Commit Graph
20269 Commits
Author SHA1 Message Date
Mitch Francese bcecdf85f6 Fix Windows Update CSP not deploying via GitOps (#37139)
When Windows OS update settings (deadline_days and grace_period_days)
are configured via GitOps YAML, the configuration is saved but the
Windows Update CSP profiles are never deployed to enrolled devices.

Root cause: The GitOps code path (editTeamFromSpec) was missing the
deployment trigger that exists in the UI path (ModifyTeam).

This fix adds the missing deployment logic following the same pattern
used by macOS/iOS/iPadOS updates:

1. Track when Windows updates are edited (mdmWindowsUpdatesEdited flag)
2. After SaveTeam(), trigger CSP deployment via
mdmWindowsEnableOSUpdates() or mdmWindowsDisableOSUpdates() based on
whether deadline is set

The fix ensures GitOps and UI paths behave consistently for Windows OS
update management.

Fixes: Windows Update CSP deployment via GitOps
Related: ee/server/service/teams.go lines 379-408 (UI implementation)

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #37137

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
2025-12-16 11:28:14 -05:00
fleet-releaseandallenhouchins 6d4c0d38c6 Update Fleet-maintained apps (#37329)
Automated ingestion of latest Fleet-maintained app data.

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
2025-12-16 10:08:57 -06:00
Allen Houchins 4d299d1770 Update Company Portal icon for macOS FMA (#37328)
This pull request adds a new icon component import to the icon index
file. The change is minor and simply makes the `CompanyPortal` icon
available for use in the application.
2025-12-16 09:55:46 -06:00
Allen Houchins 34788f7686 Add 7-zip as a Windows Fleet-maintained app (#37222)
This pull request adds support for managing 7-Zip as a maintained
Windows application. The changes include configuration for installation
and uninstallation, workflow updates to handle 7-Zip specifically in CI,
and a new icon for the frontend. These updates ensure that 7-Zip can be
detected, installed, uninstalled, and visually represented in the
software management system.

**Windows workflow and detection updates:**

- Updated `.github/workflows/test-fma-windows-pr-only.yml` to detect
changes related to 7-Zip, set a `has_7zip` output variable, and add a
step to remove pre-installed 7-Zip versions before proceeding with
further app verification. This prevents conflicts with pre-existing
installations during CI runs.
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR91)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR102)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR117-R124)
[[4]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR164-R227)

**7-Zip application configuration:**

- Added `ee/maintained-apps/inputs/winget/7-zip.json` to define 7-Zip as
a maintained app with metadata such as slug, package identifier,
installer type, and categories.
- Added `ee/maintained-apps/outputs/7-zip/windows.json` with version
info, installation and uninstallation scripts, SHA256, and upgrade code
for 7-Zip, enabling automated install/uninstall flows.
- Updated `ee/maintained-apps/outputs/apps.json` to include 7-Zip in the
list of available apps, with a description and unique identifier for
display and selection.

**Frontend icon support:**

- Added a new React SVG icon component for 7-Zip at
`frontend/pages/SoftwarePage/components/icons/7Zip.tsx`.
- Registered the 7-Zip icon in the icon index and mapped it in
`SOFTWARE_NAME_TO_ICON_MAP` to display the icon for 7-Zip in the UI.
[[1]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR7)
[[2]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR224)
2025-12-16 09:55:30 -06:00
fleet-release 75146d6d68 Update Fleet-maintained apps (#37324) 2025-12-16 08:21:14 -06:00
Magnus Jensen b4f2741b50 XML escape $FLEET_SECRET in XML files (#37255)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #32920 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
2025-12-16 09:51:48 -04:00
Marko Lisica b233493d45 Update enrollment links font to monospaced (#37279)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #36754

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] QA'd all new/changed functionality manually


Screenshots:

<img width="849" height="394" alt="Screenshot 2025-12-15 at 18 03 06"
src="https://github.com/user-attachments/assets/054d0d99-59b7-4664-b682-fb68a5cccad8"
/>
<img width="882" height="421" alt="Screenshot 2025-12-15 at 18 02 42"
src="https://github.com/user-attachments/assets/87ac021e-d88a-4cbf-8b46-8f674d838d3c"
/>
2025-12-16 14:35:46 +01:00
Allen Houchins a554564cf2 Update icon for Company Portal (#37321)
This pull request makes a minor update to the icon imports on the
Software Page by removing the unused `CompanyPortal` import from the
`icons/index.ts` file.
2025-12-15 22:10:48 -06:00
Allen Houchins 1f65507aae Add Dash and calibre as macOS FMAs (#37320)
This pull request adds support for two new macOS applications, Calibre
and Dash, to the maintained apps system. The changes include the
necessary metadata, installation and uninstallation scripts, and icon
assets, as well as updates to the main app listing.

**New Application Support**

* Added input metadata for Calibre in `homebrew/calibre.json`, including
identifiers, installer format, and categories.
* Added input metadata for Dash in `homebrew/dash.json`, including
identifiers, installer format, and categories.

**App Catalog Updates**

* Updated `outputs/apps.json` to include Calibre with a description and
identifiers.
* Updated `outputs/apps.json` to include Dash with a description and
identifiers.

**Installer and Uninstaller Scripts**

* Added versioned output and install/uninstall scripts for Calibre in
`outputs/calibre/darwin.json`.
* Added versioned output and install/uninstall scripts for Dash in
`outputs/dash/darwin.json`.

**Frontend Icon Assets**

* Added a new React SVG icon component for Calibre in `Calibre.tsx`.
2025-12-15 22:02:47 -06:00
Mitch FranceseandAllen Houchins 56bc42ebec Add TextExpander as an FMA for Fleet (#37296)
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
2025-12-15 21:15:13 -06:00
Allen Houchins e42f71402d Add AppCleaner as a macOS FMA (#37316)
This pull request adds support for the AppCleaner application to the
maintained apps system, including its metadata, installation, and
uninstallation scripts. The changes define how AppCleaner should be
recognized, installed, and uninstalled on macOS, and make it available
in the maintained apps catalog.

**AppCleaner integration:**

* Added a new input definition for AppCleaner in `appcleaner.json`,
specifying its metadata such as name, unique identifier, installer
format, and default category.
* Added a new output definition for AppCleaner in
`appcleaner/darwin.json`, including version information, SQL query for
existence, installer URL, SHA256 checksum, and detailed install and
uninstall scripts.
* Updated `apps.json` to include AppCleaner in the list of maintained
applications, making it available for discovery and installation via the
maintained apps system.
2025-12-15 21:12:59 -06:00
Allen Houchins a9aea6bc28 Update dogfood-automated-policy-updates.yml (#36294)
Updating workflow to create more accurately named Pull Requests.
2025-12-15 20:44:24 -06:00
d265d60877 Revise CrowdStrike installation guide formatting (#37301)
Updated formatting and links for CrowdStrike installation instructions,
ensuring consistency in naming and image references.

---------

Co-authored-by: Ian Littman <iansltx@gmail.com>
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
2025-12-16 10:19:58 +09:00
Victor Lyuboslavsky af55ec2db8 Modular monolith README (#37186) 2025-12-15 18:04:29 -06:00
Tim Lee c19fc10528 Cleanup android host certificate templates (#37311) 2025-12-15 16:37:27 -07:00
Rachael Shaw f4828db816 Website: Add redirect for disabling Okta conditional access (#37303)
Currently points to a heading that doesn't exist, but will be in the
updated guide when the feature is released.
2025-12-15 16:31:58 -06:00
Lucas Manuel Rodriguez 30dbc300ee Remove dead code in orbit (#37119)
Found this while working on
https://github.com/fleetdm/fleet/issues/36654.
2025-12-15 17:59:19 -03:00
Jonathan Katz e0a3959192 Android App Configurations GitOps (#37188)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #35495
- Updates `generate-gitops` to export android app configurations in
relative files
- Updates backend to set the android app configurations state to what
yaml files specify
- If an existing configuration was not included, it will be set to `{}`

# Checklist for submitter

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually
2025-12-15 15:57:45 -05:00
github-actions[bot]andlucasmrod bc6b4b50bc Update versions of fleetd components in Fleet's TUF [automated] (#37299)
Automated change from [GitHub
action](https://github.com/fleetdm/fleet/actions/workflows/fleetd-tuf.yml).

Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com>
2025-12-15 17:48:37 -03:00
RachelElysia fffafed67a Fleet UI: Fix package form preinstall sql to handle invalid sql as savable (#37283) 2025-12-15 14:31:55 -05:00
Marko Lisica 1b60a539d3 Paid Android apps not supported (#37175)
Clarified that paid Google Play Store apps are not supported in Android
MDM.
2025-12-15 13:47:57 -05:00
Noah Talerman 0dc9692e82 Download signed installers coming in 2026 (#37085)
Roadmap preview: January 2026:
https://github.com/fleetdm/fleet/pull/36020/files
2025-12-15 13:46:10 -05:00
Noah Talerman 87e88a1e0e Updating feature prioritization critieria & remove 💝 Customer requests (prioritized) project (#37205)
- Updating feature prioritization criteria
  - Use `P-` labels for high-priority customer requests
- Remove 💝 Customer requests (prioritized) project: From a Product
Design perspective, I think we get little to no value from maintaining
that project.
- @noahtalerman: I'm also going to delete the `~customer request` label.
That's the label we used to put issues on this project.
2025-12-15 13:45:38 -05:00
fleet-releaseandallenhouchins 2765cdee18 Update Fleet-maintained apps (#37285)
Automated ingestion of latest Fleet-maintained app data.

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
2025-12-15 12:21:11 -06:00
Jordan Montgomery e0ece38957 Add hosts.hostname index (#37268)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Related to #34704(no subtask created though)

Overall changelog for the issue covers this

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] QA'd all new/changed functionality manually

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
2025-12-15 13:17:24 -05:00
fleet-releaseandallenhouchins 9b3814ec01 Update Fleet-maintained apps (#37277)
Automated ingestion of latest Fleet-maintained app data.

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
2025-12-15 12:15:00 -06:00
Allen Houchins 7098e0b333 Add Adobe DNG Converter as a macOS FMA (#37238)
This pull request adds support for managing Adobe DNG Converter on
macOS. The main changes include introducing metadata and
installation/uninstallation scripts for this application, updating the
app registry, and improving version detection logic to handle Adobe’s
unique versioning format.

**Support for Adobe DNG Converter:**

* Added a new input definition for Adobe DNG Converter in
`homebrew/adobe-dng-converter.json`, specifying its identifiers,
installer format, and default category.
* Generated an output manifest in
`outputs/adobe-dng-converter/darwin.json` with version info, download
URL, SHA256, and detailed install/uninstall scripts for managing the app
lifecycle.
* Registered Adobe DNG Converter in the main `apps.json` registry,
including a description, unique identifier, and platform.

**Improvements to version detection:**

* Updated the `appExists` function in `darwin.go` to correctly detect
Adobe DNG Converter even when the installed version string includes a
build number in parentheses, improving reliability of version checks.
2025-12-15 11:12:11 -06:00
Lucas Manuel RodriguezandIan Littman 554f268768 Add team assignment checks to APIs that do label association (#37246)
Resolves #37104

## Testing

- [X] Added/updated automated tests
- [X] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Label validation now enforces team-context constraints for policies,
queries, and MDM profiles.
  * Global policies now verify label validity before creation.

* **Bug Fixes**
* Improved label association verification in team-specific
configurations.

* **Tests**
* Added comprehensive test coverage for team label associations,
including label scoping validation and team deletion scenarios.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Ian Littman <iansltx@gmail.com>
2025-12-15 14:11:36 -03:00
Allen Houchins a5b2e911d6 Add support for zip files as Windows FMAs (#36841)
### Summary
This PR adds support for `.zip` files as Windows Fleet Managed Apps
(FMAs). Zip files on Windows are treated similarly to `.exe` files and
require custom install/uninstall scripts, typically used for AppX/MSIX
packages that are distributed as zip archives.

### Changes

**Backend:**
- Added `.zip` as a supported Windows package type in
`SoftwareInstallerPlatformFromExtension`
- Updated validation to require install/uninstall scripts for zip files
(similar to `.exe` files)
- Added `addZipPackageMetadata` function to handle zip file metadata
extraction
- Updated error messages to include `.zip` in the list of supported file
types
- Enhanced `appExists` validation to detect provisioned AppX packages
(packages that are provisioned for all users but don't show up in the
programs table until a user logs in)
- Added version normalization logic to handle version string differences
(e.g., "11.2.1495.0" vs "11.2.1495")
- Updated winget ingester to recognize zip files and default to user
scope for MSIX/zip installers

**Frontend:**
- Added `.zip` to `windowsPackageTypes` in `package_type.ts`
- Updated `PackageAdvancedOptions` component to require
install/uninstall scripts for zip files
- Added validation rules for zip files in `PackageForm/helpers.tsx`
- Updated help text and tooltips to indicate script requirements for zip
packages
- Updated `software_install_scripts.ts` to include zip in default script
handling

**Maintained Apps:**
- Added Microsoft Company Portal as a maintained app example using zip
files
- Created install/uninstall PowerShell scripts that:
  - Extract zip files containing AppX packages
- Provision packages for all future users (works in headless
environments)
  - Install packages for the current user
  - Handle both provisioned and installed package detection

**Tests:**
- Updated integration tests to include `.zip` in supported file type
error messages
- Updated unit tests for `SoftwareInstallerPlatformFromExtension` and
`SofwareInstallerSourceFromExtensionAndName`

### Use Case
This enables distribution of Windows AppX/MSIX packages that are
packaged as zip files (common for Microsoft Store apps like Company
Portal). The implementation handles both provisioned packages (for all
users) and user-installed packages, ensuring detection works in both
headless and interactive environments.

### Testing
- Updated existing tests to include zip file support
- Added Microsoft Company Portal as a maintained app example with full
install/uninstall scripts

---

**Note:** This PR follows the same pattern as `.exe` file support,
requiring custom install/uninstall scripts since zip files can contain
various content types that need custom handling.
2025-12-15 11:03:43 -06:00
fleet-releaseandallenhouchins 4ad79ce25a Update Fleet-maintained apps (#37267)
Automated ingestion of latest Fleet-maintained app data.

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
2025-12-15 10:55:12 -06:00
fleet-releaseandallenhouchins ef3dd26f0e Update Fleet-maintained apps (#37259)
Automated ingestion of latest Fleet-maintained app data.

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
2025-12-15 10:43:02 -06:00
kitzyandDale Ribeiro 5e95a5eb4a Remove port 8220 from docker-compose configuration (#37004)
This port is not actually needed.

---------

Co-authored-by: Dale Ribeiro <dale@fleetdm.com>
2025-12-15 10:27:09 -05:00
fleet-releaseandmostlikelee 3bbad16c36 Update Fleet-maintained apps (#37254)
Automated ingestion of latest Fleet-maintained app data.

Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com>
2025-12-15 09:13:54 -06:00
Lucas Manuel Rodriguez e68a129eb9 Fix build warning (#37257)
Fixing the following warning:
```
$ make fleet

[...]
# github.com/shoenig/go-m1cpu
../../gopath/pkg/mod/github.com/shoenig/go-m1cpu@v0.1.6/cpu.go:75:17: warning: variable length array folded to constant array as an extension [-Wgnu-folding-constant]
../../gopath/pkg/mod/github.com/shoenig/go-m1cpu@v0.1.6/cpu.go:77:16: warning: variable length array folded to constant array as an extension [-Wgnu-folding-constant]
```

PS: This warning happens when building fleet because we need to decouple
the client code from `server/service`... (hopefully to be done as part
of https://github.com/fleetdm/fleet/issues/36087)
2025-12-15 12:08:31 -03:00
Jonathan KatzandIan Littman 9f498f8345 Send empty categories to delete them properly, remove outdated comment re: IPA categories (#37215)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #36544 
- Removes outdated comment
- Send empty categories key instead of nothing to edit package API, so
that categories will be deleted instead of ignored.

# Checklist for submitter
## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

---------

Co-authored-by: Ian Littman <iansltx@gmail.com>
2025-12-15 09:57:39 -05:00
Henry Stamerjohann be0df116ff Add 'headmin' to GitHub user list (#37256)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
2025-12-15 15:43:46 +01:00
Jordan MontgomeryandMagnus Jensen 9ec74e09e5 35513: Resend Windows SCEP profile if renewal date is hit (#37184)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #35513 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

---------

Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
2025-12-15 09:36:34 -05:00
RachelElysia 229481fc79 Fleet UI: Update Android status tooltips + global activities (#37185) 2025-12-15 09:28:55 -05:00
RachelElysia d8a3af4e88 Fleet UI: Ability to update android configuration + FE cleanups (#37065) 2025-12-15 09:26:33 -05:00
RachelElysia 3e7c4d1850 Fleet UI: Add software links go to relevant platform add software page (#37202) 2025-12-15 09:25:07 -05:00
Steven PalmesanoandMike Thomas 8949723bdc Add detail for how to create a scheduled query (#37070)
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
2025-12-15 16:07:07 +09:00
Allen Houchins a5731d540d Add Airtame as a macOS and Windows FMA (#37248)
This pull request adds support for the Airtame application on both macOS
and Windows platforms. It introduces metadata, installation and
uninstallation scripts, and icon support for Airtame, making it
available in the maintained apps catalog and ensuring it displays
correctly in the frontend.

**Airtame Application Support:**

- Added input metadata for Airtame for both Homebrew (macOS) and Winget
(Windows) in `airtame.json` files, specifying installer formats,
identifiers, and categories.
[[1]](diffhunk://#diff-448b5795b8fb5f9487415e1d64f1fca6b57fa434b4d78ce452f732a9ffda479eR1-R8)
[[2]](diffhunk://#diff-146d9ec4238b454a4f86989b068060760f2d70523aed34b68f935d493b3f23dbR1-R10)
- Added output definitions for Airtame in `darwin.json` and
`windows.json`, including version info, installation/uninstallation
scripts, installer URLs, SHA256 hashes, and verification queries.
[[1]](diffhunk://#diff-0c571f0352dfef93766b985359e9f1ab34ed36284fd701429edc5b733be5aef6R1-R21)
[[2]](diffhunk://#diff-23e19ef30503f3c50c25a06132b64d193ecfd70698e2a4ae433dbde55148b6f0R1-R22)
- Updated `apps.json` to include Airtame entries for both macOS and
Windows, with appropriate descriptions and unique identifiers.

**Frontend/Icon Integration:**

- Added a new React icon component for Airtame in `Airtame.tsx`, using a
base64-encoded image.
- Registered the Airtame icon in the icon index and mapped it in
`SOFTWARE_NAME_TO_ICON_MAP` for proper display in the software catalog.
[[1]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR12)
[[2]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR233)
2025-12-14 21:45:47 -06:00
Allen Houchins faa48b841f Add Aircall as a Windows FMA (#37247)
This pull request adds support for the Aircall application on Windows to
the maintained apps ecosystem. It introduces the necessary input and
output configuration files, as well as versioning and
installation/uninstallation scripts. Additionally, it updates the main
app listing to include Aircall for Windows.

**New Aircall Windows app support:**

* Added a new input definition for Aircall in `winget/aircall.json`,
specifying metadata such as package identifier, installer type, and
architecture.
* Created a new output file `aircall/windows.json` with version details,
installation and uninstallation scripts, download URL, and SHA256
checksum for Aircall version 3.1.66.
* Updated `apps.json` to list Aircall for Windows as a maintained app,
including its name, slug, platform, and unique identifier.
2025-12-14 21:15:59 -06:00
Lucas Manuel RodriguezandIan Littman 78b926da5d Add backend changes for team labels (#37116)
Resolves #36781.

---

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)

## Testing

- [X] Added/updated automated tests
- [X] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [X] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Team labels are now supported, allowing labels to be assigned to
specific teams.

* **Bug Fixes**
* Label memberships properly clean up when hosts are transferred between
teams.
  * Team deletion now cascades cleanup of associated team labels.
* Label query results are scoped to prevent stale or misapplied results.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Ian Littman <iansltx@gmail.com>
2025-12-14 20:02:15 -03:00
fleet-releaseandmostlikelee b0048b8fdb Update Fleet-maintained apps (#37243)
Automated ingestion of latest Fleet-maintained app data.

Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com>
2025-12-14 16:08:19 -06:00
Allen Houchins 7e0aad7895 Add 8x8 Work as a Windows FMA (#37236)
This pull request adds support for the "8x8 Work" application on Windows
to the maintained apps system. The changes introduce input and output
definitions for the app, including installation and uninstallation
scripts, version metadata, and an entry in the global apps listing.

**Addition of 8x8 Work (Windows) application:**

* Added a new input definition for `8x8 Work` in `winget` format,
specifying package identifiers, architecture, installer type, and
default categories.
* Created an output file for `8x8 Work` on Windows, including version
metadata, installer and uninstaller scripts, SHA256 hash, upgrade code,
and detection SQL query.
* Added `8x8 Work` (Windows) entry to the global `apps.json` file,
including description and unique identifier.
2025-12-13 21:10:20 -06:00
Allen Houchins 734031f733 Add 010 Editor as a Windows FMA (#37234)
This pull request adds support for managing the installation and
uninstallation of 010 Editor (version 16.0.2, 64-bit) on Windows via
Winget in the maintained apps system. It introduces metadata,
install/uninstall scripts, and output definitions for this application,
enabling automated deployment and inventory.

**010 Editor integration:**

* Added a new input definition for 010 Editor in
`winget/010-editor.json`, specifying metadata, installer details, and
script paths.
* Implemented PowerShell scripts for silent installation
(`010-editor_install.ps1`) and uninstallation
(`010-editor_uninstall.ps1`) tailored for Inno Setup-based installers.
[[1]](diffhunk://#diff-4d1e3101294ff5dcd9414cbbd5a470a1bd2942f5d4e8db5c25c9fe4098b815b3R1-R28)
[[2]](diffhunk://#diff-2ec71055559f078b69fc8cd53d483fc7738f0dbe7af384dda9587ecd76aeed23R1-R91)

**Output and inventory updates:**

* Generated a new output file `windows.json` for 010 Editor, including
version info, installation checks, installer URL, script references, and
SHA256 hash.
* Updated the main `apps.json` output to include 010 Editor as a Windows
application, ensuring it appears in the maintained apps inventory.
2025-12-13 21:00:02 -06:00
fleet-releaseandallenhouchins 56bad6fbba Update Fleet-maintained apps (#37233)
Automated ingestion of latest Fleet-maintained app data.

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
2025-12-13 18:40:51 -06:00
Allen Houchins 674bab4c56 Ignore .DS_Store files in FMA ingesters (#37223)
This pull request improves the robustness of the app ingestion process
by ensuring that only JSON files are processed, preventing potential
errors from non-JSON files (such as `.DS_Store` on macOS) being read.

File filtering improvements:

* Added a check in `ingester.go` for both the Homebrew and Winget
ingesters to skip any files that do not have a `.json` extension,
ensuring that only valid JSON files are ingested.
[[1]](diffhunk://#diff-abd7db4bef16a062c1bd81f54a7c846f1e91b913a9fe9f87976c8075f39b8cd2R45-R49)
[[2]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R53-R57)
2025-12-13 18:31:30 -06:00
fleet-releaseandmostlikelee 83f5574242 Update Fleet-maintained apps (#37231)
Automated ingestion of latest Fleet-maintained app data.

Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com>
2025-12-13 15:46:36 -06:00