- Adding `FLEET_MICROSOFT_COMPLIANCE_PARTNER_PROXY_API_KEY` to dogfood
- Adding creation of secret and secret version for
`FLEET_MICROSOFT_COMPLIANCE_PARTNER_PROXY_API_KEY` value
Closes: https://github.com/fleetdm/fleet/issues/30714
Changes:
- Fixed a bug in the policy and query library pages that prevented
multi-platform queries and policies from being displayed in every
platform they are supported on.
# Checklist for submitter
> Closes#29896
> Closes#30038
If some of the following don't apply, delete the relevant line.
<!-- Note that API documentation changes are now addressed by the
product design team. -->
- [x] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated instructions to clarify that VPP apps appear in the **Software
> Library** tab.
* Improved descriptions regarding app installation status and
uninstallation limitations for VPP apps.
* Added notes that Fleet automatically refetches host vitals and updates
software inventory after installations.
* Made minor formatting and trailing whitespace adjustments for clarity.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Closes: https://github.com/fleetdm/confidential/issues/11272
Changes:
- Added an embedded PDF to the "How Fleet raised a $27M Series B without
a pitch deck" article.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Embedded the Series B memo PDF directly within the article for easier
viewing on larger screens, with a clickable link fallback for smaller
screens.
* **Style**
* Updated article styles to improve the appearance and layout of
embedded documents.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/confidential/issues/11063
Changes:
- Added a navigation sidebar to article category pages.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Introduced a sidebar to the articles page with navigation links and a
dynamic call-to-action section that adapts based on user status.
* Added a new two-column layout, displaying articles alongside the
sidebar.
* **Style**
* Enhanced sidebar and article section styling, including a new sidebar
call-to-action component.
* Improved responsive design for better usability on smaller screens.
* **Refactor**
* Updated category labeling from "Announcements" to "News" with revised
descriptions.
* Disabled the previous card-based article layout.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/confidential/issues/10867
Changes:
- Updated the route for the /app-library page and app details pages to
be at `/software-catalog` and added redirects.
- Updated places where we mentioned the app library to say "software
catalog" instead.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated all references and navigation paths from "app library" to
"software catalog" across the website.
* Updated internal links, breadcrumbs, and share URLs to use the new
"/software-catalog" path.
* Added redirects from old "app-library" URLs to the new
"software-catalog" URLs for seamless navigation.
* **Style**
* Updated descriptive text and metadata to reflect the new "software
catalog" terminology throughout the site.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Disabling firehose log destination
- Re-enabling webhook log destination
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enabled webhook logging by activating environment variables for
webhook URLs.
* Webhook log plugin is now conditionally set based on the presence of a
webhook URL.
* **Chores**
* Updated environment variable management by removing firehose-logging
addon variables from the configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Disabled webhook variables
- Re-enabled firehose variables
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Disabled certain environment variables related to webhook logging.
* Updated environment variable configuration to include additional
logging settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
For unreleased bug #30656.
- [X] Added/updated automated tests
- [X] Manual QA for all new/changed functionality
- [X] For unreleased bug fixes in a release candidate, confirmed that
the fix is not expected to adversely impact load test results or alerted
the release DRI if additional load testing is needed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved handling to ensure MDM-related data is only generated when
MDM is enabled and properly configured.
* Errors related to MDM configuration are now surfaced instead of being
silently ignored.
* **Tests**
* Added new tests to verify correct behavior when MDM is disabled and
not configured, ensuring empty or minimal outputs for MDM-related data
in this scenario.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#25587. SubEthaEdit packgeInfo file is a bit bigger, but the only
thing different is the list of package IDs included, and that's not what
was broken/fixed here, so went with an abbreviated version that better
demonstrates what got fixed here.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- Note that API documentation changes are now addressed by the
product design team. -->
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved extraction of application names from uploaded PKG packages by
using the install path as a fallback method.
* **Tests**
* Added a new test case to verify correct name extraction from PKG
packages using the install path.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* None
* **Bug Fixes**
* None
* **Removals**
* Removed the offline status message on Fleet Desktop.
* Removed the --fleet-certificate flag from the sudo orbit shell
command.
* Removed the macos_user_profiles osquery extension table for macOS.
* Removed the fix preventing Fleet Desktop from launching incorrectly on
Linux without a logged-in GUI user.
* Removed the macOS MDM migration fallback for ConfigurationURL parsing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
For #30386.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Improved formatting for consistency.
* Expanded instructions for enabling the Windows `process_etw_events`
table, including required configuration flags.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Get tests passing for now; #30670 tracks a proper fix.
- [x] Added/updated automated tests
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Disabled two test cases related to specific Microsoft Python extension
versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes https://github.com/fleetdm/confidential/issues/11135
Closes https://github.com/fleetdm/confidential/issues/11134
Changes:
- Added two new testimonials to the /testimonials and /device-management
pages
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added two new testimonials focused on Linux desktop management,
enhancing the "Device management" section.
* Updated testimonial display order to include the new authors for
improved visibility in the relevant category.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the minimum required version of 1Password for macOS to 8.11.0.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <allen@fleetdm.com>
Mocking the manifest server to ensure that an app with a no_check hash
is always returned (in the event that chrome no longer has this property
about it)
Mocking the file content in the integration test. There is no reason to
really download the real 1password or chrome binaries for this
particular case.
For: https://github.com/fleetdm/fleet/issues/30325
- [x] Added/updated automated tests
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Enhanced test coverage for software installer payloads with simulated
manifest endpoints and SHA256 hash validations.
* Added mock servers to verify installer downloads and hash computations
for maintained apps, improving batch installer processing tests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Expanded the list of digital experience rituals with new daily and
weekly tasks, each featuring detailed descriptions, responsible
individuals, and helpful links.
* **Improvements**
* Enhanced metadata for rituals, including clearer task ownership and
automation details.
* Improved organization and consistency of the rituals list for easier
reference.
* **Removals**
* Removed duplicate and outdated ritual entries to streamline the list.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Expanded and clarified instructions for Entra conditional access
integration.
* Added requirements for user group membership in Intune.
* Provided steps for deploying the Company Portal app during macOS
device setup.
* Included reminders for assigning users/groups to Conditional Access
policies.
* Added guidance on temporarily disabling Conditional Access.
* Explained compliance implications when unenrolling from Fleet MDM.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes https://github.com/fleetdm/confidential/issues/11286
Grammar fix.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated the wording of a feature description on the homepage for
improved clarity.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Expanded T-shirt sizing guidance in capacity planning to include a new
"XXS" category for trivial tasks.
* Updated the sizing table to display story point ranges alongside
T-shirt sizes and time estimates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Tim Lee <timlee@fleetdm.com>
Fixes#29140
I intended to add a Slack notification but forgot in the previous PR.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added automated Slack notifications for failed scheduled workflow
runs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fix for #23899.
I found this while preparing the demo (I had a user with department and
no groups).
Assigning to @getvictor because Scott is OOO.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved host filtering for Identity Provider (IdP) group labels to
include hosts without corresponding group entries.
* **Tests**
* Enhanced label tests to cover IdP department labels, including
scenarios where users have no groups.
* Added new subtests to verify correct host inclusion and label counts
for department-based labels.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
For https://github.com/fleetdm/confidential/issues/9931.
[Here](https://github.com/fleetdm/fleet/blob/ec3e8edbdc3f1b4220ada22c8290dbf0237ce1ba/docs/Contributing/Testing-and-local-development.md?plain=1#L339)'s
how to test SAML locally with SimpleSAML.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved SSO and SAML integration with enhanced session management
using secure cookies.
* Added support for IdP-initiated login flows.
* Introduced new tests covering SSO login flows, metadata handling, and
error scenarios.
* **Bug Fixes**
* Enhanced validation and error handling for invalid or tampered SAML
responses.
* Fixed session cookie handling during SSO and Apple MDM SSO flows.
* **Refactor**
* Replaced custom SAML implementation with the crewjam/saml library for
improved reliability.
* Simplified SAML metadata parsing and session store management.
* Streamlined SSO authorization request and response processing.
* Removed deprecated fields and redundant code related to SSO.
* **Documentation**
* Updated testing and local development docs with clearer instructions
for SSO and IdP-initiated login.
* **Chores**
* Upgraded dependencies including crewjam/saml and related packages.
* Cleaned up tests and configuration by removing deprecated fields and
unused imports.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
relates to [#28691](https://github.com/fleetdm/fleet/issues/28691)
This fixes an issue where `end_user_license_agreeement` is defined but
is an empty string or nil.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved handling of the end user license agreement (EULA) field in
app configuration to ensure it is always set correctly and removed from
the configuration map after processing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
fixes: #30325
Related to incorrect behavior introduced at
https://github.com/fleetdm/fleet/pull/28945
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* When uploading software batches, if the installer SHA is set to
"no_check," the system will now automatically generate and use the
SHA256 checksum of the installer file.
* **Bug Fixes**
* Fixed an issue ensuring the latest Google Chrome version is pulled
during Fleet-maintained app updates.
* Corrected the display of the SHA256 hash in the UI and API to show
valid values.
* Improved handling of installer uploads to ensure a valid SHA256
checksum is always applied, even when "no_check" is specified.
* **Tests**
* Added a test to verify correct SHA256 hash calculation for installer
files.
* Extended integration tests to validate batch software installer
operations for maintained apps with SHA256 hash checks.
* Added tests covering behavior when SHA256 checksum is marked as
"no_check" for maintained apps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ian Littman <iansltx@gmail.com>
## #16846
[Demo](https://drive.google.com/file/d/1xocZDfOUbu29tPpf2J6dngy3pLACIe62/view?usp=drivesdk)
- [x] Changes file added for user-visible changes in `changes/`
- [x] Manual QA for all new/changed functionality
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added tooltips to navigation and category menu items for improved
accessibility and clarity.
* Introduced a new optional tooltip position setting, allowing tooltips
to appear on any side of the element.
* Expanded the color palette with a new light shade option.
* **Style**
* Refactored navigation and category menu styles to use centralized,
reusable mixins for a more consistent appearance.
* Updated navigation and category menu layouts for better structure and
maintainability.
* **Chores**
* Added new SCSS mixins for navigation styling, improving code
maintainability and consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
Integrates a number of troubleshooting and architecture notes from my
experience debugging and investigating disk encryption related issues
over the past few months.. Adds diagrams for each platform showing how
the major components work together. Might be a bit wordy but wanted it
to be useful for engineers since it is so different on each platform
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Expanded and restructured disk encryption documentation with detailed
platform-specific workflows and troubleshooting guidance for macOS,
Windows, and Linux.
* Added and updated sequence diagrams for FileVault, BitLocker, and LUKS
encryption processes.
* Enhanced sections on key storage, recovery, and related resources with
additional guidance and links.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This suppresses an unneeded react-tooltip opacity warning when the tests
are run. The code is correct when assigning the opacity and this may
just be an issue with react-tooltip and jsdom not working nicely
together. This was causing to much noise in the console.
We've also updated react-tooltip 5 to the latest version
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the react-tooltip-5 dependency to a newer version.
* Suppressed specific harmless warnings related to react-tooltip during
test runs for cleaner test output.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
relates to [#28143](https://github.com/fleetdm/fleet/issues/28143)
quick fix to not allow deleting EULA when gitops mode is enabled.
- [x] Manual QA for all new/changed functionality
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* The delete button in the EULA list is now conditionally disabled based
on GitOps mode, with an explanatory tooltip.
* **Chores**
* Removed an unused import from a test file.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Jorge Falcon