fleet

Author	SHA1	Message	Date
Ian Littman	62755cbd82	Bump Go to 1.25.5, Alpine to 3.23.0 where relevant, bump Trivy to current version (#36848 ) Fixes vulns reported in https://github.com/fleetdm/fleet/actions/runs/19999992703. We'll definitely want to at least cherry-pick this.	2025-12-07 20:04:14 -06:00
Victor Lyuboslavsky	61c51672e4	Bootstrapping Android app (#36233 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #36202 Updated how Android agent starts. See README updates. # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Periodic configuration check scheduled every 15 minutes in the Android agent * Improved Android management notification handling and app-role support * Documentation * Updated Android MDM deployment guide with SHA256 fingerprint instructions and build configuration snippets * Chores * Added WorkManager and AMAPI SDK for Android; updated Android/Go tooling and library versions * Tests * Added unit test coverage for the periodic config worker <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-11-26 11:36:41 -06:00
dependabot[bot]	0cbf0d532a	Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#36040 ) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.41.0 to 0.45.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/4e0068c0098be10d7025c99ab7c50ce454c1f0f9"><code>4e0068c</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/e79546e28b85ea53dd37afe1c4102746ef553b9c"><code>e79546e</code></a> ssh: curb GSSAPI DoS risk by limiting number of specified OIDs</li> <li><a href="https://github.com/golang/crypto/commit/f91f7a7c31bf90b39c1de895ad116a2bacc88748"><code>f91f7a7</code></a> ssh/agent: prevent panic on malformed constraint</li> <li><a href="https://github.com/golang/crypto/commit/2df4153a0311bdfea44376e0eb6ef2faefb0275b"><code>2df4153</code></a> acme/autocert: let automatic renewal work with short lifetime certs</li> <li><a href="https://github.com/golang/crypto/commit/bcf6a849efcf4702fa5172cb0998b46c3da1e989"><code>bcf6a84</code></a> acme: pass context to request</li> <li><a href="https://github.com/golang/crypto/commit/b4f2b62076abeee4e43fb59544dac565715fbf1e"><code>b4f2b62</code></a> ssh: fix error message on unsupported cipher</li> <li><a href="https://github.com/golang/crypto/commit/79ec3a51fcc7fbd2691d56155d578225ccc542e2"><code>79ec3a5</code></a> ssh: allow to bind to a hostname in remote forwarding</li> <li><a href="https://github.com/golang/crypto/commit/122a78f140d9d3303ed3261bc374bbbca149140f"><code>122a78f</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/c0531f9c34514ad5c5551e2d6ce569ca673a8afd"><code>c0531f9</code></a> all: eliminate vet diagnostics</li> <li><a href="https://github.com/golang/crypto/commit/0997000b45e3a40598272081bcad03ffd21b8adb"><code>0997000</code></a> all: fix some comments</li> <li>Additional commits viewable in <a href="https://github.com/golang/crypto/compare/v0.41.0...v0.45.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/crypto&package-manager=go_modules&previous-version=0.41.0&new-version=0.45.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-11-21 15:35:18 -06:00
dependabot[bot]	27e6c21a88	Bump github.com/opencontainers/selinux from 1.11.0 to 1.13.0 (#35381 )	2025-11-10 13:14:03 -06:00
dependabot[bot]	e2f527adaf	Bump github.com/containerd/containerd from 1.7.27 to 1.7.29 (#35274 ) Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.27 to 1.7.29. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/releases">github.com/containerd/containerd's releases</a>.</em></p> <blockquote> <h2>containerd 1.7.29</h2> <p>Welcome to the v1.7.29 release of containerd!</p> <p>The twenty-ninth patch release for containerd 1.7 contains various fixes and updates including security patches.</p> <h3>Security Updates</h3> <ul> <li> <p><strong>containerd</strong></p> <ul> <li><a href="https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w"><strong>GHSA-pwhc-rpq9-4c8w</strong></a></li> <li><a href="https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2"><strong>GHSA-m6hq-p25p-ffr2</strong></a></li> </ul> </li> <li> <p><strong>runc</strong></p> <ul> <li><a href="https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r"><strong>GHSA-qw9x-cqr3-wc7r</strong></a></li> <li><a href="https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm"><strong>GHSA-cgrx-mc8f-2prm</strong></a></li> <li><a href="https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2"><strong>GHSA-9493-h29p-rfm2</strong></a></li> </ul> </li> </ul> <h3>Highlights</h3> <h4>Image Distribution</h4> <ul> <li><strong>Update differ to handle zstd media types</strong> (<a href="https://redirect.github.com/containerd/containerd/pull/12018">#12018</a>)</li> </ul> <h4>Runtime</h4> <ul> <li><strong>Update runc binary to v1.3.3</strong> (<a href="https://redirect.github.com/containerd/containerd/pull/12480">#12480</a>)</li> <li><strong>Fix lost container logs from quickly closing io</strong> (<a href="https://redirect.github.com/containerd/containerd/pull/12375">#12375</a>)</li> </ul> <p>Please try out the release binaries and report any issues at <a href="https://github.com/containerd/containerd/issues">https://github.com/containerd/containerd/issues</a>.</p> <h3>Contributors</h3> <ul> <li>Derek McGowan</li> <li>Akihiro Suda</li> <li>Phil Estes</li> <li>Austin Vazquez</li> <li>Sebastiaan van Stijn</li> <li>ningmingxiao</li> <li>Maksym Pavlenko</li> <li>StepSecurity Bot</li> <li>wheat2018</li> </ul> <h3>Changes</h3> <!-- raw HTML omitted --> <ul> <li><a href="https://github.com/containerd/containerd/commit/442cb34bda9a6a0fed82a2ca7cade05c5c749582"><code>442cb34bd</code></a> Merge commit from fork</li> <li><a href="https://github.com/containerd/containerd/commit/0450f046e6942e513d0ebf1ef5c2aff13daa187f"><code>0450f046e</code></a> Fix directory permissions</li> <li><a href="https://github.com/containerd/containerd/commit/e5cb6ddb7a7730c24253a94d7fdb6bbe13dba6f7"><code>e5cb6ddb7</code></a> Merge commit from fork</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/containerd/containerd/commit/442cb34bda9a6a0fed82a2ca7cade05c5c749582"><code>442cb34</code></a> Merge commit from fork</li> <li><a href="https://github.com/containerd/containerd/commit/e5cb6ddb7a7730c24253a94d7fdb6bbe13dba6f7"><code>e5cb6dd</code></a> Merge commit from fork</li> <li><a href="https://github.com/containerd/containerd/commit/9772966401ad3c33a6cd824632f0c61e5049f3a5"><code>9772966</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/12486">#12486</a> from dmcgowan/prepare-v1.7.29</li> <li><a href="https://github.com/containerd/containerd/commit/1fc2daaf3ed53f4c9e76fbc5786a6f1ae3bb885f"><code>1fc2daa</code></a> Prepare release notes for v1.7.29</li> <li><a href="https://github.com/containerd/containerd/commit/93f710a528958474f95a95e54516624ef832d80f"><code>93f710a</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/12480">#12480</a> from k8s-infra-cherrypick-robot/cherry-pick-12475-t...</li> <li><a href="https://github.com/containerd/containerd/commit/68d04befab3284f1dfe2a9f5691ea5da76daace7"><code>68d04be</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/12471">#12471</a> from austinvazquez/1_7_update_ci_go_and_images</li> <li><a href="https://github.com/containerd/containerd/commit/3f5f9f872707a743563d316e85e530193a2e30ac"><code>3f5f9f8</code></a> runc: Update runc binary to v1.3.3</li> <li><a href="https://github.com/containerd/containerd/commit/667409fb63098cb80280940ab06038114e7712da"><code>667409f</code></a> ci: bump Go 1.24.9, 1.25.3</li> <li><a href="https://github.com/containerd/containerd/commit/294f8c027b607c4450b3e52f44280581a737a73f"><code>294f8c0</code></a> Update GHA runners to use latest images for basic binaries build</li> <li><a href="https://github.com/containerd/containerd/commit/cf66b4141defb757dee0fc5653bfd0a7ba1e8fed"><code>cf66b41</code></a> Update GHA runners to use latest image for most jobs</li> <li>Additional commits viewable in <a href="https://github.com/containerd/containerd/compare/v1.7.27...v1.7.29">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/containerd/containerd&package-manager=go_modules&previous-version=1.7.27&new-version=1.7.29)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-11-06 09:30:59 -06:00
Ian Littman	a910347683	Bump macadmins extension to v1.2.7, map crowdstrike_falcon table (#34553 ) Fixes #33967, #33193, #35149. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [ ] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux (skipped WIndows due to runtime.GOOS gating) - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))	2025-11-04 13:53:10 -06:00
Victor Lyuboslavsky	072ee68eda	Updating to Go 1.25.3 (#35082 )	2025-11-03 09:47:07 -06:00
Jahziel Villasana-EspinozaandRachelElysia	0a3c6c35d3	Android software ingestion (#33826 ) > Closes #33581 <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked table schema to confirm autoupdate - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). --------- Co-authored-by: RachelElysia <rachel@fleetdm.com>	2025-10-08 10:24:38 -04:00
Magnus Jensen	61347155b5	Error on signed configuration profiles (#33341 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #26688 I'm not sure if the IsSignedProfile check is too aggressive and can potentially shadow other problems with the file? # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Media: Gitops <img width="575" height="189" alt="Screenshot 2025-09-23 at 11 48 19" src="https://github.com/user-attachments/assets/1e7c950e-2543-4c9a-b6f0-8b546a30eb1f" /> API <img width="1318" height="169" alt="Screenshot 2025-09-23 at 12 04 22" src="https://github.com/user-attachments/assets/fc8f9171-fab9-46be-befa-dc6af82d2f7b" /> Frontend <img width="779" height="89" alt="Screenshot 2025-09-23 at 12 01 59" src="https://github.com/user-attachments/assets/78dcaf56-d344-4499-bdfa-1abb97b29b15" />	2025-09-25 14:50:48 +03:00
Victor Lyuboslavsky	e872f9a984	Update golangci-lint to v2.4.0 (#33251 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #33250 Waived most new failures. Planning to come back and fix some of them in subsequent PRs.	2025-09-22 13:17:11 -05:00
Luke Heath	a9bf8342d2	Update github.com/ulikunitz/xz to v0.5.15 (#33221 ) Resolve https://github.com/fleetdm/fleet/security/code-scanning/1445.	2025-09-19 14:47:11 -05:00
Lucas Manuel Rodriguez	134c74a94b	Add initial Arch Linux support (#33096 ) For #32859. We can ignore the "Dependency review" failure in [CVE-2023-32698](https://github.com/advisories/GHSA-w7jw-q4fg-qc4c) because we already have the rules to ignore it (we are not vulnerable). I'm not updating nfpm to latest because it would require further changes on all deb/rpm generation (source code breaking changes on the golang interfaces). --- <img width="448" height="151" alt="screenshot-2025-09-11_08-38-20" src="https://github.com/user-attachments/assets/4c00b960-568a-48d9-8098-308c8ab8916f" /> <img width="391" height="73" alt="screenshot-2025-09-11_08-37-40" src="https://github.com/user-attachments/assets/dec6ea22-31f8-4930-b067-0b04b4ec2b5f" /> <img width="759" height="428" alt="Image" src="https://github.com/user-attachments/assets/0a76d070-4709-4a35-8e6e-caf869473d28" /> <img width="1178" height="634" alt="Image" src="https://github.com/user-attachments/assets/98e6fa2a-ba07-4a55-81aa-ad747f1c57b9" /> <img width="1388" height="830" alt="Image" src="https://github.com/user-attachments/assets/19d36bad-d01d-4130-b271-38bea2534833" /> <img width="933" height="930" alt="Image" src="https://github.com/user-attachments/assets/1d6a369b-65d7-46a4-98a6-e6f0b29be2c8" /> <img width="2241" height="693" alt="Image" src="https://github.com/user-attachments/assets/d8f98e97-f027-4c1c-ae5d-c4fa3b592a20" /> - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [X] QA'd all new/changed functionality manually	2025-09-18 18:55:31 -03:00
Victor Lyuboslavsky	abc912bd03	Updated go to 1.25.1 (#32833 )	2025-09-11 18:31:39 -05:00
Jonathan RudenbergandScott Gress	48760fec58	Add support for reading private_key from AWS Secrets Manager (#31134 ) Adds support for reading server `private_key` from AWS Secrets Manager. Combined with #31075, this should allow removing all common sensitive secrets from the environment/config (if I missed any let me know). This works with localstack for local development (set `AWS_ENDPOINT_URL=$LOCALSTACK_URL`, `AWS_ACCESS_KEY_ID=test`, and `AWS_SECRET_ACCESS_KEY=test`). I did not include config options for `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` because they are a bad practice vs role credentials and defeat the purpose of this feature which is to remove secrets from the environment/config. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Added/updated automated tests - [x] Manual QA for all new/changed functionality --------- Co-authored-by: Scott Gress <scott@fleetdm.com>	2025-09-09 16:56:35 -05:00
Scott Gress Jonathan Rudenberg Noah Talerman coderabbitai[bot]	602f5a470b	Feat 1817 add iam auth to mysql and redis (#32488 ) for #1817 # Details This PR gives Fleet servers the ability to connect to RDS MySQL and Elasticache Redis via AWS [Identity and Access Management (IAM)](https://aws.amazon.com/iam/). It is based almost entirely on the work of @titanous, branched from his [original pull request](https://github.com/fleetdm/fleet/pull/31075). The main differences between his branch and this are: 1. Removal of auto-detection of AWS region (and cache name for Elasticache) in favor of specifying these values in configuration. The auto-detection is admittedly handy but parsing AWS host URLs is not considered a best practice. 2. Relying on the existence of these new configs to determine whether or not to connect via IAM. This sidesteps a thorny issue of whether to try an IAM-based Elasticache connection when a password is not supplied, since this is technically a valid setup. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually - besides using @titanous's excellent test tool, I verified the following end-to-end: - [X] regular (non RDS) MySQL connection - [X] RDS MySQL connection using username/password - [X] RDS MySQL connection using IAM (no role) - [X] RDS MySQL connection using IAM (assuming role) - [X] regular (non Elasticache) Redis connection - [X] Elasticache Redis connection using username/password - [X] Elasticache Redis connection using NO password (without IAM) - [X] Elasticache Redis connection using IAM (no role) - [X] Elasticache Redis connection using IAM (assuming role) --------- Co-authored-by: Jonathan Rudenberg <jonathan@titanous.com> Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>	2025-09-04 10:08:47 -05:00
dependabot[bot]	9bc5393d47	Bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#32431 )	2025-08-28 17:38:19 -05:00
Victor Lyuboslavsky	3432d2078d	Updated httpsig-go library to 1.2.0 and removed vendored version. (#32426 ) Fixes #32393 httpsig-go library has encorporated the changes needed to support TPM, so we are removing our local version of this library. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))	2025-08-28 14:28:30 -05:00
Victor Lyuboslavsky	17b5732673	Updated OpenTelemetry packages to latest. (#32314 ) Fixes #32313 Updated packages before identifying issues with our integration.	2025-08-26 11:08:49 -05:00
dependabot[bot]	5112d247fd	Bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 (#32158 ) Bumps [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) from 2.3.0 to 2.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-viper/mapstructure/releases">github.com/go-viper/mapstructure/v2's releases</a>.</em></p> <blockquote> <h2>v2.4.0</h2> <h2>What's Changed</h2> <ul> <li>refactor: replace interface{} with any by <a href="https://github.com/sagikazarmark"><code>@sagikazarmark</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/115">go-viper/mapstructure#115</a></li> <li>build(deps): bump github/codeql-action from 3.29.0 to 3.29.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/go-viper/mapstructure/pull/114">go-viper/mapstructure#114</a></li> <li>Generic tests by <a href="https://github.com/sagikazarmark"><code>@sagikazarmark</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/118">go-viper/mapstructure#118</a></li> <li>Fix godoc reference link in README.md by <a href="https://github.com/peczenyj"><code>@peczenyj</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/107">go-viper/mapstructure#107</a></li> <li>feat: add StringToTimeLocationHookFunc to convert strings to *time.Location by <a href="https://github.com/ErfanMomeniii"><code>@ErfanMomeniii</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/117">go-viper/mapstructure#117</a></li> <li>feat: add back previous StringToSlice as a weak function by <a href="https://github.com/sagikazarmark"><code>@sagikazarmark</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/119">go-viper/mapstructure#119</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ErfanMomeniii"><code>@ErfanMomeniii</code></a> made their first contribution in <a href="https://redirect.github.com/go-viper/mapstructure/pull/117">go-viper/mapstructure#117</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0">https://github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-viper/mapstructure/commit/b9794a5f0e73d425210d6614ed833067029155f5"><code>b9794a5</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/119">#119</a> from go-viper/string-to-weak-slice</li> <li><a href="https://github.com/go-viper/mapstructure/commit/17cdcb0741054e2a33938adf6bd1f2a5c0aa8f30"><code>17cdcb0</code></a> feat: add back previous StringToSlice as a weak function</li> <li><a href="https://github.com/go-viper/mapstructure/commit/3caca3614c3ab2c5b5d359c44fdcd72058887b19"><code>3caca36</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/117">#117</a> from ErfanMomeniii/main</li> <li><a href="https://github.com/go-viper/mapstructure/commit/9a861bc115f2b54ed4e494662f29c172d9ef046a"><code>9a861bc</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/107">#107</a> from peczenyj/patch-2</li> <li><a href="https://github.com/go-viper/mapstructure/commit/86ed5b59da0615fb8c3a413f401cdf0231f1234c"><code>86ed5b5</code></a> refactor: update</li> <li><a href="https://github.com/go-viper/mapstructure/commit/ace5b4e8b3dec99468ffa9498e42fb09d177b0a6"><code>ace5b4e</code></a> chore: add interface any linter</li> <li><a href="https://github.com/go-viper/mapstructure/commit/1a4f1aef38bfa8549762aaf42c7c18a5d268e76e"><code>1a4f1ae</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/118">#118</a> from go-viper/generic-tests</li> <li><a href="https://github.com/go-viper/mapstructure/commit/a2689090ed4348033c36724d866faf1f911a9f63"><code>a268909</code></a> fix: lint</li> <li><a href="https://github.com/go-viper/mapstructure/commit/17f1fd44eb7606b109c9bb017c0a1c6d3e93b5cd"><code>17f1fd4</code></a> test: add more comments</li> <li><a href="https://github.com/go-viper/mapstructure/commit/b48c8566836bf291bfee2b217d51fc36e8e61f6f"><code>b48c856</code></a> test: expand tests</li> <li>Additional commits viewable in <a href="https://github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-viper/mapstructure/v2&package-manager=go_modules&previous-version=2.3.0&new-version=2.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-08-21 13:44:40 -03:00
dependabot[bot]	aedf4690fc	Bump github.com/docker/docker from 26.1.5+incompatible to 28.0.0+incompatible (#31918 )	2025-08-14 12:47:54 -05:00
Lucas Manuel Rodriguez	d849e01add	Update Go to 1.24.6 (#31784 ) Ran ``` make update-go version=1.24.6 ``` And then updated the `sha256`s manually in the Dockerfiles. Fixes https://nvd.nist.gov/vuln/detail/CVE-2025-47907 ``` Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error. ```	2025-08-12 08:10:05 -03:00
Victor Lyuboslavsky	d1992aa983	Added integration test for TPM. (#31315 ) For #31048 This change includes some refactoring of orbit code. No functional changes. Moved non-Linux-specific code from `securehw_linux.go` to `securehw_tpm.go` so that tests on any platform can use it. There are no server changes impacting the upcoming 4.72 release. Just tests. # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Introduced a new TPM 2.0-based secure hardware interface, enabling creation, loading, and management of ECC keys within a TPM device. * Added support for both standard and RFC 9421-compatible HTTP signatures using TPM-backed keys. * Bug Fixes * Improved error handling and resource management for TPM operations. * Tests * Added comprehensive unit tests for TPM key file loading scenarios. * Introduced integration tests using a simulated TPM device to validate end-to-end secure hardware and SCEP workflows. * Chores * Updated dependencies for enhanced compatibility and security. * Modernized build constraints for improved maintainability. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-07-29 20:21:09 +02:00
Dan Fuhry	60b3b514c2	[fleetctl] api command: support request body, including file uploads (#30806 ) Add the capability to build a request body with `fleetctl api`, including uploading files. Example command to upload a software package: ```sh fleetctl api --debug -X POST -F team_id=0 -F 'software=@./server/service/testdata/software-installers/ruby.deb' software/package ``` Unit tests are included for both simple POST requests and file uploads. Closes #21754. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Added/updated automated tests - [x] Manual QA for all new/changed functionality	2025-07-29 08:15:23 -05:00
Lucas Manuel Rodriguez	26a0425633	Use ASN.1 format to store TPM child key (#31131 ) #31047 We were storing public key bytes and encrypted private key bytes as raw files called `tpm_cms_pub.blob` and `tpm_cms_priv.blob` respectively. This PR changes to use a better format on a single file that looks like this: ``` "-----BEGIN TSS2 PRIVATE KEY-----" [...] "-----END TSS2 PRIVATE KEY-----" ``` (We haven't released this feature yet so we don't need a migration.)	2025-07-22 21:15:03 -03:00
Lucas Manuel Rodriguez	4948325892	fleetd generate TPM key and issue SCEP certificate (#30932 ) #30461 This PR contains the changes for the happy path. On a separate PR we will be adding tests and further fixes for edge cases. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Added/updated automated tests - [x] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added support for using a TPM-backed key and SCEP-issued certificate to sign HTTP requests, enhancing security through hardware-based key management. * Introduced new CLI and environment flags to enable TPM-backed client certificates for Linux packages and Orbit. * Added a local HTTPS proxy that automatically signs requests using the TPM-backed key. * Bug Fixes * Improved cleanup and restart behavior when authentication fails with a host identity certificate. * Tests * Added comprehensive tests for SCEP client functionality and TPM integration. * Chores * Updated scripts and documentation to support TPM-backed client certificate packaging and configuration. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-07-18 11:31:52 -03:00
Victor Lyuboslavsky	836cc044d2	Fleet server verifies HTTP signature (#30825 ) Fixes #30473 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Added/updated automated tests - [ ] Manual QA for all new/changed functionality <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added support for TPM-backed host identity certificates enabling hardware-backed HTTP signature authentication for hosts. * Introduced HTTP signature verification middleware for API requests, applied conditionally for premium licenses. * Hosts presenting identity certificates must authenticate with matching HTTP message signatures during enrollment and authentication. * Added SCEP-based certificate issuance for secure host identity management. * Updated enrollment endpoints to use standardized request/response contract types. * Bug Fixes * Enhanced authentication logic to verify consistency between host identity certificates and host records, preventing duplicate or mismatched identities. * Chores * Updated dependencies and test infrastructure to support HTTP signature verification and host identity certificate workflows. * Added comprehensive integration and datastore tests for host identity certificate issuance, storage, and authentication. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-07-16 20:08:27 +02:00
jacobshandlingandJacob Shandling	555ae5441e	Update Go to 1.24.5 (#30770 ) ## #30730 - Update Go version - Update the docs for this process - Confirmed `fleet`, `fleetctl`, and related docker images build successfully - Note that failing tests are unrelated: see [Slack thread](https://fleetdm.slack.com/archives/C019WG4GH0A/p1752175318523689) --------- Co-authored-by: Jacob Shandling <jacob@fleetdm.com>	2025-07-15 10:59:17 -07:00
Lucas Manuel Rodriguez	c69d56ed64	Replace home-made SAML implementation with https://github.com/crewjam/saml (#28486 ) For https://github.com/fleetdm/confidential/issues/9931. [Here](https://github.com/fleetdm/fleet/blob/ec3e8edbdc3f1b4220ada22c8290dbf0237ce1ba/docs/Contributing/Testing-and-local-development.md?plain=1#L339)'s how to test SAML locally with SimpleSAML. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] Added/updated automated tests - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [x] Manual QA for all new/changed functionality <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Improved SSO and SAML integration with enhanced session management using secure cookies. * Added support for IdP-initiated login flows. * Introduced new tests covering SSO login flows, metadata handling, and error scenarios. * Bug Fixes * Enhanced validation and error handling for invalid or tampered SAML responses. * Fixed session cookie handling during SSO and Apple MDM SSO flows. * Refactor * Replaced custom SAML implementation with the crewjam/saml library for improved reliability. * Simplified SAML metadata parsing and session store management. * Streamlined SSO authorization request and response processing. * Removed deprecated fields and redundant code related to SSO. * Documentation * Updated testing and local development docs with clearer instructions for SSO and IdP-initiated login. * Chores * Upgraded dependencies including crewjam/saml and related packages. * Cleaned up tests and configuration by removing deprecated fields and unused imports. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-07-07 15:13:46 -03:00
Lucas Manuel Rodriguez	404f0d3ac0	Migrate from `aws-sdk-go` v1 to v2 (#30308 ) #29482 [Migrate to the AWS SDK for Go v2](https://docs.aws.amazon.com/sdk-for-go/v2/developer-guide/migrate-gosdk.html) documents how to migrate codebases. QA on features that use AWS SDK Go: - Bootstrap package: - upload: ✅ - download: ✅ - cleanup: ✅ - Software (upload, download, installation, etc.) ✅ - Cloudfront: Luckly, this feature was already using aws-sdk-go-v2. - Carves ✅ - Logging: - Firehose ✅ - Kinesis ✅ - Lambda ✅ (tested result logs to a lambda function on our AWS Dogfood account) - Email: - Amazon SES TODO ⚠️ (this is what Dogfood uses and a few customers) - We cannot easily test locally, we can use dogfood or load testing (AWS) environments. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality	2025-06-30 17:45:39 -03:00
dependabot[bot]	17245b04e5	Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 (#30388 ) Bumps [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) from 2.2.1 to 2.3.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-viper/mapstructure/releases">github.com/go-viper/mapstructure/v2's releases</a>.</em></p> <blockquote> <h2>v2.3.0</h2> <h2>What's Changed</h2> <ul> <li>build(deps): bump actions/checkout from 4.1.7 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/46">go-viper/mapstructure#46</a></li> <li>build(deps): bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/47">go-viper/mapstructure#47</a></li> <li>[enhancement] Add check for <code>reflect.Value</code> in <code>ComposeDecodeHookFunc</code> by <a href="https://github.com/mahadzaryab1"><code>@mahadzaryab1</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/52">go-viper/mapstructure#52</a></li> <li>build(deps): bump actions/setup-go from 5.0.2 to 5.1.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/51">go-viper/mapstructure#51</a></li> <li>build(deps): bump actions/checkout from 4.2.0 to 4.2.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/50">go-viper/mapstructure#50</a></li> <li>build(deps): bump actions/setup-go from 5.1.0 to 5.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/55">go-viper/mapstructure#55</a></li> <li>build(deps): bump actions/setup-go from 5.2.0 to 5.3.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/58">go-viper/mapstructure#58</a></li> <li>ci: add Go 1.24 to the test matrix by <a href="https://github.com/sagikazarmark"><code>@sagikazarmark</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/74">go-viper/mapstructure#74</a></li> <li>build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.5.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/72">go-viper/mapstructure#72</a></li> <li>build(deps): bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/76">go-viper/mapstructure#76</a></li> <li>build(deps): bump actions/setup-go from 5.3.0 to 5.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/78">go-viper/mapstructure#78</a></li> <li>feat: add decode hook for netip.Prefix by <a href="https://github.com/tklauser"><code>@tklauser</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/85">go-viper/mapstructure#85</a></li> <li>Updates by <a href="https://github.com/sagikazarmark"><code>@sagikazarmark</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/86">go-viper/mapstructure#86</a></li> <li>build(deps): bump github/codeql-action from 2.13.4 to 3.28.15 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/87">go-viper/mapstructure#87</a></li> <li>build(deps): bump actions/setup-go from 5.4.0 to 5.5.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/93">go-viper/mapstructure#93</a></li> <li>build(deps): bump github/codeql-action from 3.28.15 to 3.28.17 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/92">go-viper/mapstructure#92</a></li> <li>build(deps): bump github/codeql-action from 3.28.17 to 3.28.19 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/97">go-viper/mapstructure#97</a></li> <li>build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/96">go-viper/mapstructure#96</a></li> <li>Update README.md by <a href="https://github.com/peczenyj"><code>@peczenyj</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/90">go-viper/mapstructure#90</a></li> <li>Add omitzero tag. by <a href="https://github.com/Crystalix007"><code>@Crystalix007</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/98">go-viper/mapstructure#98</a></li> <li>Use error structs instead of duplicated strings by <a href="https://github.com/m1k1o"><code>@m1k1o</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/102">go-viper/mapstructure#102</a></li> <li>build(deps): bump github/codeql-action from 3.28.19 to 3.29.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/101">go-viper/mapstructure#101</a></li> <li>feat: add common error interface by <a href="https://github.com/sagikazarmark"><code>@sagikazarmark</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/105">go-viper/mapstructure#105</a></li> <li>update linter by <a href="https://github.com/sagikazarmark"><code>@sagikazarmark</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/106">go-viper/mapstructure#106</a></li> <li>Feature allow unset pointer by <a href="https://github.com/rostislaved"><code>@rostislaved</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/80">go-viper/mapstructure#80</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tklauser"><code>@tklauser</code></a> made their first contribution in <a href="https://redirect.github.com/go-viper/mapstructure/pull/85">go-viper/mapstructure#85</a></li> <li><a href="https://github.com/peczenyj"><code>@peczenyj</code></a> made their first contribution in <a href="https://redirect.github.com/go-viper/mapstructure/pull/90">go-viper/mapstructure#90</a></li> <li><a href="https://github.com/Crystalix007"><code>@Crystalix007</code></a> made their first contribution in <a href="https://redirect.github.com/go-viper/mapstructure/pull/98">go-viper/mapstructure#98</a></li> <li><a href="https://github.com/rostislaved"><code>@rostislaved</code></a> made their first contribution in <a href="https://redirect.github.com/go-viper/mapstructure/pull/80">go-viper/mapstructure#80</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-viper/mapstructure/compare/v2.2.1...v2.3.0">https://github.com/go-viper/mapstructure/compare/v2.2.1...v2.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-viper/mapstructure/commit/8c61ec1924fcfa522f9fc6b4618c672db61d1a38"><code>8c61ec1</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/80">#80</a> from rostislaved/feature-allow-unset-pointer</li> <li><a href="https://github.com/go-viper/mapstructure/commit/df765f469ad16a1996fd0f0ae6a32b20535b966a"><code>df765f4</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/106">#106</a> from go-viper/update-linter</li> <li><a href="https://github.com/go-viper/mapstructure/commit/5f34b05aa12639380ef7c2af69eb6f8fd629dbd0"><code>5f34b05</code></a> update linter</li> <li><a href="https://github.com/go-viper/mapstructure/commit/36de1e1d74f55681536097ff8467a8ce952ef183"><code>36de1e1</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/105">#105</a> from go-viper/error-refactor</li> <li><a href="https://github.com/go-viper/mapstructure/commit/6a283a390ee7bc0f9331f58199db234902e0739f"><code>6a283a3</code></a> chore: update error type doc</li> <li><a href="https://github.com/go-viper/mapstructure/commit/599cb73236404c044abcf278a45c3928d7480dd0"><code>599cb73</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/101">#101</a> from go-viper/dependabot/github_actions/github/codeql...</li> <li><a href="https://github.com/go-viper/mapstructure/commit/ed3f92181528ff776a0324107b8b55026e93766a"><code>ed3f921</code></a> feat: remove value from error messages</li> <li><a href="https://github.com/go-viper/mapstructure/commit/a3f8b227dcdae324c070d389152837f0aa635f4b"><code>a3f8b22</code></a> revert: error message change</li> <li><a href="https://github.com/go-viper/mapstructure/commit/9661f6d07c319da00ae0508d99df5f3f0c3953bd"><code>9661f6d</code></a> feat: add common error interface</li> <li><a href="https://github.com/go-viper/mapstructure/commit/f12f6c76fe743c8e4cc6465c6a9f16fcd8cede57"><code>f12f6c7</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/102">#102</a> from m1k1o/prettify-errors2</li> <li>Additional commits viewable in <a href="https://github.com/go-viper/mapstructure/compare/v2.2.1...v2.3.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-viper/mapstructure/v2&package-manager=go_modules&previous-version=2.2.1&new-version=2.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-06-27 14:45:01 -03:00
Lucas Manuel Rodriguez	5646062c85	Update go to `1.24.4` and add some automation (#29954 ) Fixes CVE-2025-22874 reported by https://github.com/fleetdm/fleet/actions/runs/15601368321/job/43941793647. (IMO not a critical CVE, so it doesn't need to be cherry-picked into v4.69.0.) Added automation to make this easier next time.	2025-06-13 13:08:14 -05:00
Victor Lyuboslavsky	1577d491b2	Hook up Android fleetdm.com/proxy (#29645 ) For #26519 This PR allows Fleet server to use Android with either fleetdm.com proxy or locally. It also removes the Android feature flag from the backend. The frontend changes and proxy API documentation will be in separate PRs. Updated contributor docs: https://github.com/fleetdm/fleet/pull/29880/files Integration tests are missing and tracked as a separate issue: https://github.com/fleetdm/fleet/issues/27080 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Added/updated automated tests - [x] Manual QA for all new/changed functionality	2025-06-12 19:42:15 -05:00
dependabot[bot]andLucas Manuel Rodriguez	9e923b9898	Bump github.com/cloudflare/circl from 1.3.8 to 1.6.1 (#29899 ) Bumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl) from 1.3.8 to 1.6.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cloudflare/circl/releases">github.com/cloudflare/circl's releases</a>.</em></p> <blockquote> <h2>CIRCL v1.6.1</h2> <ul> <li>Fixes some point checks on the FourQ curve.</li> <li>Hybrid KEM fails on low-order points.</li> </ul> <h3>What's Changed</h3> <ul> <li>kem/hybrid: ensure X25519 hybrids fails with low order points by <a href="https://github.com/Lekensteyn"><code>@Lekensteyn</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/541">cloudflare/circl#541</a></li> <li>.github: Use native ARM64 builders instead of QEMU by <a href="https://github.com/Lekensteyn"><code>@Lekensteyn</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/542">cloudflare/circl#542</a></li> <li>Fixes several errors on twisted Edwards curves. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/545">cloudflare/circl#545</a></li> <li>Release v1.6.1 by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/546">cloudflare/circl#546</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudflare/circl/compare/v1.6.0...v1.6.1">https://github.com/cloudflare/circl/compare/v1.6.0...v1.6.1</a></p> <h2>CIRCL v1.6.0</h2> <h3>New!</h3> <ul> <li><a href="https://github.com/cloudflare/circl/blob/main/vdaf/prio3">Prio3</a> Verifiable Distributed Aggregation Function (<a href="https://datatracker.ietf.org/doc/draft-irtf-cfrg-vdaf/">draft-irtf-cfrg-vdaf</a>).</li> <li><a href="https://github.com/cloudflare/circl/blob/main/kem/xwing">X-Wing</a>: general-purpose hybrid post-quantum KEM (<a href="https://datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/">draft-connolly-cfrg-xwing-kem</a>)</li> </ul> <h3>What's Changed</h3> <ul> <li>Add OIDs to ML-DSA by <a href="https://github.com/bwesterb"><code>@bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/519">cloudflare/circl#519</a></li> <li>Adds Prio3 a set of verifiable distributed aggregation functions. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/522">cloudflare/circl#522</a></li> <li>Run semgrep cronjob only in upstream repository. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/526">cloudflare/circl#526</a></li> <li>X-Wing PQ/T hybrid by <a href="https://github.com/bwesterb"><code>@bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/471">cloudflare/circl#471</a></li> <li>ckem: move crypto/elliptic to crypto/ecdh by <a href="https://github.com/MingLLuo"><code>@MingLLuo</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/529">cloudflare/circl#529</a></li> <li>hpke: Update HPKE code to use ecdh stdlib package. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/530">cloudflare/circl#530</a></li> <li>prio3: Adds polynomial multiplication using NTT by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/532">cloudflare/circl#532</a></li> <li>Add Prio3 in readme. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/527">cloudflare/circl#527</a></li> </ul> <h3>New Contributors</h3> <ul> <li><a href="https://github.com/MingLLuo"><code>@MingLLuo</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/529">cloudflare/circl#529</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudflare/circl/compare/v1.5.0...v1.6.0">https://github.com/cloudflare/circl/compare/v1.5.0...v1.6.0</a></p> <h1>CIRCL v1.5.0</h1> <p><strong>New:</strong> ML-DSA, Module-Lattice-based Digital Signature Algorithm.</p> <h3>What's Changed</h3> <ul> <li>kem: add X25519MLKEM768 TLS hybrid KEM by <a href="https://github.com/bwesterb"><code>@bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/510">cloudflare/circl#510</a></li> <li>Create semgrep.yml by <a href="https://github.com/hrushikeshdeshpande"><code>@hrushikeshdeshpande</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/514">cloudflare/circl#514</a></li> <li>repo: Some fixes reported by CodeQL by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/515">cloudflare/circl#515</a></li> <li>Add ML-DSA (FIPS204) by <a href="https://github.com/bwesterb"><code>@bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/480">cloudflare/circl#480</a></li> <li>sign/mldsa: Add test for ML-DSA signature verification. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/517">cloudflare/circl#517</a></li> <li>Release v1.5.0 by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/518">cloudflare/circl#518</a></li> </ul> <h3>New Contributors</h3> <ul> <li><a href="https://github.com/hrushikeshdeshpande"><code>@hrushikeshdeshpande</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/514">cloudflare/circl#514</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudflare/circl/compare/v1.4.0...v1.5.0">https://github.com/cloudflare/circl/compare/v1.4.0...v1.5.0</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cloudflare/circl/commit/c6d33e35234ebf5c4319d12ae7d77d7d17053e56"><code>c6d33e3</code></a> Release v1.6.1</li> <li><a href="https://github.com/cloudflare/circl/commit/0c3868ef6fc8ce864bc4104863186afdd2947f14"><code>0c3868e</code></a> curve4q: Shared must fail with low order points.</li> <li><a href="https://github.com/cloudflare/circl/commit/9fd570dd508eef941d3f42fb94413a899b96d52e"><code>9fd570d</code></a> curve4q: Test showing DH does not fails on identity point.</li> <li><a href="https://github.com/cloudflare/circl/commit/c988ceba827fe09896e770c152646dded447903d"><code>c988ceb</code></a> fourq: Correctly unmarshalling point.</li> <li><a href="https://github.com/cloudflare/circl/commit/ef2611dcde7f6d25e31082412bbb30f2a870d133"><code>ef2611d</code></a> fourq: Test showing point unmarshal fails.</li> <li><a href="https://github.com/cloudflare/circl/commit/05eba44d1a35f979c5f3ac914bcc50c1122e8ced"><code>05eba44</code></a> fourq: Handle the case of Z=0 for IsOnCurve and IsEqual.</li> <li><a href="https://github.com/cloudflare/circl/commit/eef08780cc3cb9befa20014e65f731391103be6b"><code>eef0878</code></a> fourq: Test showing isEqual and IsOnCurve fail.</li> <li><a href="https://github.com/cloudflare/circl/commit/2298474ef688938e4a81ca14990b9a11a8677e2a"><code>2298474</code></a> goldilocks; Handling points with z=0.</li> <li><a href="https://github.com/cloudflare/circl/commit/5a940a111507232035d0b753fbf3068c52d6b8ac"><code>5a940a1</code></a> goldilocks: Test for IsEqual must fail with Z=0</li> <li><a href="https://github.com/cloudflare/circl/commit/48c3b6a2746a18db4d8b675ab296980514359340"><code>48c3b6a</code></a> ed25519: Fix isEqual to handle points with Z=0.</li> <li>Additional commits viewable in <a href="https://github.com/cloudflare/circl/compare/v1.3.8...v1.6.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/cloudflare/circl&package-manager=go_modules&previous-version=1.3.8&new-version=1.6.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>	2025-06-11 12:51:03 -03:00
Zach Wasserman	4a977cfff3	Add containerd_containers table to fleetd (#29384 ) # Checklist for submitter Implementation for #28315 <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] Added/updated automated tests (automated testing seemed infeasible) - [x] Manual QA for all new/changed functionality (tested on Ubuntu 24) - For Orbit and Fleet Desktop changes: - [x] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)). - [x] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. (tested on Ubuntu 24, code does not compile on other platforms)	2025-05-27 10:55:38 -07:00
Scott Gress	b7d0297d03	Update OPA dependency to v1.4.2 (#29454 ) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.	2025-05-27 11:48:38 -05:00
Lucas Manuel Rodriguez	bfe3b186d3	Fix detected CVEs and docker scout exit code to fail the Github Action (#28836 ) For #28837. Fixing this all of this because we got multiple reports from the community and customers and these were also detected by Amazon Inspector. - Fixes CVE-2025-22871 by upgrading Go from 1.24.1 to 1.24.2. - `docker scout` now fails the daily scheduled action if there are CRITICAL,HIGH CVEs (we missed setting `exit-code: true`). - Report CVE-2025-46569 as not affected by it because of our use of OPA's go package. - Report CVE-2024-8260 as not affected by it because Fleet doesn't run on Windows. - The `security/status.md` shows a lot of changes because we are now sorting CVEs so that newest come first. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). - [ ] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.	2025-05-06 13:35:27 -03:00
jacobshandlingandJacob Shandling	2c58f623bf	Fleetd: Update the Registry `DisplayVersion` when `fleetd` auto-updates (#28183 ) ## For #27082 ### The Registry version string is updated with `fleetd`: ![ezgif-3881ff1bdfce04](https://github.com/user-attachments/assets/241009f5-91c0-4236-8526-95a3d2ce59e4) - [x] Changes file added for user-visible changes in `orbit/changes/` - [x] A detailed QA plan exists on the associated ticket - [x] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [x] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [x] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). --------- Co-authored-by: Jacob Shandling <jacob@fleetdm.com>	2025-04-17 11:04:02 -07:00
dependabot[bot]	bd8352de3e	Bump golang.org/x/net from 0.36.0 to 0.38.0 (#28311 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.36.0 to 0.38.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/e1fcd82abba34df74614020343be8eb1fe85f0d9"><code>e1fcd82</code></a> html: properly handle trailing solidus in unquoted attribute value in foreign...</li> <li><a href="https://github.com/golang/net/commit/ebed060e8f30f20235f74808c22125fd86b15edd"><code>ebed060</code></a> internal/http3: fix build of tests with GOEXPERIMENT=nosynctest</li> <li><a href="https://github.com/golang/net/commit/1f1fa29e0a46fffe18c43a9da8daa5a0b180dfa9"><code>1f1fa29</code></a> publicsuffix: regenerate table</li> <li><a href="https://github.com/golang/net/commit/12150816f701c912a32a376754ab28dd3878833a"><code>1215081</code></a> http2: improve error when server sends HTTP/1</li> <li><a href="https://github.com/golang/net/commit/312450e473eae9f9e6173ad895c80bc5ea2f79ad"><code>312450e</code></a> html: ensure <search> tag closes <p> and update tests</li> <li><a href="https://github.com/golang/net/commit/09731f9bf919b00b344c763894cd1920b3d96d90"><code>09731f9</code></a> http2: improve handling of lost PING in Server</li> <li><a href="https://github.com/golang/net/commit/55989e24b972a90ab99308fdc7ea1fb58a96fef1"><code>55989e2</code></a> http2/h2c: use ResponseController for hijacking connections</li> <li><a href="https://github.com/golang/net/commit/2914f46773171f4fa13e276df1135bafef677801"><code>2914f46</code></a> websocket: re-recommend gorilla/websocket</li> <li><a href="https://github.com/golang/net/commit/99b3ae0643f9a2f9d820fcbba5f9e4c83b23bd48"><code>99b3ae0</code></a> go.mod: update golang.org/x dependencies</li> <li>See full diff in <a href="https://github.com/golang/net/compare/v0.36.0...v0.38.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/net&package-manager=go_modules&previous-version=0.36.0&new-version=0.38.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-17 07:55:28 -03:00
Lucas Manuel RodriguezandSharon Katz	895194d63b	Add scanning to released images and process to track vulnerabilities (#28087 ) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>	2025-04-16 11:50:10 -03:00
Lucas Manuel Rodriguez	94ec77f6f0	Update `apmhttp` to fix upload of software packages in Dogfood (#27929 ) For #27235. This is updating the dependency after fixing the bug in https://github.com/elastic/apm-agent-go/pull/1707. The issue with the upload of medium/big sized packages can be reproduced by running `fleet serve` with `FLEET_LOGGING_TRACING_ENABLED=1 FLEET_LOGGING_TRACING_TYPE=elasticapm`. We have reproduced this issue in Dogfood only because it's the only production environment where APM tracing is enabled. We also have APM enabled in our internal load-testing to collect data during troubleshooting. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [X] Manual QA for all new/changed functionality	2025-04-08 10:28:31 -03:00
Lucas Manuel Rodriguez	8003227554	Use go 1.24 new tool feature (#27765 ) Release notes: https://tip.golang.org/doc/go1.24 > Go modules can now track executable dependencies using tool directives in go.mod. This removes the need for the previous workaround of adding tools as blank imports to a file conventionally named “tools.go”. The go tool command can now run these tools in addition to tools shipped with the Go distribution. For more information see [the documentation](https://tip.golang.org/doc/modules/managing-dependencies#tools). The new -tool flag for go get causes a tool directive to be added to the current module for named packages in addition to adding require directives. I ran: ``` go get -tool github.com/fleetdm/fleet/v4/server/goose go get -tool github.com/kevinburke/go-bindata go get -tool github.com/quasilyte/go-ruleguard/dsl go rm tools.go go mod tidy ``` `make deps-go` was failing in CI because of the removal of `tools.go` (my guess is that `go get .` was a nop because there was nothing in `.` to download). So, taking the chance of removing `deps-go` because `go` will download packages during the build process. AFAICS there's no need to download everything beforehand.	2025-04-07 11:12:05 -03:00
Victor Lyuboslavsky	2198fd8d65	Add SCIM Users (#27551 ) For #27287 Video explaining the PR: https://www.youtube.com/watch?v=ZHgFUAvrPEI This PR adds SCIM Users support for Okta. The goal is to first add Users/Groups support so that the remaining backend SCIM work can be done in parallel. This PR does not include the following, which will be added in later PRs - Changes file - Groups support for Okta - Full support for Entra ID - Integration tests # Checklist for submitter - [x] If database migrations are included, checked table schema to confirm autoupdate - For database migrations: - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). - [x] Added/updated automated tests - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [x] Manual QA for all new/changed functionality	2025-04-01 11:02:24 -05:00
Scott Gress	59f96651b6	Update to Go 1.24.1 (#27506 ) For #26713 # Details This PR updates Fleet and its related tools and binaries to use Go version 1.24.1. Scanning through the changelog, I didn't see anything relevant to Fleet that requires action. The only possible breaking change I spotted was: > As [announced](https://tip.golang.org/doc/go1.23#linux) in the Go 1.23 release notes, Go 1.24 requires Linux kernel version 3.2 or later. Linux kernel 3.2 was released in January of 2012, so I think we can commit to dropping support for earlier kernel versions. The new [tools directive](https://tip.golang.org/doc/go1.24#tools) is interesting as it means we can move away from using `tools.go` files, but it's not a required update. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [X] Make sure fleetd is compatible with the latest released version of Fleet - [x] Orbit runs on macOS ✅ , Linux ✅ and Windows. - [x] Manual QA must be performed in the three main OSs, macOS ✅, Windows and Linux ✅.	2025-03-31 11:14:09 -05:00
dependabot[bot]	8baa66a88c	Bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#27426 )	2025-03-25 11:51:59 -05:00
Victor Lyuboslavsky	6b7d232522	Additional CA validation (#27169 ) For #26623 - Updated `github.com/groob/plist` to `github.com/micromdm/plist` -- it was renamed - Added validation that restricts DigiCert Fleet variables to `com.apple.security.pkcs12` payloads plus additional restrictions - Added validation that restricts Custom SCEP Fleet variables to `com.apple.security.scep` payloads plus additional restrictions - Enabled multiple CAs (Fleet variables) to be present in an Apple MDM profile. But each CA can only be used once. For example, we can have DigiCert CA and Custom SCEP CA in one Apple profile. # Checklist for submitter - [x] If database migrations are included, checked table schema to confirm autoupdate - For database migrations: - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). - [x] Added/updated automated tests - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [x] Manual QA for all new/changed functionality	2025-03-19 08:27:55 -05:00
dependabot[bot]	6e3791501b	Bump golang.org/x/net from 0.33.0 to 0.36.0 (#27094 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.33.0 to 0.36.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/85d1d54551b68719346cb9fec24b911da4e452a1"><code>85d1d54</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/cde1dda944dcf6350753df966bb5bda87a544842"><code>cde1dda</code></a> proxy, http/httpproxy: do not mismatch IPv6 zone ids against hosts</li> <li><a href="https://github.com/golang/net/commit/fe7f0391aa994a401c82d829183c1efab7a64df4"><code>fe7f039</code></a> publicsuffix: spruce up code gen and speed up PublicSuffix</li> <li><a href="https://github.com/golang/net/commit/459513d1f8abff01b4854c93ff0bff7e87985a0a"><code>459513d</code></a> internal/http3: move more common stream processing to genericConn</li> <li><a href="https://github.com/golang/net/commit/aad0180cad195ab7bcd14347e7ab51bece53f61d"><code>aad0180</code></a> http2: fix flakiness from t.Log when GOOS=js</li> <li><a href="https://github.com/golang/net/commit/b73e5746f64471c22097f07593643a743e7cfb0f"><code>b73e574</code></a> http2: don't log expected errors from writing invalid trailers</li> <li><a href="https://github.com/golang/net/commit/5f45c776a9c4d415cbe67d6c22c06fd704f8c9f1"><code>5f45c77</code></a> internal/http3: make read-data tests usable for server handlers</li> <li><a href="https://github.com/golang/net/commit/43c2540165a4d1bc9a81e06a86eb1e22ece64145"><code>43c2540</code></a> http2, internal/httpcommon: reject userinfo in :authority</li> <li><a href="https://github.com/golang/net/commit/1d78a085008d9fedfe3f303591058325f99727d7"><code>1d78a08</code></a> http2, internal/httpcommon: factor out server header logic for h2/h3</li> <li><a href="https://github.com/golang/net/commit/0d7dc54a591c12b4bd03bcd745024178d03d9218"><code>0d7dc54</code></a> quic: add Conn.ConnectionState</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.33.0...v0.36.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/net&package-manager=go_modules&previous-version=0.33.0&new-version=0.36.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-03-13 07:18:30 -03:00
Martin Angers	d903cf9081	Android: add test to verify that filtering hosts by android platform is supported (#26613 )	2025-02-26 11:31:19 -05:00
Dante CatalfamoandLucas Manuel Rodriguez	a1e752341b	Only allow once instance of fleet desktop at once (#25821 ) #25396 --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>	2025-02-25 16:46:06 -05:00
Scott Gress	0c95c50a41	Make desktop server display manager restart (#26526 ) For #25616 # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - For Orbit and Fleet Desktop changes: - [X] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - Tested on macOS, Windows, Ubuntu, Fedora (w/ and without system tray) and Debian (w/ and without system tray) ## Details This PR addresses the issue that on Ubuntu, if a user restarts their display manager (e.g. with `sudo systemctl restart gdm3`), the Fleet Desktop tray icon disappears and doesn't come back. The solution in this PR is to add a function that runs in a loop and checks whether the tray icon still exists, and if not, kills the Fleet Desktop process. The parent Orbit process already has code to restart the desktop if it dies. We also update the Orbit checker to run every 15 seconds, to limit the delay in the icon coming back after a restart. Also included in this PR is a rename from `desktop_unix.go` to `desktop_linux.go`, which will be used automatically for linux builds, and a new `desktop_darwin.go` for macos builds, and the removal of redundant build directives for all.	2025-02-24 10:14:45 -06:00
Victor Lyuboslavsky	fc33df1981	Basic Android MDM on/off functionality (#26309 ) For #26218 Basic Android MDM on/off backend functionality. Manually tested. The following env vars must be set: ``` FLEET_DEV_ANDROID_ENABLED=1 FLEET_DEV_ANDROID_SERVICE_CREDENTIALS=$(cat credentials.json) FLEET_DEV_ANDROID_PUBSUB_TOPIC=projects/your-project/topics/your-topic ``` I picked https://github.com/go-json-experiment/json as the JSON library, which seems like the safest option. - will become json/v2 at some point - currently used in production by other companies, like Tailscale - well-maintained - Some context here: https://github.com/fleetdm/fleet/issues/25512 Plan for next work: - refactoring from 1st PR - add pubsub with device enroll -> spec proxy for fleetdm.com - come back to this sub-task to add tests and finish TODOs # Checklist for submitter - [x] Added/updated automated tests - [x] Manual QA for all new/changed functionality	2025-02-18 09:43:11 -06:00

1 2 3 4 5 ...