b89e4eceb5b380eecf7fd6dc2144c5054de1303f
4438
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Jonathan Katz
|
2b4437a566 |
Fix spaces in script package name causing validation failure (#47945)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44710 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed validation failures when script packages contain spaces in their names during GitOps operations. * Script-based installer packages are no longer incorrectly validated as standard URLs. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Carlo
|
47db1a63bd |
Fix host software details dropping pending installs/uninstalls (#47954)
**Related issue:** Related to #47839 Follow-up to #47949 (same root cause, same issue). That PR fixed the OR-dominance drop out in the software *title summary* queries; this applies the same fix to the four per-host queries behind a host's *software details* page. A host with more than one queued install or uninstall for the same installer, VPP app, or in-house app could disappear from its software details page: the old self anti-join's `(priority < OR created_at >)` predicate let two rows eliminate each other, so neither survived. This rewrites those four queries (`hostSoftwareInstalls`, `hostSoftwareUninstalls`, `hostVPPInstalls`, `hostInHouseInstalls`) to rank with `ROW_NUMBER()` and keep one row per item. No performance change — these are per-host queries. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] `SELECT *` is avoided and SQL injection is prevented (named placeholders used for all values in the modified statements). ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where installers, VPP apps, and in-house apps could disappear from a host's software details page when multiple install or uninstall actions were queued for the same item. * **Tests** * Added regression tests to prevent this issue from recurring. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Luke Heath
|
383d20cb26 | Adding changes for Fleet v4.87.0 (#47109) (#47958) | ||
|
Carlo
|
3f5b58888f |
Fix software title page timeout for large upcoming-activity backlogs (#47949)
**Related issue:** Resolves #47839 The software title details page (`GET /api/v1/fleet/software/titles/{id}`) could take minutes to load and return a 500 or 502 when an installer, VPP app, or in-house app was scoped to many hosts. The cause was the status summary query. To find each host's most recent pending activity, it joined `upcoming_activities` to itself, and an `OR` in the join condition stopped MySQL from using an index. The query got much slower as the pending backlog grew. This rewrites the query in all three summary functions (`GetSummaryHostSoftwareInstalls`, `GetSummaryHostVPPAppInstalls`, `GetSummaryHostInHouseAppInstalls`) to use a `ROW_NUMBER()` window function. It filters to the installer or app first, then picks each host's most recent activity, which removes the self-join. It also fixes a related bug where the old `OR` condition could drop a host from the counts. Verified live against a 6,000-host backlog. The page went from ~12.7s to ~1.1s with identical status counts. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-chan ges.md#changes-files) for more information. - [x] `SELECT *` is avoided and SQL injection is prevented (named placeholders used for all values in the modified statements). ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Before (reproduction): [before.webm](https://github.com/user-attachments/assets/f03154d5-6062-42e3-81d3-ce33b0809145) ## After (fix): [after.webm](https://github.com/user-attachments/assets/b6d1ce53-7778-4023-84b7-56c49d846649) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed software title details pages timing out for installers, VPP apps, and in-house apps when hosts have large backlogs of pending activities. * Improved pending software install status selection to prevent hosts from being dropped or counted inconsistently when multiple upcoming activities exist. * **Tests** * Added regression coverage for upcoming-per-host counting without dropouts when multiple queued activity entries share the same host and app context. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
0301aea831 |
Add more filtering to Vulnerability Exposure chart (frontend) (#47674)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** For #44746 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually - [x] Changing the filters in the UI causes the related API params to be set - [x] Changing the software filters causes the "filtered" tooltip to show up and include info about software filters - [x] Changing the host filters causes the "filtered" tooltip to show up and include info about host filters - [x] Changing both host and software filters causes the "filtered" tooltip to show up and include info about both filters - [x] CVE search works and utilizes infinite scroll <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Added software category filtering options to vulnerability charts. * Added EPSS range filtering with validation to refine results. * Added known exploit toggle and CVE exclusion capabilities. * Improved filter status display with tabbed interface. * **Tests** * Added comprehensive test coverage for software filtering and validation logic. * **Style** * Enhanced filter UI styling and interactivity. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Carlo
|
a024d8e26a |
Fix policy and report pages showing previously viewed content (#47767)
**Related issue:** Resolves #43310 Read-only policy and report detail pages rendered their displayed fields (name, description, resolution, platforms, query) from the editing context (`PolicyContext`/`QueryContext`), which only updates in react-query's `onSuccess`. On a cached revisit, `isLoading` is `false` (no spinner) and the freshly-loaded entity is available immediately, but the context still held the previously-viewed entity's values for a frame — briefly showing the wrong policy/report. This change makes both detail pages render directly from the fresh `useQuery` result (`storedPolicy`/`storedQuery`) and drops their coupling to the editing context, matching the existing `HostDetailsPage`/`SoftwareTitleDetailsPage` pattern. `QueryDetailsPage` (Reports) had the identical latent bug and is fixed here too. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually New regression tests (`PolicyDetailsPage.tests.tsx`, `QueryDetailsPage.tests.tsx`) seed the context with stale values and assert the page renders the freshly-loaded entity instead. Verified live against a running Fleet instance with Playwright: navigating between cached detail pages no longer flashes the previous entity's content. [6f7d6d22134dc1fd968f8473c552ee49.webm](https://github.com/user-attachments/assets/c8ef5f3f-278c-4e13-adc1-689b3eff4e59) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit ## Release Notes * **Bug Fixes** * Resolved an issue where policy and query details pages could briefly display previously viewed policy/report information when switching between items. * **Tests** * Added regression coverage to ensure the UI renders freshly loaded policy/query name, description, and query/report details, and does not show stale values. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
fcd99a1842 |
Fix GenerateHostStatusStatistics query so that hosts enrolled chart is accurate (#47791)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #47605 # Details The queries in GenerateHostStatusStatistics (which feeds the host_summary API) were incorrectly filtering out hosts that had been removed from ABM from the denominator (i.e. "total hosts") count, while keeping them in the per-platform counts. This PR fixes the query so that the sum of the platforms matches the total. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually **Before** <img width="499" height="420" alt="image" src="https://github.com/user-attachments/assets/9b8d22bc-1dac-49e6-9d2f-8ce9ffda5f17" /> **After** <img width="501" height="420" alt="image" src="https://github.com/user-attachments/assets/fe3705b7-9a90-4d9c-a9dc-b04b2905f3fb" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue causing incorrect platform percentage breakdowns in the "Hosts enrolled" dashboard chart. * Corrected host status calculations to ensure accurate total and per-platform host counts by properly handling device enrollment assignment records. * **Tests** * Added regression tests to validate the correct handling of device enrollment records in host status calculations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
5368b99636 |
Policy status page: automation activity history, reset endpoint, and details UI
Resolves #38670 Adds the backend and frontend for the Policy status page — a historical, per-host view of policy automation outcomes — plus a way to reset a policy's results. |
||
|
Scott Gress
|
208715e2c8 |
Update some GitOps error messages for clarity (#47134)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45639 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually A bit hard to replicate these ones, but they're text changes only. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved error message clarity for macOS setup assistant and bootstrap package workflows, including more precise identification of the failed operation (such as verifying or uploading) and better details for script-reading failures. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
c370a9672b |
Add CVE chart filtering and non-critical CVE data collection (backend) (#47470)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44746 # Details * Adds the ability to filter historical CVE data by software type, EPSS, CVSS, CVE ID (exclude only) and "has known exploit" * Hard-codes the CVSS filter to 9.0+ for now, since that's the only data that's been collected thus far * Un-gates the collection code so that it will collect CVE data for _all_ severities (but still in the restricted set of software) Related PRs [update the front-end](https://github.com/fleetdm/fleet/pull/47674) to allow sending these filters, and [update GitOps](https://github.com/fleetdm/fleet/pull/47634) to allow changing the default filters. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually ### Manual test plan — CVE chart filtering (backend smoke test) #### Setup - Premium dev server running with a few hosts carrying vulnerable software (so `cve_meta` / `software_cve` / `operating_system_vulnerabilities` are populated) - Chart data present — collector ran once, or seeded: `go run ./tools/charts-backfill --dataset cve --use-tracked-cves --days 7` - API token exported and helper set: ```bash BASE=https://localhost:8080/api/v1/fleet/charts peak() { curl -sk -H "Authorization: Bearer $TOKEN" "$BASE/$1" | jq '[.data[].value] | max'; } #### Checks (compare against the no-filter baseline) - [x] Baseline returns data — GET /charts/cve?days=7 returns a data series; .filters is empty/default - [x] Severity force-pinned to critical — cve?days=7 and cve?days=7&severity_min=0&severity_max=10 give identical peaks (no low-severity leak; client severity ignored) - [x] Category narrowing — software_categories=browsers ≤ baseline; software_categories=os,browsers,office,adobe == baseline - [x] OS category includes kernel — software_categories=os returns OS-vuln + Linux-kernel CVE counts - [x] Known-exploit narrowing — known_exploit=true ≤ baseline - [x] EPSS narrowing — epss_min=0.9 ≤ baseline; epss_min=0&epss_max=1 == baseline (EPSS is 0.0–1.0 on the API) - [x] Exclude is subtractive + tolerant — excluding a visible CVE lowers/keeps counts; exclude_cves=CVE-0000-00000 == baseline (no-op) - [x] Filters echo back — filtered requests return applied values under .filters - [x] Uptime untouched — GET /charts/uptime?days=7 returns its normal series - [x] Free-tier safety (optional) — on non-Premium, /charts/cve returns an empty series, no error - [x] > 0 rows from: SELECT COUNT(DISTINCT scd.entity_id) AS below_critical FROM host_scd_data scd JOIN cve_meta cm ON cm.cve = scd.entity_id WHERE scd.dataset='cve' AND cm.cvss_score < 9.0; - (confirms lower-severity CVEs are stored) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary of changes * **New Features** * Added advanced CVE chart request filters: software categories, known-exploit flag, EPSS min/max, severity min/max, and excluded CVEs. * Expanded CVE chart coverage to use the full “collectible” CVE set, with filtering applied when serving chart data. * **Tests** * Added coverage for collecting collectible CVEs and resolving chart entities based on filter combinations and exclusions. * **Chores** * Updated CVE chart backfill to use collectible CVE discovery. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon Katz
|
2044c77243 |
Improve session handling during password reset (#47860)
# Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Summary Align `PerformRequiredPasswordReset` with the other two password-change paths (`ChangePassword` and `ResetPassword`) by clearing sessions on completion. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Bug Fixes** * Password reset process now clears all active sessions. When a required password reset is enforced, users are automatically logged out of all active sessions and must re-authenticate with their new password. This improves security by ensuring users cannot maintain access to the account during a password reset operation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrew Mellor
|
013ccf406e |
45640 Add activity feed entry when a custom Apple or Windows MDM command is run (#47743)
**Related issue:** Resolves #45640 - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Running custom MDM commands on Apple or Windows devices now creates activity log entries that appear in both the global activity feed and host-specific activity feeds. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Carlo
|
25a57c7808 |
Fix tooltips to center of label row (#47861)
**Related issue:** Resolves #44325 ## Summary In GitOps mode, disabled settings fields show a "Manage in YAML (GitOps mode)" tooltip via `GitOpsModeTooltipWrapper`. The wrapper passed the entire field (label + input + help text) to the shared `TooltipWrapper`, so react-tooltip anchored to the whole field's bounding box. For `position="left"`/`"right"` fields this centered the tooltip vertically across the field, landing the arrow between the input and the help text instead of at the label. This change anchors the tooltip to the field's label/control row (via react-tooltip-5 `anchorSelect` scoped to a unique wrapper id), so the arrow points at the label regardless of input, help-text, or tooltip-content length. The change is contained to `GitOpsModeTooltipWrapper`, leaving `TooltipWrapper` untouched. Non-field usages (buttons, icon rows) fall back to the previous whole-element anchoring. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Verified manually with Playwright against a live instance in GitOps mode: the tooltip arrow points at the checkbox/control row (incl. fields with help text) and at the label for `isInputField` inputs; button usages are unchanged. <img width="1726" height="1041" alt="Screenshot 2026-06-18 at 15 31 08" src="https://github.com/user-attachments/assets/58229743-58d4-4b26-b69d-c78ca2e6b3b1" /> <img width="1721" height="1040" alt="Screenshot 2026-06-18 at 15 30 58" src="https://github.com/user-attachments/assets/253db973-2a57-4f62-9d6f-2d18f0c2a7ca" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected GitOps mode tooltip positioning for disabled settings fields. Tooltips now properly target field labels instead of the combined label/input/help element area, improving visual alignment and clarity. * **Tests** * Enhanced test coverage for GitOps mode tooltip anchoring with tests for single form fields and grouped field controls to ensure correct positioning behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
97f28d632b |
Fixed Windows MDM not re-installing fleetd (#47852)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #47259 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Windows MDM now properly re-installs fleetd when a device is wiped and re-enrolled via Autopilot/Entra, preventing the Enrollment Status Page from hanging. * **Tests** * Added comprehensive test coverage for fleetd presence detection across multiple enrollment scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin Sykulev
|
b32ceb72e1 |
Added variables in Android configuration profiles (#47750)
**Related issue:** Resolves https://github.com/fleetdm/fleet/issues/41968 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for using Fleet variables (`$FLEET_VAR_HOST_*`) in Android configuration profiles, enabling per-host dynamic value substitution during deployment. * **Improvements** * Strengthened Android profile validation to reject unsupported Fleet variables and prevent invalid placements (for example, using variables in JSON object keys or non-string fields). * Enhanced deployment behavior when variables can’t be resolved for a host, marking affected profiles as delivery failed and avoiding partial policy application. * Improved Android per-host rollout by applying installs in staggered batches for smoother throughput. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
a619660636 |
Fix out-of-order Windows MDM fleetd install commands (#47683) (#47736)
The fleetd install Add and Exec were enqueued as two separate Windows MDM commands ordered only by created_at (1-second granularity), so they could be delivered Exec-before-Add. The device then ran DownloadInstall on a not-yet-created node, returned 404, and fleetd never installed, which could hang the Windows Autopilot Enrollment Status Page. Enqueue them as a single command so Add always precedes Exec. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #47683 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed intermittent fleetd installation failures during Windows MDM enrollment that could cause the Windows Autopilot Enrollment Status Page to hang. * **Documentation** * Updated Windows MDM fleetd installation documentation to reflect the fix. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
1c2b229805 |
Add current-timeframe border and 'No data' tooltip to checkerboard chart (#47812)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #47811 # Details - Outline the slot containing 'now' (the timeframe still being collected) with a fleet-black-50 border. - Show 'No data' instead of a host count in the tooltip for the current and future timeframes. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <img width="708" height="416" alt="image" src="https://github.com/user-attachments/assets/2878c72b-6c56-4302-b77f-2c9ebdaf9c8c" /> <img width="706" height="412" alt="image" src="https://github.com/user-attachments/assets/a17a37a3-7264-42aa-9880-db3c68946c56" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enhanced checkerboard graph visualization to clearly distinguish current time slots from future (uncollected) time slots with distinct visual styling * Updated tooltips and accessibility labels to display "No data" for future time periods * **Tests** * Added test coverage for current and future time cell behavior <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
a2757a1d7c |
Don't require end user auth on orbit re-enrollment (#46300) (#47740)
Windows and Linux hosts that had already orbit-enrolled were prompted for end user authentication (an SSO browser tab) when fleetd re-enrolled after a service restart, node key file loss, or osquery DB rebuild. Hosts enrolled before EUA was enabled have no host_mdm_idp_accounts row, so the service-layer EUA gate treated every re-enroll like a brand-new device. Before returning END_USER_AUTH_REQUIRED, EnrollOrbit now checks whether a host matching the enrollment identifiers already exists and previously held an orbit node key (HostPreviouslyOrbitEnrolled, reusing matchHostDuringEnrollment's semantics). If so, the re-enroll proceeds without prompting. Genuinely new devices, and hosts moved to a different Fleet server, are still gated. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46300 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit **Bug Fixes** * Fixed unnecessary end-user authentication prompts for Windows and Linux hosts during fleetd re-enrollment after a service restart. Previously enrolled devices can now re-enroll without being prompted for SSO authentication, while new devices still require the appropriate authentication. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Noah TalermanandSharon
|
a43856a774 |
Better error message: Missing private key when adding a custom variable (#47785)
- [x] QA'd all new/changed functionality manually For the following quick win: - https://github.com/fleetdm/fleet/issues/47784 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved the error message shown when saving a custom variable fails due to a missing required private key configuration, including a direct link with guidance to resolve it. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Sharon <sharon@fleetdm.com> |
||
|
Magnus Jensen
|
b28e6ceaaf |
filter OS versions platforms (#47742)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46322 I'm not sure why, but it already had pagination? I suspect the frontend filtering was breaking it, so I moved the platform filtering to the backend via the `MatchQuery` query param. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Bug Fixes** * Fixed pagination for OS version lists containing more than 8 entries. * Improved OS version filtering so platform queries are applied consistently before pagination, yielding correct results and counts. * Enhanced OS version list coverage with a new test validating platform-specific filtering and ordering. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
e4025a8193 |
Always display Windows ESP error when software install fails (#47522)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45948 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Updated Windows ESP failure copy with clearer “Reset your device to try again…” wording. * When not all apps are required, added a **“Reset PC and Continue Anyway”** soft-block option and continuable error text that lists failed app names with truncation (“N more”). * **Bug Fixes** * Improved SyncML generation by escaping XML-sensitive characters in embedded text. * **Tests** * Added/expanded unit and property-based tests covering continuable error formatting, soft-block behavior, and SyncML XML escaping. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven PalmesanoandJuan Fernandez
|
435c6e130b |
Display instructions needed for SSO-enabled accounts with fleetctl (#46768)
**Related issue:** Resolves #21818 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * The CLI now detects when SSO is enabled on the server and shows a warning directing users to authenticate with an API token (with guidance link) instead of email/password. * **Bug Fixes** * Authentication error messaging is now SSO-aware, improving guidance when credential login fails. * **Tests** * Added coverage to verify the authentication guidance changes correctly based on whether SSO is enabled. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Juan Fernandez <juan@fleetdm.com> |
||
|
Magnus Jensen
|
e14f6e67c1 |
fix gitops relative paths for unassigned and org_settings (#47512)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45661 I couldn't really find another good solution that would solve it all, as the path resolution is spread out, plus unassigned merging into global config definitely makes it more complex (root cause of the issue). # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed GitOps relative path resolution so controls and nested organization settings correctly resolve referenced files from their source directory, including cases with `unassigned.yml`. * Corrected macOS setup assistant uploads to use the base filename instead of the full configured path/URL. * **Tests** * Added regression coverage for GitOps relative path handling across working-directory and nested-file scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin Sykulev
|
ead9d40293 |
Added FLEET_VAR_HOST to android configs (#47642)
**Related issue:** Resolves #45353 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Added support for `$FLEET_VAR_HOST_*` variables in Android managed app configurations, including host UUID, hardware serial, platform, and end-user IdP details. * **Improvements** * Android app configurations are now validated to reject unsupported Fleet variables. * Fleet variables are substituted with real per-host values during Android app configuration deployment, including batch/GitOps and host-specific workflows. * **Tests** * Added unit and integration coverage for supported/unsupported variables, substitution behavior, and JSON escaping. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin Sykulev
|
8e3f17804e |
Clear idp cookie after succesful SSO (#47569)
**Related issue:** Resolves #47343 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for providing an identity provider (IdP) UUID in enrollment-token requests via an `idp_uuid` query parameter, affecting both fully-managed and non-fully-managed flows. * Enrollment OTA now carries the IdP UUID into the enrollment flow and token request, with server-rendered pages exposing the selected IdP when applicable. * **Bug Fixes** * For fully-managed enrollments, the IdP/SSO cookie is cleared after successful authentication to avoid stale IdP selection. * **Tests** * Extended coverage for `idp_uuid` precedence over the IdP cookie and for cookie-clearing behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Carlo
|
a189b5328d |
Fix self-service update button flashing (#47749)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44645 # Summary On the My device > Self-service page, apps that just finished updating briefly flashed the "Update" button again during the inventory refetch. The "recently updated" flag was only set by the pending-poll, so other refetch paths could surface a completed-but-stale app before it was flagged. Now a `selfServiceData`-keyed effect flags completed user actions on every data change, so the card holds "Updated" through the refetch instead of reverting. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually https://github.com/user-attachments/assets/c9a6ee13-c1f9-4ba0-a704-a578552a5dcd <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Resolved an issue on the **My device > Self-service** page where the **“Update”** button could briefly reappear after app updates, even though the card should remain in the **“Updated”** state until the software inventory refresh completes. * **Tests** * Added coverage to ensure the **“Updated”** UI state persists while inventory refetch is pending, and that the **“Update”** button does not render during that window. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
fe4d74edc2 |
Join MDM for missing status for non osquery devices (#47672)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46243 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed incorrect reporting of iOS, iPadOS, and Android hosts as missing (including MIA and missing-over-30-days counts). * Host status filtering and dashboard cards now correctly fall back to Apple MDM activity when OSQuery “last seen” data is unavailable, preventing recently active devices from being flagged. * **Tests** * Added coverage to verify iOS/iPadOS hosts aren’t treated as missing when Apple MDM “last seen” is recent, and are flagged once it becomes stale. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
ef0aed3b3f |
Move tooltip for vulnerability support to "Not supported" (#47074)
**Related issue:** Resolves #44109 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Updated the Vulnerabilities column on the Software > OS page: "Not supported" cells now include a tooltip relocated to the unsupported indicator that explains which platforms support vulnerability detection, and a "Learn more" link to Fleet documentation. Copy clarified to make platform support and next steps more visible to users. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
ec1d8fb30c |
Paginate Fleet-maintained apps and filters (#47615)
Fix the Fleet-maintained apps list being cut off by adding server-side pagination and applying platform / "hide added apps" filters across the full library. Introduces MaintainedAppListOptions (with Platform and AvailableOnly) and changes the ListAvailableFleetMaintainedApps / ListFleetMaintainedApps signatures. Datastore now paginates and counts by distinct app name, fetches all platform rows for apps on a page, and returns a count and pagination metadata; default client page size set to 500. Frontend no longer performs client-side filtering or local status/platform state; it relies on the API and uses data.count for totals. Docs, tests, mocks, and various call sites updated (including a new test that verifies pagination, platform and availability filters). <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fleet-maintained apps listing now paginates server-side (100 per page) so entries near the end of the alphabet are reachable. * Platform and “Hide added apps” filters are applied across the entire library, not just the currently loaded subset. * The displayed count now matches results by counting macOS and Windows versions separately. * **New Features** * Listing now supports URL-driven platform and “available” filtering, and the UI consistently reflects the active filter state. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
cbae661149 |
Show actual number of selected hosts (#46334)
**Related issue:** Resolves #40502 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed "select all matching hosts" to display the actual total count instead of showing an estimate like "50+" in table headers and delete confirmation dialogs. * **Tests** * Updated test cases to reflect accurate host count display behavior when selecting all matching hosts. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46334?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George Karr
|
295e0f8501 |
Adding changes for Fleet v4.86.2 (#47219)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Resolved an issue where team-scoped host vitals labels (from IdP attributes) failed to populate associated hosts correctly. * **Chores** * Updated Fleet/Helm chart versions and container image/CLI package tags from v4.86.1 to v4.86.2 across the deployment chart, values, infrastructure defaults, and tooling manifest, with no other configuration changes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
a627f87113 |
Fix scrollbar showing up when not needed in report/policy results tables (#47627)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44272 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually Pages tested: ``` https://<fleet_url>/hosts/<host_id>/reports/<id> https://<fleet_url>/reports/<id>?fleet_id=<fleet_id> https://<fleet_url>/reports/<id>/live?fleet_id=<fleet_id> https://<fleet_url>/policies/<id>/live?fleet_id=<fleet_id> ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed unnecessary horizontal scrollbars appearing in report and policy results tables. Scrollbars now display only when content requires horizontal scrolling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
ed195c860f |
Navigate back to the report details page after saving a report (#46754)
**Related issue:** Resolves #38928 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * After saving report edits, the UI now redirects users back to the report details page. * URL context (host_id and fleet_id) is preserved during this navigation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
1b0001fdd1 |
Positive language checkboxes (#47603)
**Related issue:** Resolves ##39323 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated checkbox labels and tooltips across settings to use positive language (describing enabled outcomes like “Store data” and “Bypass for non-critical policies”). * Adjusted checkbox behavior to match the new checked-state semantics for data retention, feature toggles, and conditional access bypass (including revised default/tooltip copy). * **Tests** * Updated assertions to reflect the new checkbox/help text wording and checked/unchecked expectations in advanced settings and discard-data options. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dante Catalfamo
|
295e2b3af0 |
Filter vulnerable software by cvss on my device page (#47372)
**Related issue:** Resolves #35694 |
||
|
Carlo
|
37493e7d51 |
Show .sh scripts in macOS setup experience (#47629)
Resolves #43667 |
||
|
Nico
|
12d2aba40c |
Fix macOS "Update new hosts to latest" staying enabled in GitOps after clearing version/deadline (#45984) (#47602)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45984 Fix is applied on the GitOps side since that's what I figured the customer was using on the [Slack thread](https://fleetdm.slack.com/archives/C061ZA91Y1J/p1779372669701129). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually #### Before Reproduced on `main`: - Set `update_new_hosts: true` beforehand. - Ran `gitops` with `update_new_hosts` commented out. It was still kept as `true`. https://github.com/user-attachments/assets/f6b41f0d-38e6-468f-a605-b3e66b7b2dbc #### After Running `gitops` with `update_new_hosts` commented out switched its value to `false`. https://github.com/user-attachments/assets/24756063-b3a9-400b-a2cc-208dd816a556 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected GitOps behavior for the macOS “Update new hosts to latest” setting so it no longer stays enabled after clearing `minimum_version` and `deadline`; it now defaults to disabled unless both are set. * **Tests** * Added GitOps test coverage to verify the defaulting outcomes across YAML variations for the macOS update settings, including explicit and empty field combinations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
76de4adfcb |
BYOF: Add support for unique token ADUE (#47407)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45598 1. Apple disregards query params in the 403 WWW-Authenticate URL, so setting it as the ?initiator= does not work, had to make a new route on the frontend to match the same URL but with a dynamic token. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary * **New Features** * Added support for a configured default fleet/team for BYO Apple enrollment. * Enabled account-driven Apple MDM enrollment using per-enrollment tokens. * Added tokenized Apple MDM service discovery and enrollment endpoints. * **Bug Fixes & Improvements** * Added automated daily cleanup of expired enrollment challenges. * Improved BYOD/account-driven enrollment challenge handling, including default team assignment and Managed Apple ID updates. * Reduced unnecessary BYOD MDM profile refetches during reenrollment. * **Tests** * Expanded coverage for token lookup, enrollment challenges, and updated BYOD/account-driven flows. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin Sykulev
|
ab64d0e657 |
Throttling android software installs (#47461)
**Related issue:** Resolves #41910 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Configurable Android app operation batch size (FLEET_MDM_ANDROID_BATCH_SIZE, default 1000) to reduce Android Management API load. * Android software install and app-availability operations now run in batched, staggered jobs across workers to improve reliability and avoid API throttling on large fleets. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
c57e54c529 | Filter OTEL by environment (#47574) | ||
|
Jonathan Katz
|
75a822fb91 |
Show Fleet Premium message when viewing install details modal on Fleet Free (#47551)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44617 Screenshot: <img width="1318" height="528" alt="image" src="https://github.com/user-attachments/assets/4ec4bd85-8efb-4729-86ad-ea3059439b60" /> Note that the uninstall details modal is viewable without any errors on Fleet Free, so maybe we should address that at some point. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * When accessing software install details without a Fleet Premium license, the activity modal now displays a Fleet Premium upsell message with a "Learn more" link instead of a generic error, providing clearer guidance to upgrade. * **Tests** * Added test coverage for the Fleet Premium license requirement scenario in the install details modal. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
4fdd4bd3b4 |
Fixing Windows SCEP issues (#47255)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #47492 and Resolves #46982 - Fixed panic when uploading bad profile - Added validation for SCEP challenge to exclude underscore (and other non-printable characters). # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Prevented a server panic during Windows configuration profile validation when SCEP and non-SCEP elements are mixed; such profiles are now rejected with a clear validation error. * **New Features** * Enforced Windows-compatible printable characters for Custom SCEP proxy challenge values; rejects disallowed characters while preserving legacy values unless changed. * **UI / Validation** * Improved form validation feedback for the Custom SCEP challenge field, showing errors and disabling submit for invalid input while allowing masked/unchanged values. * **Tests** * Added regression and unit tests covering profile validation and challenge character validation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
207d41e995 |
Windows MDM reconciler cleanup and remaining fixes (#47493)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45635 - Refactored setup experience flow to use host-specific reconciler methods - Removed now unneeded reconciler methods # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Windows configuration profiles are now queued immediately when a host enrolls in Windows MDM, so profile delivery happens during the same check-in instead of waiting for the next reconciliation cycle. * Windows MDM enrollment finalization now runs per-host reconciliation and will block release until that reconciliation completes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin Sykulev
|
2ad76714ce |
Throttle requests to AMAPI during profile reconcilation (#47223)
**Related issue:** Resolves #41910 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a configurable env var to limit Android MDM profile reconciliation batch size (FLEET_MDM_ANDROID_PROFILES_BATCH_SIZE; default 1000). * Reconciliation now processes hosts in cursor-based, batched windows and persists a reconciliation cursor to resume/advance work, reducing peak API load and enabling pagination. * **Tests** * Added validation tests for the batch-size config and tests verifying cursor-based pagination and processing. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
ac6aa7329c |
Improve SAMLResponse validation in SSO callbacks (#47463)
- [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security Enhancements** * Enforced strict size limits for SAMLResponse payloads and rejected overly large submissions. * Added protections against deeply nested or excessively large SAML XML documents. * Applied rate limiting to SSO/authentication callback endpoints (configurable via Auth settings). * **Tests** * Added tests verifying SAMLResponse size and XML shape validation behavior. * **Documentation** * Noted these SSO validation and rate-limiting changes in the changelog. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
2c8b21a782 |
Defer Windows MDM profile removals via pending-delete retention (#47156)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46993 Requires #47071 to merge first Loadtest shows reduction of batch delete of 40 profiles for 30K hosts down to ~3.9 seconds. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Bug Fixes** * Resolved timeout issues when removing large numbers of Windows configuration profiles from teams with many hosts. * **New Features** * Windows profile deletions now process asynchronously in the background, enabling faster API responses and consistent behavior with profile delivery operations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Carlo
|
6735479a5d |
Make ctxerr treat 4xx errors as client errors (#47415)
**Related issue:** Resolves #45855 |
||
|
Lucas Manuel Rodriguez
|
cf6a8a29c0 |
Fix command line flags in agent settings UI (#47414)
Resolves #47412. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Agent settings editor now renders empty or null command-line flags visibly (instead of hiding them), preserving their clearing behavior for host-level settings. * **Tests** * Added tests to validate YAML output and formatting for command-line flags, missing keys, and related edge cases. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
b4c32d279e |
Policies: Include/Exclude label targeting in Save policy modal (#33441) (#47213)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46583 Figma: https://www.figma.com/design/0F1sw63SuYaKVWlcL7mnc6/-33441-Policies--Custom-targets-with-%22Include-any%22-and-%22Exclude-any%22?node-id=5303-5687&t=Fszpf83KhcZ7ViWh-0 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Note: policy creation will fail if more than one inclusion/exclusion option is provided. This will be addressed as part of https://github.com/fleetdm/fleet/issues/46582 (we'll relax that check to make sure we can accept a combination). https://github.com/user-attachments/assets/9cfbcbca-54ce-4978-8248-7d550f18785b https://github.com/user-attachments/assets/16138fb1-da7c-4838-8819-f370bf7072c1 Empty state: <img width="850" height="628" alt="Screenshot 2026-06-10 at 11 30 45 AM" src="https://github.com/user-attachments/assets/141c4d26-e464-4ae1-b6ed-94d24a640e1c" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Add optional "exclude all" label targeting for policies (labels_exclude_all) and tab-based Include/Exclude targeting UI. * **Improvements** * In-modal navigation to add new labels; Custom targeting requires at least one selected label to enable Save. * Payloads now include include/exclude label fields when using Custom targeting. * **Tests** * Updated modal tests to cover exclude-tab label selection. * **Style** * Improved empty-state border styling in label selector. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
b4dcea8a82 |
Improved Windows MDM reconciler (#47071)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45635 Moved profile reconciler work from SQL to code, similar to what Apple MDM team did last sprint. The Windows MDM loadtest for 40 profiles with 30K hosts looks much better. ``` ┌──────────────────────────┬─────────────────────────────────────────┬───────────────────────────────────────────┐ │ │ Pre-fix baseline │ This branch │ ├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤ │ Transfer wall time │ ~40–42 min │ ~15.5 min │ ├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤ │ Per work tick │ 215–257s (host-finding query dominated) │ ~48s (host-finding gone; now bulk writes) │ ├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤ │ Ticks > 30s (work ticks) │ ~all │ ~all (16/17, ~48s) │ ├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤ │ Pacing governor │ the host-finding query │ the 2000-host delivery cap + 30s interval │ └──────────────────────────┴─────────────────────────────────────────┴───────────────────────────────────────────┘ ``` The writer spikes briefly to 16 AAS, but has CPU headroom, so I'd say we can claim to support 40 profies on 30K hosts. ``` ┌───────────────┬───────────────┬───────────────────────────┬───────────────────────────────────────┐ │ Instance │ CPU avg / max │ DBLoad avg / max (4 vCPU) │ Read / Write / Commit latency │ ├───────────────┼───────────────┼───────────────────────────┼───────────────────────────────────────┤ │ writer -two │ 67.9% / 74.9% │ 4.84 / 16.0 │ 0.28ms / 2.07ms / 10.6ms (max 12.2ms) │ ├───────────────┼───────────────┼───────────────────────────┼───────────────────────────────────────┤ │ reader -one │ 46.1% / 52.7% │ 1.19 / 5.0 │ 1.59ms / — / — │ ├───────────────┼───────────────┼───────────────────────────┼───────────────────────────────────────┤ │ reader -three │ 65.4% / 70.1% │ 1.77 / 5.0 │ 1.72ms / — / — │ └───────────────┴───────────────┴───────────────────────────┴───────────────────────────────────────┘ ``` # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Reworked Windows MDM reconciliation to a snapshot-based, batched drain-loop, improving responsiveness and reducing database load during large profile operations. * **Performance / Reliability** * Windows MDM profile changes now reach hosts faster; large team-wide profile additions/removals (including host transfers) complete more quickly with lower DB impact. * **Chore / Configuration** * Added tunables to control per-tick delivery caps and scan budgets. * **Tests** * Expanded end-to-end and property tests for install/remove, team/label gating, and multi-window drain behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
