bae2ba7e1088ef346d81f85c3fa2c7ef91eee300
24095
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Justine Hoang
|
bae2ba7e10 |
Update README.md (#44926)
Fixed typo "during" under the Confirm CEO shadow dates section |
||
|
Sean Hannon
|
f59766db38 |
Fix broken link for Sean Hannon in CS README.md (#44895)
Missing https:// in original commit <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Luke Heath
|
071cfb3c73 | Add temporary workflow to clear legacy Trivy alerts (#44942) | ||
|
Noah TalermanandRachael Shaw
|
62c1033868 |
tools/ directory: Rename "queries" => "reports" and "teams" => "fleets" (#43575)
For the following issue: - https://github.com/fleetdm/fleet/issues/41419 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated tooling and documentation wording across scripts, utilities, and infrastructure files to reflect the product terminology change from “teams” to “fleets” (references now note “fleets” and indicate the former “teams” naming). <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Rachael Shaw <r@rachael.wtf> |
||
|
|
e4edb1b3e4 |
Handbook: Add "Mark an account as a Top target" section to GTM operations (#44896)
## Summary - Adds a new "Mark an account as a Top target" section to the Go-To-Market operations handbook page - Placed after the existing "Remove a contact from the Top contacts list in Salesforce" section, as both relate to account/contact management in Salesforce ## Changes - `handbook/company/go-to-market-operations.md`: Added new `### Mark an account as a "Top target"` section with instructions for labeling accounts and a callout about stack ranking target accounts. --- Built for [Sam Pfluger](https://fleetdm.slack.com/archives/D0AF8QFBVHB/p1778106382921239?thread_ts=1775094096.519039&cid=D0AF8QFBVHB) by [Kilo for Slack](https://kilo.ai/slack) --------- Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com> |
||
|
Lucas Manuel Rodriguez
|
f4bae86e0d |
Ignore critical CVE in fleetdm/fleetctl docker image (#44939)
Fixes: https://github.com/fleetdm/fleet/actions/runs/25480975109/job/74764798920 New run: https://github.com/fleetdm/fleet/actions/runs/25504007303. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security** * Added vulnerability assessment documentation confirming fleetctl is not affected by CVE-2026-33845. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
5c3d8ae807 |
Show 'Fleet will try again.' in host activity feed for NotNow MDM commands (#44532)
Relates to: https://github.com/fleetdm/fleet/issues/44529 ## Summary - Adds "Fleet will try again." text to the host-level activity feed for MDM commands with a "NotNow" status, matching the existing behavior in the CommandDetailsModal. - Previously, users had to open the modal to see this retry information; now it's visible directly in the activity feed. ## Changes - `frontend/pages/hosts/details/cards/Activity/CommandItem/CommandItem.tsx`: When a command's `status` is `"NotNow"`, append " Fleet will try again." to the activity text displayed in the feed. ## QA 1. Navigate to a host details page with MDM commands enabled. 2. Trigger or find a command with "NotNow" status (host locked or running on battery in Power Nap). 3. Verify the activity feed item shows "The **{command}** command is deferred. Fleet will try again." 4. Verify the CommandDetailsModal still shows the full deferred message with "Fleet will try again." --- Built for [Mel Pike](https://fleetdm.slack.com/archives/D0AKX7DJFCN/p1777575458215749?thread_ts=1777299502.461149&cid=D0AKX7DJFCN) by [Kilo for Slack](https://kilo.ai/slack) Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> Co-authored-by: melpike <79950145+melpike@users.noreply.github.com> |
||
|
Mike McNeil
|
e0da361901 | Update device-management.ejs (#44941) | ||
|
Allen Houchins
|
83b746cc15 |
Create fleetctl pkg asset every release (#35089)
|
||
|
dependabot[bot]
|
3292f0eb47 |
Bump github.com/apache/thrift from 0.22.0 to 0.23.0 (#44889)
Bumps [github.com/apache/thrift](https://github.com/apache/thrift) from 0.22.0 to 0.23.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/thrift/releases">github.com/apache/thrift's releases</a>.</em></p> <blockquote> <h2>Version 0.23.0</h2> <p>Please head over to the official release download source: <a href="http://thrift.apache.org/download">http://thrift.apache.org/download</a></p> <p>The assets listed below are added by Github based on the release tag and they will therefore not match the checkums published on the Thrift project website.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/apache/thrift/blob/master/CHANGES.md">github.com/apache/thrift's changelog</a>.</em></p> <blockquote> <h2>0.23.0</h2> <h3>Build Process</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5877">THRIFT-5877</a> - Add cpp cross tests</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5866">THRIFT-5866</a> - Dockerfile to support Ubuntu 24.04 LTS (Noble Numbat)</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5909">THRIFT-5909</a> - add Ruby in GitHub workflow</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5649">THRIFT-5649</a> - add go in GitHub workflow / action</li> </ul> <h3>C glib</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5931">THRIFT-5931</a> - thrift_ssl_socket_get_ssl_error() can underflow its remaining-buffer counter and write past the stack buffer</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5871">THRIFT-5871</a> - Improve MAX_MESSAGE_SIZE check and friends</li> </ul> <h3>C++</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5911">THRIFT-5911</a> - Inconsistent UUID compilation for aliased types</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5912">THRIFT-5912</a> - Assertion failed: <code>delta > 0</code>, file ThreadManagerTests.h, line 162</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5880">THRIFT-5880</a> - C++ TSocket on an IPv6-only system fails if you use a hostname of 127.0.0.1</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-3268">THRIFT-3268</a> - warning: token pasting of ',' and <code>__VA_ARGS__</code> is a GNU extension</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5887">THRIFT-5887</a> - build/cmake/ should be prepended (not appended) to CMAKE_MODULE_PATH</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5878">THRIFT-5878</a> - Add UUID support for THeaderProtocol and TProtocolTap</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5898">THRIFT-5898</a> - Unable to build Thrift as a shared library on Windows</li> </ul> <h3>Contributed</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5920">THRIFT-5920</a> - Remove threadsafe warnings in thrift-maven-plugin</li> </ul> <h3>Delphi</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5939">THRIFT-5939</a> - Replace GUID generation with stable UUID algorithm</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5876">THRIFT-5876</a> - Add Delphi WinHTTP client TLS1.3 support</li> </ul> <h3>Go</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5896">THRIFT-5896</a> - Race condition in TServerSocket.Addr() method</li> </ul> <h3>Java</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5925">THRIFT-5925</a> - UUID implementation in JAVA is not according to the Thrift Specification</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5869">THRIFT-5869</a> - Close the transport after TServerEventHandler deleteContext</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5863">THRIFT-5863</a> - Make TServerTransport able to customize the max message size</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5774">THRIFT-5774</a> - Add remote client's IP address to ServerContext in TServerEventHandler</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-4280">THRIFT-4280</a> - Add async nonblocking ssl support in java client</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5879">THRIFT-5879</a> - java and kotlin cross tests fail in the GitHub action</li> </ul> <h3>netstd</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5902">THRIFT-5902</a> - Add net10 support</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/thrift/commit/e4b684f5ff4f9c3a42cd7ec0a667c3d9bd7f6ac1"><code>e4b684f</code></a> Updated CHANGES.md</li> <li><a href="https://github.com/apache/thrift/commit/c4cbe43fd12ab5d043af5dd08d1f59e2ba07b2e4"><code>c4cbe43</code></a> Address vulnerabilities in Rack</li> <li><a href="https://github.com/apache/thrift/commit/68ac8e935ef440c3e22d0e1a30e7211b9bf1d441"><code>68ac8e9</code></a> Enable TLS hostname verification in TNonblockingSSLSocket</li> <li><a href="https://github.com/apache/thrift/commit/5e4f01d737e4d3845d07dde6da43981feee0cb9a"><code>5e4f01d</code></a> Harden Node.js WebSocket server handling</li> <li><a href="https://github.com/apache/thrift/commit/e242889231df48f8791372598052862c28f5be83"><code>e242889</code></a> Add input validation to Swift protocol layer</li> <li><a href="https://github.com/apache/thrift/commit/4af8c7c8768cb687b182c1839a39d4beb4f35a5d"><code>4af8c7c</code></a> Add recursion depth limit to Node.js protocol skip()</li> <li><a href="https://github.com/apache/thrift/commit/a30c552bd0808b7e19f35ad30212ba7a9aee8c66"><code>a30c552</code></a> Enable TLS hostname verification in TSSLTransportFactory</li> <li><a href="https://github.com/apache/thrift/commit/0f8ec9c1014ed21acc324aaa421017fb164e9608"><code>0f8ec9c</code></a> Fix parent class resolution in c_glib generated dispatch_call</li> <li><a href="https://github.com/apache/thrift/commit/276ec883910cd936b4f9413bf607c808a7423185"><code>276ec88</code></a> THRIFT-5929: Fix build failure on PHP 8.5 due to removed zend_exception_get_d...</li> <li><a href="https://github.com/apache/thrift/commit/17f2c13ec2b27503dd0de2720401b96787632364"><code>17f2c13</code></a> Added missing 0.23.0 JIRA tickets to CHANGES.md</li> <li>Additional commits viewable in <a href="https://github.com/apache/thrift/compare/v0.22.0...v0.23.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Juan Fernandez
|
292bab32f6 |
Clarify SMTP TLS error and surface STARTTLS toggle (#34104)
Resolves #34104 When saving SMTP settings with SSL/TLS off, STARTTLS on, and SSL cert verification on, the test-email send produced an opaque Go cert error that gave users no actionable hint. The two TLS-related toggles also live on different settings cards with no cross-reference, which made the conflict hard to spot before hitting Save. |
||
|
Andrew Mellor
|
119feeda02 |
42218 updated ios version number to include supplemental extra (#44727)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42218 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Note: Sim update included and validated with and without supplemental, screen shots attached <img width="760" height="87" alt="Host List" src="https://github.com/user-attachments/assets/c55f0ace-a205-4242-95da-510e8e6ec4ad" /> <img width="1511" height="523" alt="Standard" src="https://github.com/user-attachments/assets/74a42e57-9391-4ce0-8b0a-ad3de6ab4745" /> <img width="1505" height="526" alt="Supplimental" src="https://github.com/user-attachments/assets/392fc603-c7a2-4d6f-8ae0-87767cab7e3c" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * iOS/iPadOS devices managed via MDM now include reported supplemental OS version text (e.g., Rapid Security Response suffixes) in the displayed OS version string. * **Bug Fixes** * Supplemental extras are validated; invalid values are ignored. Combined version strings are length-limited and safely truncated. * **Tests** * Added tests for supplemental handling, validation, fallback, and truncation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
d8a1ffae81 |
Clear stale broken label rows on profile batch upsert (#44847)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42637 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ### Reproduction steps: - Created Label X and Label Y as manual labels in the UI. - Applied gitops referencing the labels. The specified profile referenced Label X: ```yaml macos_settings: custom_settings: - path: ../repro-42637-profile.mobileconfig labels_exclude_any: - "Repro Label X 42637" ``` - Manually ran a SQL query to update `label_id` to NULL. <img width="712" height="46" alt="Screenshot 2026-05-06 at 6 19 51 PM" src="https://github.com/user-attachments/assets/32f386c7-adf3-48e8-adee-03102831e556" /> - Re-ran gitops referencing Label Y in the profile config. ```yaml macos_settings: custom_settings: - path: ../repro-42637-profile.mobileconfig labels_include_any: - "Repro Label Y 42637" ``` - Old row was preserved AND a new one was created (association to Label Y): <img width="709" height="68" alt="Screenshot 2026-05-06 at 6 22 07 PM" src="https://github.com/user-attachments/assets/fe2c4644-eb95-45a0-a582-994ad88e45be" /> ### Testing steps - Re-built fleetctl with the fix applied and re-ran gitops, still referencing Label Y for the profile. - Confirmed the orphan row was deleted. <img width="740" height="212" alt="Screenshot 2026-05-06 at 6 24 43 PM" src="https://github.com/user-attachments/assets/da9e9461-c352-4266-80b8-625a98e055ec" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Bug Fixes * Fixed an issue where MDM configuration profiles would remain enforced on hosts after their associated labels were deleted during fleetctl gitops apply operations. Label associations are now properly cleared when profiles are reapplied with updated targeting. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
b47b1fc205 |
Update chart styles / fix bugs (#44813)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44676 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. n/a, unreleased ## Testing - [ ] Added/updated automated tests just style fixes, but the ["disable features: frontend" PR](https://github.com/fleetdm/fleet/pull/44797) has some tests - [X] QA'd all new/changed functionality manually - [x] make hosts enrolled chart match height w/ checkerboard - [x] use empty boxes with outline instead of filled boxes for 0 value - [x] use dark-mode colors for green theme - [x] put host enrolled chart bars between horizontal rules instead of on top of them - [x] only show date and # of hosts in tooltip, no percentage or denominator - [X] add day of week to checkerboard tooltip - [x] use comma in tooltip numbers - [x] use relative shading in both datasets - [x] make text size match between hosts enrolled and checkerboard titles - [x] on vuln chart tooltip, add "Want more control over this chart? Comprehensive vulnerability filtering is [coming soon](link to this issue: https://github.com/fleetdm/fleet/issues/44746)." - [x] on vuln chart tooltip, fix link styling in dark mode - [x] change "Hosts active" => "Hosts online" - [x] Update tooltip copy to "The number of hosts detected online during a given hour. A host is considered online if it's actively checking in to Fleet. This includes sleeping hosts (e.g. lid closed)." - [X] Fix issue where at smaller widths, the entire page has a horizontal scrollbar - [X] Make charts stay pegged to the right side when first loaded and when resizing window Charts align: <img width="1223" height="479" alt="image" src="https://github.com/user-attachments/assets/4a7ba859-a0aa-43c6-a06b-4ef8361e2418" /> Data tooltip: <img width="162" height="77" alt="image" src="https://github.com/user-attachments/assets/5b1768e4-0736-4e45-ad49-6faf31958352" /> Vuln tooltip: <img width="387" height="123" alt="image" src="https://github.com/user-attachments/assets/98c2096f-fa4e-4b06-917e-ec6eed844b05" /> Hosts online tooltip: <img width="360" height="113" alt="image" src="https://github.com/user-attachments/assets/bd65cd1d-0f0c-4c72-a31d-ffe602cacd9c" /> For unreleased bug fixes in a release candidate, one of: - [X] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Optional relative scaling for chart visualizations * Responsive chart sizing in the Hosts Enrolled card * **Improvements** * Dataset label updated to "Hosts online" * Tooltips and labels show formatted host counts with proper pluralization * Day labels now include weekday for clearer dates * Chart descriptions mention upcoming vulnerability filtering * Tighter header, dropdown, scrollbar, and dark‑mode styling * **Tests** * Updated dataset heading test and added a relative‑scale color ramp test <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Rachael Shaw <r@rachael.wtf> Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> Co-authored-by: Luke Heath <luke@fleetdm.com> |
||
|
Scott Gress
|
684becade8 |
Allow disabling chart datasets: backend (#44769)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** For #44077 # Details This PR implements enforcement of the "disable dataset" feature. When a dataset is disabled globally, we: * Stop collecting all data for that dataset (the `Collect` method for that dataset is not called in the cron job) * Remove all previously-collected data for the dataset via an asynchronous job When a dataset is disabled for one or more fleets, we: * Provide the list of disabled fleets as an argument to each dataset's `Collect` method. Each dataset is responsible for filtering out hosts in the most efficient way possible * Scrub the data for the relevant datasets using a bitmask, so that all hosts from the disabled fleets are removed from the data. This is done via an asynchronous job. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. n/a, unreleased - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [X] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [X] Added/updated automated tests - [X] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually ### Prerequisites / Test Setup - [ ] Fleet running with at least 3 teams (call them T1, T2, T3) and ≥3 hosts in each, plus ≥2 hosts with no team - [ ] At least one host on each team has reported recent uptime (within the bucket window) - [ ] At least one host in each team is affected by a tracked CVE (so `host_scd_data` for `dataset='cve'` will have non-empty bitmaps) - [ ] AppConfig: both `features.historical_data.uptime` and `features.historical_data.vulnerabilities` start as `true`; same for every team - [ ] Let the collection cron run at least one full tick to populate baseline rows in `host_scd_data` for both `uptime` and `cve` - [ ] Note the current row count per dataset: `SELECT dataset, COUNT(*) FROM host_scd_data GROUP BY dataset;` --- ### 1. Cron Skips Globally-Disabled Datasets #### 1.1 Global disable of `uptime` - [x] Disable globally: `PATCH /api/v1/fleet/config` with `features.historical_data.uptime = false` - [x] Verify activity feed shows `disabled_historical_dataset` for `uptime` (existing behavior) - [x] Wait for next collection tick (or trigger it via fleetctl debug if available) - [x] Confirm **no new rows** appear for `dataset='uptime'`: `SELECT MAX(valid_from) FROM host_scd_data WHERE dataset='uptime';` should not advance after the disable - [x] Confirm cron still writes `cve` rows on the same tick (per-dataset isolation) - [x] Re-enable: PATCH `historical_data.uptime = true` - [x] Verify next tick resumes writing `uptime` rows #### 1.2 Global disable of `vulnerabilities` - [x] Repeat 1.1 with `features.historical_data.vulnerabilities` - [x] Confirm `cve` writes stop, `uptime` continues #### 1.3 Both disabled globally - [x] Disable both globally - [x] Confirm cron tick produces zero new rows for either dataset - [x] Confirm cron does not error or get stuck - [x] Re-enable both --- ### 2. Per-Fleet Disable — Cron Filters at SQL #### 2.1 Single team disabled for one dataset - [x] Disable uptime for T1 only: PATCH team T1 with `features.historical_data.uptime = false` - [x] Verify scoped `disabled_historical_dataset` activity emitted for T1 - [x] Wait for next cron tick / trigger cron - [x] Pick a host known to be in T1 (call it `H_T1`); confirm its bit is NOT set in any `uptime` row written *after* the disable by filtering the chart to that host - [x] Pick a host in T2 (`H_T2`); confirm its bit IS still set in the same rows (T2 is not disabled) - [x] Pick a no-team host (`H_none`); confirm its bit IS still set (no-team hosts follow the global value) #### 2.2 Same fleet, different dataset - [x] With T1's uptime disabled, confirm T1's hosts ARE still written into `cve` rows on subsequent ticks (per-dataset isolation) #### 2.3 All teams disabled, global on, no-team hosts - [x] Disable uptime on every team (T1, T2, T3) - [x] Confirm next tick still writes a row containing only no-team hosts' bits (global is on, no-team hosts always count) - [x] Re-enable uptime on all teams --- ### 3. Global Scrub — DELETE #### 3.1 Successful global scrub - [x] Note baseline: `SELECT COUNT(*) FROM host_scd_data WHERE dataset='uptime';` (should be > 5000 to exercise the loop; if not, manually insert filler rows or run multiple cron ticks) - [x] Disable uptime globally via the API - [x] Wait for the worker to pick up the scrub / trigger the job - [x] Confirm the count drops to 0: `SELECT COUNT(*) FROM host_scd_data WHERE dataset='uptime';` - [x] Confirm rows for **other datasets** are untouched - [ ] Test again but disable via GitOps --- ### 4. Per-Fleet Scrub — ANDNOT #### 4.1 Single-fleet scrub clears bits - [x] Identify hosts in T1 and record their IDs (call this set `S`) - [x] Pre-disable, confirm at least one `host_scd_data` row for `dataset='uptime'` has bits set at positions in `S` by filtering the chart to those hosts - [x] Disable uptime on T1 only, via the API - [x] Wait for the scrub to run / trigger it - [x] Confirm: every existing row for `dataset='uptime'` now has NO bits set at any position in `S`. Spot-check by filtering the chart to those hosts - [x] Confirm rows for `dataset='cve'` (different dataset) are untouched - [x] Confirm bits for hosts in T2/T3 (not disabled) are still set - [x] Run test again but disable via GitOps #### 4.2 Multi-fleet scrub via GitOps batch - [x] Apply a GitOps spec that flips cve to false on T1 and T3 in a single apply - [x] Wait for scrub(s) to complete - [x] Confirm bits for the union of T1∪T2 hosts are cleared from every row of `dataset='cve'` - [x] Confirm T2 hosts' bits remain set --- ### 5. Activity Feed Cross-Check - [x] Each global flip emits exactly one `disabled_historical_dataset` activity (existing behavior, unchanged) - [x] Each per-team flip emits one scoped activity with the team's ID and name - [x] PATCH submitting unchanged values emits **no** activity and causes **no** scrub (no `host_scd_data` data change observed after the cron tick) - [x] No new "scrub completed" or "scrub started" activity is emitted (out of scope for v1) - [x] Re-enable flips emit `enabled_historical_dataset` activities and do NOT emit any scrub-related activity --- ### 6. Regression Spot Checks - [x] With everything enabled (default), the chart UI renders the same data as before this change (no behavior change in the "all on" case) - [x] AppConfig YAML round-trip (`fleetctl apply`) is benign: applying the unchanged config produces no scrub jobs and no activities - [x] GitOps apply with `historical_data` omitted from team specs defaults to `true` (per the gitops-api change) and does not trigger spurious scrubs - [x] After a full disable+scrub of cve, the `host_scd_data` table has no `dataset='cve'` rows; the chart UI for "vulnerable hosts over time" shows an empty/zero state without errors --- <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Chart collection now supports per-dataset scoping and honors team-level disables; new scrub jobs are registered and worker handlers added. * New dataset scrub operations: global and fleet-scoped scrubs; scrubs can be enqueued and are deduplicated to avoid duplicate pending jobs. Historical-data changes enqueue scrubs after save (errors logged, non-blocking). * **Tests** * Added unit tests for scope resolution, scrub enqueue/dedup behavior, scrub workers, scrub application, and low-level blob scrub logic. * **Documentation** * Added OpenSpec metadata for the chart scrub change. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dan Gordon
|
3f471e86fa |
update linux page with whitepaper cta (#44915)
Updated Linux page main cta to download new Linux white paper. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Replaced primary demo/contact CTAs with a prominent "Read the whitepaper" CTA on the Linux management landing page (hero and bottom sections). * Preserved the "See Fleet in action" video CTA in the hero section; layout updated for consistent presentation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
e3b7739ede |
Update Fleet-maintained apps (#44921)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated Keka macOS to version 1.6.4 <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
|
4106ab71d3 |
Add Primo link to their logo (#44730)
Adds a link to the partner logo scrollbar for Primo's logo <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Primo partner logo in both carousel rows is now clickable and opens the Primo site in a new tab. * Both carousel links use a no-icon presentation for a cleaner, consistent appearance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Eric <eashaw@sailsjs.com> |
||
|
|
78cd4bdaea |
Handbook: Design system updates are up to Mike T (#44868)
- @noahtalerman: Context: We introduced this new [multi-select/filter UI component](https://www.figma.com/design/mCPegRjoFdpMem1PLMF1BF/-41519----44591---43769-Dashboard-widgets?node-id=5537-18651&t=jBcSqVENnj8ZRna5-1) w/ the new dashboard widgets and @melpike discovered this on her own. This new notification process would have sped up that discovery. <img width="534" height="393" alt="Screenshot 2026-05-07 at 9 16 56 AM" src="https://github.com/user-attachments/assets/eaa67612-2bb0-49d2-96c4-94aba4aa2ee5" /> --------- Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> Co-authored-by: melpike <79950145+melpike@users.noreply.github.com> Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> |
||
|
Juan Fernandez
|
0147f6cde2 |
Fix IdP department host vital missing when SCIM PATCH carries extra attrs (#41996)
Resolves #41996 Some IdPs push SCIM PATCH operations that bundle `department` with other RFC 7643 §4.3 enterprise attributes that Fleet does not store. Before this change the SCIM library rejected those payloads with a 400 because the schema only declared 'department'. An environment variable was added (FLEET_DEBUG_SCIM_PAYLOADS) for aiding in further debugging this if the issue persist. |
||
|
fleet-release
|
29f8d52917 | Update Fleet-maintained apps (#44914) | ||
|
Steven Palmesano
|
359408b6b9 | Fix broken links for setup_experience (#44903) | ||
|
Jordan Montgomery
|
a9c66471c0 |
43890 MLAPR frontend (#44739)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43890 Frontend for macOS Local Admin Password Rotation Changes file added during past work # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Added ability to rotate managed local account passwords for hosts * Added visibility for auto-rotation scheduling and pending rotation status * New activity feed entries for managed local account password rotation events (successful and failed rotations) * **Improvements** * Enhanced host action menu to display managed account options when password is available * Added real-time status updates and notifications during password rotation operations <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordan Montgomery
|
4910c450a4 |
43887 MLAPR backend (#44726)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43887 Adds the password rotation state machine for macOS local admin accounts. Changes file covered in prior PR # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Automatic macOS managed-local-account password rotation (5‑minute scheduler) with queued SetAutoAdminPassword device commands * Manual rotation API: POST /hosts/{id}/managed_local_account/rotate (returns 204) * API now reports auto-rotation timing and pending-rotation state (auto_rotate_at, pending_rotation) * Activity records for successful and failed rotations * **Behavior Changes** * Password availability is based on stored encrypted password (broader than before) * Rotate-while-in-flight is rejected to prevent duplicate rotations * **Tests** * New unit and integration tests for rotation flows, cron behavior, and failure paths <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
9d96d6c76a |
add script output to GitOps (#44728)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44082 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enhanced GitOps script logging: reports how many scripts would be applied in dry‑run mode or were actually applied, with per-team and per-fleet breakdowns. * **Tests** * Added test coverage validating logging output for both dry‑run and real execution, ensuring reported script counts and per-team/fleet messages are accurate. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
9bee62b1cf |
Update Fleet-maintained apps (#44900)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated macOS installer versions: Twingate (2026.85 → 2026.120), Windsurf (2.1.32 → 2.2.17), Zed (1.0.1 → 1.1.6), and Zotero (9.0.2 → 9.0.3) <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Luke Heath
|
6bc2352b19 |
Update guidelines on reviewing AI-generated code (#44841)
Important qualifier. |
||
|
Steven Palmesano
|
c6f7e790e2 | Fix broken link for mdm.enable_custom_os_updates_and_filevault (#44785) | ||
|
Sean Hannon
|
2c2c63e9ae |
Remove duplicate 'and' in config section (#44893)
Fix typo in the agent configuration documentation. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Irena Reedy
|
9cd0753ad0 | Update cybersecurity-company-1.md (#44774) | ||
|
fleet-releaseandmostlikelee
|
c5e642b412 |
Update Fleet-maintained apps (#44890)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated application version information for ChatGPT (1.2026.118), Docker Desktop (4.72.0), Inkscape (1.4.4), MongoDB Compass (1.49.6), Proxyman (6.10.0), and Twingate (20.26.120.9484). Deployment manifests have been refreshed with latest installer URLs and verification checksums, ensuring accurate application tracking and proper installation validation across macOS and Windows environments. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com> |
||
|
Allen Houchins
|
682a182d8f |
Run ingest workflow every 4 hours (#44851)
Replace the two fixed daily cron entries (0 14 * * * and 0 21 * * *) with a single every-4-hours schedule (0 */4 * * *) for .github/workflows/ingest-maintained-apps.yml. This consolidates and increases the ingest job frequency to run hourly at 4-hour intervals. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the schedule for the maintained apps ingestion workflow to run more frequently (every 4 hours instead of at fixed times). <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
917ce99324 |
Allow disabling chart datasets: frontend (#44797)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** For #44077 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. n/a, unreleased ## Testing - [X] Added/updated automated tests - [ ] QA'd all new/changed functionality manually ### Manual QA — Chart disabling (frontend) Setup notes: - Test as a global admin and (where indicated) a fleet admin - Need a Premium deployment to test per-fleet behavior - Have at least one fleet (e.g. "Engineering") for fleet-scoped checks - Be able to flip `appConfig.features.historical_data.{uptime,vulnerabilities}` and the equivalent per-fleet keys (via API or settings UI) #### Advanced settings page — `/settings/organization/advanced` - [ ] "Activity & data retention" subheading appears on the page - [ ] Section contains a "Disable hosts online" checkbox - [ ] Section contains a "Disable vulnerabilities" checkbox - [ ] Section is visible on Free tier - [ ] Section is visible on Premium tier - [ ] With `historical_data.uptime = true` in appConfig, "Disable hosts online" loads **unchecked** - [ ] With `historical_data.uptime = false` in appConfig, "Disable hosts online" loads **checked** - [ ] With `historical_data.vulnerabilities = false` in appConfig, "Disable vulnerabilities" loads **checked** - [ ] Saving with "Disable hosts online" checked sends `features.historical_data.uptime = false` in the `PATCH /api/v1/fleet/config` payload (verify in network tab) - [ ] Saving with "Disable vulnerabilities" unchecked sends `features.historical_data.vulnerabilities = true` #### Per-fleet settings page (Premium only) - [ ] Fleet settings page shows an "Activity & data retention" section - [ ] Section contains "Disable hosts online" and "Disable vulnerabilities" checkboxes scoped to the active fleet - [ ] On **Free** tier, the per-fleet TeamSettings page is not reachable (and therefore the section is not visible) - [ ] On **Premium** tier, the section is visible to fleet admins - [ ] Saving with "Disable vulnerabilities" checked sends `features.historical_data.vulnerabilities = false` in `PATCH /api/v1/fleet/teams/{id}` (verify in network tab) #### Per-fleet checkbox locks when global is disabled - [ ] With global `historical_data.uptime = false`, fleet's "Disable hosts online" is **disabled / non-interactive** - [ ] Hovering the locked fleet checkbox shows the tooltip "Disabled globally" - [ ] **Stored value preserved across lockout**: - [ ] Set fleet `historical_data.uptime = false` (saved) - [ ] Then set global to `false` — fleet checkbox renders **checked but disabled** - [ ] Flip global back to `true` — fleet checkbox renders **checked and interactive** (fleet's `false` survived the round trip) #### Confirmation modal on Save (both global and per-fleet) - [ ] Loading with `uptime = true`, then checking "Disable hosts online" and clicking Save → modal opens listing **"Hosts online"** - [ ] No PATCH is issued until the user confirms - [ ] No-op save (page loaded with `uptime = false`, no changes, click Save) → modal does **not** open - [ ] Re-enable (page loaded with `uptime = false`, uncheck "Disable hosts online", Save) → modal does **not** open; PATCH is issued - [ ] Disabling **both** datasets at once → modal lists **both** "Hosts online" and "Vulnerabilities" - [ ] Modal "Save and disable" button issues the PATCH and modal closes once it resolves successfully - [ ] Modal Cancel closes the modal, no PATCH is issued, checkboxes remain checked (form state unchanged, ready to retry or revert) #### Confirmation modal copy by scope - [ ] Modal opened from Advanced page → body describes the change as affecting the **entire Fleet deployment** - [ ] Modal opened from fleet "Engineering" settings → body **references "Engineering" by name** and describes the change as affecting **only that fleet** #### GitOps mode lockout - [ ] With GitOps mode enabled, on `/settings/organization/advanced`: - [ ] "Disable hosts online" is disabled with the GitOps tooltip - [ ] "Disable vulnerabilities" is disabled with the GitOps tooltip - [ ] With GitOps mode enabled, on a fleet's settings page: - [ ] "Disable hosts online" is disabled with the GitOps tooltip - [ ] "Disable vulnerabilities" is disabled with the GitOps tooltip - [ ] When **both** GitOps mode and "Disabled globally" would apply, the fleet checkbox shows the **GitOps tooltip** (GitOps wins) #### Dashboard chart card — empty state - [ ] With `appConfig.features.historical_data.uptime = false`, viewing dashboard in "All teams" with the **uptime** dataset selected → visualization area shows the **"Data collection disabled"** empty state - [ ] Dataset selector, time range selector, and filter gear remain visible **and functional** while the empty state is shown - [ ] With global `vulnerabilities = true` but the active fleet's `historical_data.vulnerabilities = false`, viewing the dashboard scoped to that fleet with a vulnerabilities-driven dataset selected → empty state shown - [ ] With both global and fleet sub-keys `true` (or fleet sub-key absent in All-teams scope) → visualization renders normally; empty state does **not** appear - [ ] Switching from a disabled dataset (A) to an enabled dataset (B) replaces the empty state with B's visualization - [ ] A dataset whose internal name has no `DATASET_CONFIG_KEY` mapping renders normally (no empty state — implicitly enabled) #### Empty-state content - [ ] When the empty state is rendered for the "Hosts online" dataset, "Hosts online" appears as the dataset name - [ ] Link text describes re-enabling collection (e.g. "Manage data collection in Advanced settings") - [ ] Empty state includes a link to `/settings/organization/advanced` when viewing All Fleets as a global admin - [ ] Empty state includes a link to the correct Fleet settings page when viewing a specific fleet as a global or team admin - [ ] Empty state includes no link or call to action when viewed as a non-admin #### Activity feed rendering - [ ] `enabled_historical_dataset` with `dataset = "uptime"`, `fleet_id = null` → renders **"Enabled data collection for Hosts online."** ("Hosts online" bolded) - [ ] `disabled_historical_dataset` with `dataset = "vulnerabilities"`, `fleet_id = null` → renders **"Disabled data collection for Vulnerabilities."** - [ ] `enabled_historical_dataset` with `dataset = "uptime"`, `fleet_id = 7`, `fleet_name = "Engineering"` → renders **"Enabled data collection for Hosts online for the Engineering fleet."** - [ ] `disabled_historical_dataset` with `dataset = "vulnerabilities"`, `fleet_id = 7`, `fleet_name = "Engineering"` → renders **"Disabled data collection for Vulnerabilities for the Engineering fleet."** - [ ] `disabled_historical_dataset` with an **unknown** `dataset = "policy_compliance"` → does **not** throw; renders **"Disabled data collection for Policy compliance."** (raw key sentence-cased — `_` → space, first letter capitalized) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Org- and team-level controls to enable/disable historical data collection for "Hosts online" and "Vulnerabilities." * Updated chart label: "Hosts active" → "Hosts online." * Confirmation modal and a disabled-state UI when data collection is turned off; per-team confirmation flow to prevent accidental data loss. * Activity feed now records enable/disable actions for historical dataset collection with readable dataset labels and scope. * **Tests** * Added comprehensive tests for controls, confirmation flows, disabled states, chart headings, and activity items. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Eric
|
bba69b7249 |
Website: Update validation errors in build static content script (#44883)
Changes: - Updated validation error messages that log an object to use util.inspect (These were being logged as `[object Object]`) - Removed unused validation for `comingSoon` values in the pricing features table YAML. - Updated webinar video URL validation to use the same method we use for validating testimonial video URLs |
||
|
Claude
|
8525503d9f | [WIP] Fix denial of service vulnerability in jsonparser (#44702) | ||
|
|
2d1206de9c |
Add Field Event Follow-Up process to Sales handbook (#44660)
## Summary - Adds a new "Field Event Follow-Up" section to the Sales handbook under Responsibilities - Documents the Solution Specialist post-event process for tradeshows, GitOps & field events - Includes the full follow-up workflow: immediate triage (pull from SF, prioritize), outreach (email, CTA, LinkedIn, SFDC logging), and routing (ICP, pipeline, partner, non-ICP) ## Changes - `handbook/sales/README.md`: New `### Field Event Follow-Up` section inserted before `## Rituals` --- Built for [Chaz Maclaughlin](https://fleetdm.slack.com/archives/D0AHH0ZEMLY/p1777907825885609?thread_ts=1777384598.397169&cid=D0AHH0ZEMLY) by [Kilo for Slack](https://kilo.ai/slack) --------- Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com> |
||
|
Magnus JensenandLucas Manuel Rodriguez
|
d3775bda86 |
Check device auth token individual before querying host tables on auth (#44817)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Resolves #44816. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Summary by CodeRabbit * **Performance** * Improved device authentication efficiency by optimizing token resolution, reducing database load for both valid and invalid token scenarios in Fleet Desktop. * **Tests** * Added comprehensive test coverage for device authentication fast-fail scenarios, including handling of non-existent tokens, expired tokens, and edge cases. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
Victor Lyuboslavsky
|
c79d33a3a6 |
Add support for SAN in Android certificate templates. (#44690)
2/3rds of this PR is OpenSpec and tests. Use OpenSpec files as a reference (if needed). They're there to help the review, and not to be a review surface themselves. - Backend implementation for `subject_alternative_name` in certificate templates. - Includes schema migration, variable expansion, GitOps support. - Limits SAN types to `DNS`, `EMAIL`, `UPN`, `IP`, and `URI`. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41472 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Android certificate templates support Subject Alternative Name (SAN) with validation (DNS, EMAIL, UPN, IP, URI), Fleet-variable substitution, runtime expansion, and delivery; SAN use is gated by Premium license * GitOps now validates and includes SAN in Android certificate flows * **Chores** * Database schema updated to store SAN on certificate templates * Changelog entry added * **Tests** * Added unit and end-to-end tests covering SAN validation, variable expansion, and GitOps behavior <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
dependabot[bot]
|
7e410c7f12 | Bump axios from 1.15.0 to 1.15.2 (#44744) | ||
|
|
d38163db94 |
Setup experience for Windows. (#44306)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43859 This PR brings the Windows Autopilot setup experience to parity with macOS DEP. Windows hosts that enroll through Autopilot now coordinate with Fleet during the OOBE Enrollment Status Page (ESP), so admin-defined software installs run while the device is still waiting at the ESP screen, before the user can sign in. Fleet holds the device on the ESP until profiles and setup-experience software all reach a terminal state, then either releases the device to login or blocks it on a Reset PC failure screen. A new team-level setting controls the policy: when enabled, any critical software install failure during ESP blocks the device with a software-specific error message; when disabled, the device releases regardless of install outcomes (best effort). A pure 3-hour timeout also forces a finalize, with a timeout-specific error message on the block screen. The setting is premium-only and rejected when Windows MDM is not configured. Beyond the gating itself, the PR adds the supporting machinery: orbit-driven setup-experience initialization on Windows so installs are enqueued at the right moment, defense-in-depth cancellation of pending software installs (both queue rows and status rows) whenever the device is going to block or time out, idempotent re-enrollment cleanup so a device that resets and re-enrolls during ESP starts from a clean state. Internally, finalize is structured so a transient failure at any step (cancel, persist, or the state-machine transition) leaves the device retriable on the next management session rather than permanently stuck on "Working on it...". The behavior is exercised by example-based tests, a property-based test that randomly samples the wait/block/release decision matrix, and manual VM testing across Autopilot edge cases. <img width="1184" height="776" alt="image" src="https://github.com/user-attachments/assets/5e48660d-235d-40bd-80b6-f8591c579279" /> # Checklist for submitter - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Re-enrollment now clears stale setup-experience results and pending activities so devices aren’t blocked by old work. * Insert operations tolerate missing enrollments and return clear not-found behavior. * **New Features** * ESP finalization waits for software installation results and can block or release based on configurable “require all” behavior; blocking cancels pending steps and shows prioritized error text. * Finalization persists batched final commands for consistent retries. * Orbit config exposes setup-experience notification for pending/active Windows hosts. * **Tests** * Expanded coverage for ESP flows, datastore awaiting-configuration, Orbit config, and re-enrollment cascades. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Konstantin Sykulev <konst@sykulev.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> |
||
|
Luke Heath
|
2fcf55daa3 | Add CODEOWNERS entry for openspec directory (#44866) | ||
|
johnjeremiah
|
3fe00b8f65 |
Changing default setting in active campaign (#44862)
Troubleshooting why ActiveCampaign does not see visits from emails. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Configuration** * Default tracking in the ActiveCampaign integration is now enabled. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
bfb6f3b010 |
Enable Apple hardware attestation for workstations (#44860)
Set apple_require_hardware_attestation: true in it-and-security/fleets/workstations.yml under controls to require hardware-backed attestation for Apple devices. This strengthens security for managed macOS workstations by enforcing hardware attestation checks. |
||
|
Allen Houchins
|
26a8345c05 |
Switch scripts to bash and update refs (#44853)
Replace /bin/sh shebangs with /bin/bash across numerous Homebrew input scripts to support bash-specific constructs (local, arrays, [[ ]], etc.). Update darwin.json refs for multiple apps (notably 1password, adobe-acrobat-pro, adobe-creative-cloud) to point to new install/uninstall script refs and replace inline script bodies with bash variants. Also remove ee/maintained-apps/outputs/docker/darwin.json. Changes affect ee/maintained-apps/inputs/homebrew/scripts/* and corresponding ee/maintained-apps/outputs/* darwin.json entries. |
||
|
Sharon Katz
|
9611bb87b7 |
Improve error message when referencing a bad label for a configuration profile (#44839)
Closes #39739 ## Local reproduction Reproduced the bug locally by running `fleetctl gitops --dry-run` against a local Fleet server with a GitOps config that references a nonexistent label on a configuration profile. **Setup:** 1. Started a local Fleet server (`fleet serve` against Docker MySQL/Redis on `https://localhost:8080`, fresh database). 2. Created a minimal `.mobileconfig` profile (`test-profile.mobileconfig`). 3. Created a `default.yml` that references it under `controls.macos_settings.custom_settings` with `labels_include_all: ["this-label-does-not-exist"]`. **Reproduction:** ```bash fleetctl gitops -f /tmp/repro-39739/default.yml --dry-run ``` **Result (before fix):** ``` [!] Unknown label 'this-label-does-not-exist' is referenced by MDM Profile '/tmp/repro-39739/profiles/test-profile.mobileconfig' Error: Please create the missing labels, or update your settings to not refer to these labels. ``` Two problems visible: - Says "MDM Profile" — internal jargon, not the user-facing term - Shows the full absolute path — noisy and unhelpful --- ## Code changes **Summary:** Two lines changed in `cmd/fleetctl/fleetctl/gitops.go` inside the `getLabelUsage()` function. Both fix how configuration profile label errors are displayed to the user during `fleetctl gitops` runs. ### `cmd/fleetctl/fleetctl/gitops.go` **Line 851 — "multiple label keys" error message:** Changed `"MDM profile"` → `"configuration profile"` and wrapped `setting.Path` in `filepath.Base()` so the error shows just the filename instead of the full absolute path. ```diff - err := fmt.Errorf("MDM profile '%s' has multiple label keys; ...", setting.Path) + err := fmt.Errorf("configuration profile '%s' has multiple label keys; ...", filepath.Base(setting.Path)) ``` **Line 869 — label usage tracking entry:** Changed the type string from `"MDM Profile"` → `"configuration profile"` and the identifier from the full `setting.Path` to `filepath.Base(setting.Path)`. This feeds into the error message on line 458: `[!] Unknown label '<name>' is referenced by <type> '<identifier>'` ```diff - updateLabelUsage(labels, setting.Path, "MDM Profile", result) + updateLabelUsage(labels, filepath.Base(setting.Path), "configuration profile", result) ``` **After fix:** ``` [!] Unknown label 'this-label-does-not-exist' is referenced by configuration profile 'test-profile.mobileconfig' ``` --- ## Testing ### Manual testing 1. Started a local Fleet server (fresh DB, `fleet serve` on `https://localhost:8080`). 2. Created a minimal `.mobileconfig` profile and a `default.yml` GitOps config that references it with `labels_include_all: ["this-label-does-not-exist"]`. 3. Built `fleetctl` from the **unfixed** code (`git stash`) and ran `fleetctl gitops -f default.yml --dry-run`. Confirmed the old error message: ``` [!] Unknown label 'this-label-does-not-exist' is referenced by MDM Profile '/tmp/repro-39739/profiles/test-profile.mobileconfig' ``` 4. Built `fleetctl` from the **fixed** code and ran the same command. Confirmed the new error message: ``` [!] Unknown label 'this-label-does-not-exist' is referenced by configuration profile 'test-profile.mobileconfig' ``` ### Unit tests added New file: `cmd/fleetctl/fleetctl/gitops_label_usage_test.go` — two tests that exercise `getLabelUsage()` directly (no Redis/MySQL needed): - **`TestGetLabelUsageProfilePathShortened`**: Creates a `GitOps` config with a macOS profile using a full absolute path and a nonexistent label. Asserts the label usage entry has the basename (not the full path) and the type is `"configuration profile"` (not `"MDM Profile"`). - **`TestGetLabelUsageMultipleLabelKeysError`**: Creates a config with both `labels_include_all` and `labels_include_any` on the same profile. Asserts the error contains `"configuration profile"` and the short filename, and does **not** contain the directory path. Both tests were verified to **fail on unfixed code** and **pass on the fix** via a `git stash` round-trip. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Enhanced error messages for MDM configuration profile label validation to display concise filenames instead of full file paths, improving user experience. * **Refactor** * Updated internal label usage tracking to use configuration profile base filenames for consistency and clarity. * **Tests** * Added test coverage for configuration profile path shortening and error message validation in label key scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
3bd92026aa |
Update Fleet-maintained apps (#44845)
Automated ingestion of latest Fleet-maintained app data. Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
|
b84704f5d3 |
Always start token rotation (#39533)
- @noahtalerman: For the following quick win: - https://github.com/fleetdm/fleet/issues/44681 --- Remove the fleet-desktop conditional so the token/device identifier rotation is started unconditionally. This keeps the device identifier (e.g. /opt/orbit/identifier) up to date for refetch-host, device auth, and Fleet Desktop, and defers stopping the rotation as before. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #31421 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Bug Fixes** * Device token rotation is now enabled for all runs, ensuring consistent behavior across all scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> |
||
|
RachelElysia
|
c72158dc6b | Fleet UI: Controls > Setup experience descriptions cleanup (#44824) | ||
|
RachelElysia
|
a89f5dea97 | Fleet UI: Fix 403, 404, 500 clouds in dark mode (#44842) | ||
|
|
2b64524150 |
Website: Small FAQ updates on /pricing (#44808)
I guess it's been like 2 years since we updated this <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Revised FAQ on the pricing page to clarify OS management focus. * Added information about GitOps and infrastructure workshops. * Updated Fleet history and platform references (Omnissa, Jamf/Intune) and adjusted audience examples. * Refined contributor messaging and phrasing throughout the FAQ. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Eric <eashaw@sailsjs.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |