For #22723.
Bundle IDs pulled from installs of the software, with regexes being
starts-with matches to include EAPs in matches. Used the products list
from CVE-2024-37051 to match up NVD product names (which is why
Writerside isn't included here; it doesn't have any published vulns
yet).
This fixes vuln detection in e.g. GoLand EAPs when the app name is
something other than the product name, similar to what we've done with
IntelliJ and PyCharm (but omitting homebrew handling for now).
No changes file as this doesn't need to be cherry-picked, and it will go
out in the next NVD pull after merged to `main`.
# Checklist for submitter
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
Closes: #23904
Changes:
- Replaced the regex routes that handle articles and article category
pages to have a separate route for each category
- Updated the build-static-content script to transform periods in
article filenames into dashes
- Added redirects for articles that have a changed URL
Closes: https://github.com/fleetdm/fleet/issues/25176
Changes:
- Updated the to-html helper to add the `v-pre` directive to Markdown
code blocks, This directive will prevent any of the content inside of it
from being interpreted as a Vue template.
- Updated the regex in build-static-content that looks for vue templates
to not match any templates inside code blocks.
#24804
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated tests
- [x] If database migrations are included, checked table schema to
confirm autoupdate
- [x] Manual QA for all new/changed functionality
relates to #25155
fixes an issue where we weren't showing an error message for a windows
profile with incorrect secret
<!-- Note that API documentation changes are now addressed by the
product design team. -->
- [x] Manual QA for all new/changed functionality
For #24868 (subtask)
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality
> Related issue: #25071
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- Note that API documentation changes are now addressed by the
product design team. -->
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
For #25144.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- Note that API documentation changes are now addressed by the
product design team. -->
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
## #24653
- This bug was more generally that live query runs from the Edit query
form did not include the `query_id` in the `run` API call.
- [x] Changes file added for user-visible changes in `changes/`
- [x] Manual QA for all new/changed functionality
---------
Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
relates to #25067, #25061
includes two fixes for the scoped software via labels feature:
1. update the delete label modal copy
2. don't show the confirm changes modal if only the self service value
has changed.
- [x] Manual QA for all new/changed functionality
Related to: #24688
Changes:
- Added two new dependencies: `jsonwebtoken` and `@azure/msal-node`
- Added a new hook: `entra-sso`. A hook that replaces the default
authentication mechanism with Microsoft Entra SSO.
- Added a new action: signup-sso-user-or-redirect. This action finds or
creates user records for authenticated SSO users and attaches the user
record to the user's session.
- updated the is-logged-in policy to check if an SSO user's token is
still valid.
- Added a link to the account page to the app's header navigation.
relates to #24120
adds the `software_title_id` to the `added_app_store_activity`
- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality
Rebecca Cowart