fleet

Author	SHA1	Message	Date
Lucas Manuel Rodriguez	1397531199	Authorize packs before returning them in query responses (#50148 ) - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Query responses now include pack details only when the requester has permission to view them. * Prevented pack metadata from being disclosed across fleets when query names overlap. * Corrected target selection labels and empty-state messaging for fleet-based targets. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 13:35:47 -03:00
Magnus Jensen	451319b384	Hide Account Provisioning on Fleet free (#50130 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #50122 <img width="730" height="148" alt="image" src="https://github.com/user-attachments/assets/e7a803bd-b50d-404f-8af2-9fa32cc34772" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. (Unreleased bug) - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features* - Account provisioning settings now indicate when the feature is included with Fleet Premium. - Premium-tier accounts continue to see the full provisioning configuration and save controls. - Bug Fixes - Improved license-tier handling so account provisioning displays the appropriate experience for free and premium plans. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 14:31:36 +02:00
kitzy	f4d7064f9a	Add Rtools as a Windows FMA (#50028 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: #50020 # What this does Adds Rtools as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing The install script hit the validator's 10-minute `executeScript` cap exactly: ``` 20:41:22 INFO msg="Executing install script..." app=Rtools 20:51:22 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later 20:51:22 WARN msg="failed to remove rtools45-6768-6492.exe: ... Access is denied." ``` The locked installer in the temp dir shows a process was still alive. `Start-Process -Wait` waits for the process and all of its descendants, which is the same root cause as the other install-timeout apps in this batch. Rtools is also the one app in the batch where a slow unpack is a plausible second cause — the installer is ~460 MB and expands a full toolchain. So rather than assume, the script now waits on the installer process alone with a 480s cap (under the caller's 10-minute budget) and logs elapsed time plus Add/Remove Programs registration state on every poll. If the cap is reached: - registered → the install finished and only a lingering child remains, so it stops that process and succeeds; - not registered → the unpack genuinely didn't finish, and it fails with that stated explicitly. Either way the CI log now says which one happened instead of just timing out. ## Notes - Identity verified against the installer, not winget metadata. The setup stub's PE version resource reads `CompanyName: The R Foundation`, `ProductName: Rtools`. Inno derives `VersionInfoCompany` from `AppPublisher`, so the ARP publisher is `The R Foundation` — which is what the exists query uses. - Versioned ARP name. The registry `DisplayName` is `Rtools 4.5 (6768-6492)`, so the input uses `fuzzy_match_name` and the exists query is `name LIKE 'Rtools %'`. - Installs to `C:\rtools45`, not Program Files, so the validator's "no changes detected in `C:\Program Files`" line is an expected warning, not a failure. - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) passes* on the SYSTEM-context Windows runner — [run 30384196159](https://github.com/fleetdm/fleet/actions/runs/30384196159) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries checked against the installer's PE version resource, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added Rtools as a supported Windows application. * Added installation and uninstallation support with silent setup and silent removal. * Added Rtools version metadata, installer verification, and Developer tools categorization. * Added a dedicated Rtools icon for software listings. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 23:01:31 -05:00
kitzy	c61632305a	Add Logitech Unifying Software as a Windows FMA (#50024 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: #50020 # What this does Adds Logitech Unifying Software as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing Install and detection were already fine on the SYSTEM-context Windows runner — osquery found `Logitech Unifying Software 2.52` at `C:\Program Files\Common Files\LogiShrd\Unifying`. Uninstall was the failure: ``` 20:40:55 INFO msg="Executing uninstall script for app..." 20:40:57 INFO msg="Found app: 'Logitech Unifying Software 2.52' ... Version: 2.52.33" 20:40:57 ERROR msg="App still present after uninstall (expected no match for version '2.52.33' in programs)" ``` Two seconds start to finish — the uninstaller hadn't actually done anything yet. This is standard NSIS behavior: the uninstaller copies itself to `%TEMP%` and relaunches, so the process the script starts exits almost immediately while the real work happens in a detached child. The fix passes NSIS's `_?=<dir>` switch, which runs the uninstaller in place instead of relaunching, making it synchronous. It has to be the last argument and unquoted, so the script builds a single argument string rather than an array (PowerShell would quote an element containing spaces). A bounded poll on the ARP key follows as a backstop, and the script fails explicitly if the entry is still there. ## Notes - Versioned ARP name. The registry `DisplayName` is `Logitech Unifying Software 2.52`, so the input uses `fuzzy_match_name` and the exists query is `name LIKE 'Logitech Unifying Software %'`. The uninstall script matches the same prefix rather than an exact string. - Publisher `Logitech` confirmed against the winget locale manifest. - Installs under `C:\Program Files\Common Files`, so the validator's "no changes detected in `C:\Program Files`" line is an expected warning, not a failure. - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) passes* on the SYSTEM-context Windows runner — [run 30384010810](https://github.com/fleetdm/fleet/actions/runs/30384010810) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added Logitech Unifying Software to the Windows software catalog, including the version 2.52.33 download, checksum, and install-detection metadata. * Implemented silent installation and a robust, registry-aware uninstall flow (with process lock handling and timeout behavior). * Added a dedicated Logitech Unifying Software icon to the software page UI. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 22:59:09 -05:00
kitzy	cfbb5a59fa	Add GNU Privacy Guard as a Windows FMA (#50025 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: #50020 # What this does Adds GNU Privacy Guard as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing The install itself worked — the validator logged `New application detected at: C:\Program Files\GnuPG`. The script never returned: ``` 20:18:36 INFO msg="Executing install script..." app="GNU Privacy Guard" 20:28:36 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later 20:28:36 INFO msg="New application detected at: C:\Program Files\GnuPG" ``` Ten minutes on the nose is the validator's `executeScript` timeout. The cause is a PowerShell detail rather than anything wrong with the installer: *`Start-Process -Wait` waits for the process and all of its descendants**. GnuPG's installer starts `gpg-agent`, `dirmngr`, `keyboxd` and `scdaemon` and leaves them resident, so `-Wait` never returns. The same run left the installer `.exe` locked in the validator's temp dir, which is the other tell that a child process was still alive. The install script now follows the pattern already established by [`ollama_install.ps1`](ee/maintained-apps/inputs/winget/scripts/ollama_install.ps1): start with `-PassThru` (no `-Wait`), wait on the installer process alone with a 7-minute cap (below the caller's 10-minute script budget), poll for the Add/Remove Programs entry so a fast-returning installer can't be mistaken for a finished one, then stop the daemons. Stopping the daemons also fixes the uninstall, which would otherwise fail on files those processes hold open. The uninstall script stops them up front, uses NSIS's `_?=<dir>` switch so the uninstaller runs in place instead of relaunching itself detached from `%TEMP%`, and polls the ARP key to confirm removal. ## Notes - Clean ARP `DisplayName` (`GNU Privacy Guard`), so exact name matching — no `fuzzy_match_name` needed. Publisher `The GnuPG Project`. - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) passes on the SYSTEM-context Windows runner — [run 30384069714](https://github.com/fleetdm/fleet/actions/runs/30384069714) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added GNU Privacy Guard as a supported Windows application in the maintained apps catalog. * Added install/upgrade detection and uninstall support for Windows. * Added GNU Privacy Guard to the software catalog (Security category). * Added a dedicated GNU Privacy Guard icon to the software interface for proper name-based display. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 22:56:46 -05:00
kitzy	2fc41c7592	Add Azure Data Studio as a Windows FMA (#50027 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: #50020 # What this does Adds Azure Data Studio as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing The install itself worked — the validator logged `New application detected at: C:\Program Files\Azure Data Studio`. The script never returned: ``` 20:08:19 INFO msg="Executing install script..." app="Azure Data Studio" 20:18:19 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later 20:18:19 INFO msg="New application detected at: C:\Program Files\Azure Data Studio" ``` Ten minutes on the nose is the validator's `executeScript` timeout. Azure Data Studio is a Visual Studio Code fork and ships the same Inno Setup script — including the `runcode` task, which launches the app when the install finishes. Because `Start-Process -Wait` waits for the process and all of its descendants, the launched app kept the script blocked forever. The fix is the switch VS Code's own FMA already uses: `/MERGETASKS=!runcode` (see [`vscode_install.ps1`](ee/maintained-apps/inputs/winget/scripts/vscode_install.ps1) and [`vscodium_install.ps1`](ee/maintained-apps/inputs/winget/scripts/vscodium_install.ps1), both of which pass validation). The script also waits on the installer process alone rather than its descendants, polls for the Add/Remove Programs entry, and stops a stray `azuredatastudio` process as a backstop in case a future build ignores the task suppression. ## Notes - Machine-scope x64 installer, per the winget manifest — Azure Data Studio publishes both user and machine scope, and Fleet installs run as SYSTEM, so machine scope is required. - Clean ARP `DisplayName` (`Azure Data Studio`), so exact name matching. Publisher `Microsoft Corporation`. - Uninstall is unchanged: the Inno uninstaller doesn't leave anything resident, and `-Wait` waiting on descendants is the desired behavior there (Inno relaunches itself from `%TEMP%`). - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) passes* on the SYSTEM-context Windows runner — [run 30384162280](https://github.com/fleetdm/fleet/actions/runs/30384162280) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added Azure Data Studio to the available Windows software catalog. * Added support for installing and uninstalling Azure Data Studio (version 1.52.0) via silent installer and uninstaller flows with completion detection. * Added an Azure Data Studio icon to the software interface for better visual identification. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 22:56:00 -05:00
Allen Houchins	a3cdb7e14b	Fix macOS-only copy on two Windows FMA catalog entries (#50111 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: N/A — found while removing the macOS Yubikey Manager FMA (#50109) Two Windows Fleet-maintained apps describe themselves as macOS software in `ee/maintained-apps/outputs/apps.json`, because the entries were copy-pasted from their macOS counterparts. This copy is customer-facing: it shows in the Fleet UI's software catalog and on `fleetdm.com/software-catalog/<slug>`. - `proxyman/windows` — "Proxyman is a high-performance macOS app that enables developers to view HTTP/HTTPS requests and responses." → drops "macOS". (The `proxyman/darwin` description keeps it; it's accurate there.) - `wechat/windows` — name "WeChat for Mac" and "WeChat for Mac is a free messaging and calling application." → "WeChat". The winget input (`inputs/winget/wechat.json`) already declares `"name": "WeChat"`, so this also makes `apps.json` agree with its own input. The `wechat/darwin` entry keeps "WeChat for Mac", which is the actual macOS product name. Renaming the Windows entry needs a matching icon key. `getMatchedSoftwareIcon` matches on the lowercased app name and requires an exact match or a whole-word prefix (`matchLoosePrefixToKey`: `s === key \|\| s.startsWith(key + " ")`), so the existing `"wechat for mac"` key would not match a name of "WeChat" and the app would fall back to the generic package icon. Added a `wechat: Wechat` key alongside it (both point at the same component; the `"wechat for mac"` key stays for macOS and for hosts reporting that name in inventory). No server-side impact: `UpsertMaintainedApp` keys on `slug` and updates `name` in place, and `ReconcileMaintainedAppSoftwareNames` only renames `darwin` titles, so the Windows rename doesn't touch existing software titles. Website icons resolve from the slug (`build-static-content.js` builds `app-icon-<slug>-60x60@2x.png`), not the name, so `app-icon-wechat-60x60@2x.png` is unaffected. Descriptions here mirror upstream cask/winget copy, so these are minimal factual corrections rather than a voice rewrite. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually: - `apps.json` still parses; 1378 apps; verified the four `proxyman`/`wechat` entries read as intended and the `darwin` ones are untouched. - Traced the icon lookup by hand: name "wechat" now hits the new exact-match key; "wechat for mac" still hits the original. - Swept every non-darwin entry in `apps.json` for macOS-only phrasing (`Rosetta`, `macOS`, `Mac`, `Apple`) — these two were the only genuine mismatches. `duo-desktop/windows` (lists macOS, Windows, and Linux) and `imazing-profile-editor/windows` (edits Apple configuration profiles) are correct as written. Note: `node_modules` isn't installed in my working copy, so ESLint/Prettier weren't run locally — the added line is a one-line map entry matching the surrounding style. CI will confirm.	2026-07-28 21:47:42 -05:00
Noah Talerman	3a78739c10	Low contrast text on dashboard charts (#49651 ) - [x] QA'd all new/changed functionality manually For the following bug: - https://github.com/fleetdm/fleet/issues/49626 Before: <img width="1362" height="492" alt="Screenshot 2026-07-28 at 12 59 19 PM" src="https://github.com/user-attachments/assets/2a8be8a5-4687-4259-8aec-7b49e4c2b93e" /> <img width="1365" height="477" alt="Screenshot 2026-07-28 at 1 00 11 PM" src="https://github.com/user-attachments/assets/855b19c7-e855-40b9-9952-3ca45a443dee" /> <img width="928" height="443" alt="Screenshot 2026-07-28 at 1 01 51 PM" src="https://github.com/user-attachments/assets/f66ed7f9-9f0f-4416-a938-57a6c6b3d984" /> <img width="923" height="443" alt="Screenshot 2026-07-28 at 1 01 54 PM" src="https://github.com/user-attachments/assets/83fab0ae-1496-44b0-b65e-c256e4f0d0bc" /> After: <img width="1349" height="469" alt="Screenshot 2026-07-28 at 12 59 08 PM" src="https://github.com/user-attachments/assets/f51e6cce-6f2f-4385-8c7d-81a8d3e99ec3" /> <img width="1368" height="552" alt="Screenshot 2026-07-28 at 12 59 55 PM" src="https://github.com/user-attachments/assets/75557fea-d614-4383-a557-8ef7f6a8f3ef" /> <img width="919" height="378" alt="Screenshot 2026-07-28 at 1 01 39 PM" src="https://github.com/user-attachments/assets/82db0bdf-c8c2-40a2-90e0-f531c0cfb9b3" /> <img width="920" height="435" alt="Screenshot 2026-07-28 at 1 01 42 PM" src="https://github.com/user-attachments/assets/ed01a037-22ba-40a6-9833-a7f98541e536" />	2026-07-28 14:30:26 -07:00
Rahul Raghunathan	8f7a4ba2a0	Redirect to software inventory on 404 when switching fleets on title (#48389 )	2026-07-28 13:58:55 -07:00
Rahul Raghunathan	5bdbcc8495	48792 fix actions dropdown layout shift (#49430 )	2026-07-28 13:56:50 -07:00
RachelElysia	f7c2cf4106	Fleet UI: PR #49292 follow-up — buttons, 8px gaps, focus ring (#50049 )	2026-07-28 13:52:48 -07:00
Juan Fernandez	360e4b74ff	Update macOS disk encryption banner copy for ADE-enrolled hosts Relates #47832 Both the Host details and My device pages told the reader to log out or restart when Fleet didn't have a Mac's FileVault key. That's wrong for ADE-enrolled hosts: they escrow the key automatically, and the only thing standing between the host and a cleared banner is the next vitals refetch. It stays correct for manual enrollment, where Escrow Buddy only generates a new key at next login.	2026-07-28 15:33:26 -04:00
LeAnn	418fd60e9c	Clarify "Not supported" on Hosts page by adding tooltip (#49301 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #39987 - Added tooltips to the "Agent," "Last restarted," and "Status" column headers on the Hosts page explaining which platforms are supported and why. - On the Host details page, vitals with a "Not supported" value are now hidden instead of shown. - Fixed the "Last restarted" vital showing on ChromeOS hosts, where it's not actually collected. - Updated the "Last opened" tooltip on the Host details Software table to explain why it's only supported for native macOS, Windows, and Linux apps and packages. - Remove cellProps.rows.length === 1 workaround (which suppresses the tooltip whenever the table has exactly one row) by adding the correct CSS which removes the tooltip overflowing if host table is only 1 row # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Added/updated explanatory tooltips for Hosts table column headers (Agent, Last restarted, Status) with clearer supported-platform wording. - Clarified “Last opened” tooltip scope to native macOS, Windows, and Linux app/package entries. - Bug Fixes - Removed “Last restarted” from Host details for ChromeOS hosts when the value isn’t collected. - Prevented vitals rows from rendering when their values resolve to “Not supported,” and tightened “Last restarted” platform visibility. - Fixed tooltip overflow/positioning in the single-row Host software table case. - Tests - Updated and expanded vitals/header coverage to match the new display rules. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 10:30:21 -07:00
Carlo	5250936179	Consistent URL/email on-blur validation across forms (#40410 follow-up) (#49932 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #40410 Follow-up to #48854, which added on-blur validation to the software vulnerability automations webhook. QA found three more forms with inconsistent validation, in two flavors: - Validated only on save (no on-blur feedback): Policies > Manage automations > Other workflows > Destination URL. - Errored before any input (validation fired on mount/enable): Settings > Users > Add/edit user > Email, and the host status webhook Destination URL (both global and fleet settings). This makes them consistent with the rest of the app: no error on open/enable → validate on blur → clear the field's error as the user edits → validate on submit. - `OtherWorkflowsModal` — added an on-blur handler for the Destination URL (guarded by the field's disabled condition). - `UserForm` — on-blur now validates only the blurred field (so blurring the autofocused Name no longer flags the empty Email/Password); submit validates all fields. - `GlobalHostStatusWebhook` — removed the `useEffect` that validated the moment the webhook was enabled; validation now runs on blur and submit. - `TeamSettings` (fleet host status webhook) — the Destination URL error is no longer surfaced on change/enable; it validates on blur and submit. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated (URL and email fields validate on blur and on submit; no errors are shown before the user interacts). ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Improved webhook destination URL validation across integrations, team settings, and workflow automation forms. * Validation messages now appear after leaving the URL field, rather than prematurely while enabling or editing. * Prevented saving or submitting forms with missing or invalid destination URLs. * Correctly clears validation errors once a valid URL is entered. * Improved user form validation so field-specific errors appear only for the field being reviewed, while submit continues to validate the full form. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 13:23:48 -04:00
Victor Lyuboslavsky	ffc85a42ae	Add Windows admin account config (#49863 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #48720 Subtask of https://github.com/fleetdm/fleet/issues/43488 This PR only adds the Windows config, and doesn't mess with macOS configs. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added managed local account settings for Windows to app and team configuration, including GitOps support. * Exposed an explicit enabled/disabled toggle in configuration output and Fleet controls. * Added licensing and Windows MDM prerequisites for enabling the setting. * Bug Fixes * Managed local account enable/disable actions are now correctly persisted and declaratively applied. * Activity feed messages now display platform-specific (macOS vs Windows) wording. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 12:10:33 -05:00
kitzyandAllen Houchins	3ce3e238ed	Add 6 Windows Fleet-maintained apps (#50016 ) Related issue: N/A — Windows Fleet-maintained app (FMA) coverage for apps found deployed in a customer's ManageEngine SDP environment but missing from Fleet. ## What this does Adds 6 Windows Fleet-maintained apps — the subset of a larger batch that passes the FMA validator cleanly. Each has a winget-sourced input, a generated output manifest, and a catalog icon. Detection identity was verified against each app's real registry DisplayName; apps whose DisplayName carries a version suffix use fuzzy name matching, the rest match exactly. MSI (clean, auto upgrade-code uninstall): - Git Extensions — versioned ARP name (`Git Extensions 7.2.0.92`) → fuzzy match - TightVNC, Yarn, SonicWall NetExtender (WiX), Zoom Outlook Plugin — clean ARP names → exact match EXE — NSIS (custom `/S` install + registry-lookup uninstall): - Spyder — versioned ARP name (`Spyder 6`) → fuzzy match ## Notes - Detection verification. Every app's `unique_identifier` (registry DisplayName / osquery `programs.name`) and publisher were verified per the `new-fma` skill against winget `AppsAndFeaturesEntries`, MSI Property tables (`msiinfo`), and vendor installer scripts — not assumed. Git Extensions' MSI `ProductName` is `Git Extensions 7.2.0.92` and Spyder's ARP entry is `Spyder 6`, so both need `fuzzy_match_name`; the four exact-match apps were confirmed clean (e.g. TightVNC registers as `TightVNC`, not a versioned string). - Validated on a real Windows host. All six pass the FMA CI validator (install → detect → uninstall) on the SYSTEM-context Windows runner. - Icons. Git Extensions, SonicWall NetExtender, TightVNC, Yarn, and Zoom Outlook Plugin ship new catalog icons + website assets; Spyder reuses the existing `Spyder` icon. ## Testing - [x] FMA CI validator (install → detect → uninstall) on the SYSTEM-context Windows runner. - Generated outputs verified locally: all 6 produce valid manifests; MSI apps carry the correct UpgradeCode-based uninstall; exists/patched queries reviewed for name + publisher correctness; `go test ./ee/maintained-apps/...` passes. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added maintained Windows catalog entries for Git Extensions, SonicWall NetExtender, Spyder, TightVNC, Yarn, and Zoom Outlook Plugin, including silent install, version upgrade detection, and maintenance-ready uninstall flows. * Added new software icons for these apps and expanded icon matching so they display correctly in the catalog. * Bug Fixes * Improved Spyder Windows uninstall targeting and command/argument handling for more reliable removals. * Documentation * Refreshed Spyder supported version details to 6.1.5. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Allen Houchins <allenhouchins@mac.com>	2026-07-28 10:14:53 -05:00
Allen Houchins	aea7c4068f	Remove Nocturnal as a macOS FMA (#50050 ) Related issue: N/A — fixes the failing scheduled "Update Fleet-maintained apps" workflow The `nocturnal` cask was removed from homebrew-cask on 2026-07-28 ([Homebrew/homebrew-cask@517db75](https://github.com/Homebrew/homebrew-cask/commit/517db75b78)) after being deprecated on 2024-07-27 and disabled on 2025-07-27, both `because: :unmaintained` (upstream repo's last push was in 2018). The brew API now returns 404 for it, so the maintained-apps ingester panics: ``` panic: ingesting homebrew app: app not found in brew API ``` This removes Nocturnal as a Fleet-maintained app, following the same pattern as #46541 (Messenger) and #47420 (Dell Display Manager): - `ee/maintained-apps/inputs/homebrew/nocturnal.json` — Homebrew input - `ee/maintained-apps/outputs/nocturnal/darwin.json` — macOS output data - `ee/maintained-apps/outputs/apps.json` — Nocturnal entry - `frontend/pages/SoftwarePage/components/icons/Nocturnal.tsx` and its import/mapping in `index.ts` - `website/assets/images/app-icon-nocturnal-60x60@2x.png` # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually (verified `apps.json` still parses, no remaining `nocturnal` references, ESLint passes on the icons index) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Removed Apps* - Removed Nocturnal from the maintained application catalog. - Removed its installation and uninstallation support. - Removed the Nocturnal icon from software listings. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 09:53:17 -05:00
Andrew Mellor	8e0c038eff	47701 abm errors UI (#49896 ) Related issue: Resolves #47701 # Checklist for submitter ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually: Not able to test token_rejected, terms and conditions or apple server error. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added an Apple Business Manager invalid-token warning banner that lists the affected organization names. * Introduced dedicated invalid-token state support so the banner can appear with the correct priority. * Bug Fixes * Ensured invalid-token state is cleared when no tokens are returned and consistently set on token fetch success/error. * Improved Apple/DEP status messaging and made profile-assignment rendering more resilient for non-DEP and partial-error responses. * Style * Adjusted banner spacing and added styling for DEP error presentation. * Tests * Added/expanded tests for invalid-token messaging, ABM expiry updates, and MDM status/error scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 15:01:48 +01:00
Rajendra KadamandMagnus Jensen	0504e5949e	Add host_id and host_serial to Apple mdm_enrolled activity (#49969 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #49777 ## Description Adds `host_id` and `host_serial` to the Apple `mdm_enrolled` activity so IT admins can build automations on top of it, and surfaces the activity on the individual host's activity timeline. - `server/fleet/activities.go` — added `HostID` to `ActivityTypeMDMEnrolled` and a `HostIDs()` method (mirrors the existing `ActivityTypeMDMUnenrolled` pattern), so the activity is linked to the host and appears on its timeline. - `server/mdm/lifecycle/lifecycle.go` — populate `host_id` for macOS/iOS/iPadOS enrollments. Account-driven user (BYOD) enrollments have no hardware serial, so they report the enrollment ID as `host_serial` too, keeping `host_serial` populated for automations regardless of enrollment type. - Frontend — new `MdmEnrolledActivityItem` component, registered in the host past-activity component map (and the `IHostPastActivityType` union), renders the now-host-linked `mdm_enrolled` activity on the host details Activity card. There's no Figma, so the copy mirrors the sibling `mdm_unenrolled` item (e.g. "Mobile device management (MDM) was turned on for this host"). `host_id` uses `omitempty`, so Windows (`microsoft_mdm.go`) enrollments keep their existing activity payload unchanged — Windows is intentionally out of scope, handled in #47874, which also owns the audit-log documentation update for the shared field. > For reviewer: the ADUE `host_serial = enrollment_id` behavior comes from the issue's test plan. It means `host_serial` and `enrollment_id` carry the same value for BYOD. Flagging in case Product would rather leave `host_serial` empty for ADUE and have automations read `enrollment_id`. ## Testing - Automated: `TestMDMEnrolledActivityHostIDAndSerial` (`server/mdm/lifecycle`) covers device enrollment (`host_serial` = hardware serial) and ADUE (`host_serial` = enrollment ID), both asserting `host_id`/`HostIDs()`. Also verified `server/datastore/mysql` `TestMDMEnrollment`, `server/activity/internal/mysql` `TestListActivities`, and `server/service` `TestMDMTokenUpdate` pass. - Live (simulated) manual macOS enrollment* via `osquery-perf`: the `mdm_enrolled` activity recorded `host_id` + `host_serial`, and an `activity_host_past` row linked it to the host (confirmed it shows on the host timeline). - Frontend: `MdmEnrolledActivityItem.tests.tsx` covers the rendered copy for macOS/iOS/Android and the actor/no-actor variants; also visually confirmed the activity renders on a host's Activity card in the running app. `yarn jest`, `eslint`, and `tsc` pass. - Updated the MDM integration tests (`integration_mdm_test.go`, `integration_mdm_dep_test.go`, `integration_vpp_install_test.go`) whose activity-detail and host-feed assertions changed now that `mdm_enrolled` carries `host_id` and appears on the host timeline (feed assertions now filter by activity type). - Pending on-device QA (next week): DEP/ADE macOS and account-driven user enrollment (iOS/iPadOS) on real hardware, per the issue's test plan. - Regression: Windows `mdm_enrolled` payload is unchanged (`host_id` is omitted when zero); both platforms' `mdm_unenrolled` are unaffected. # Screenshot for the frontend change <img width="706" height="382" alt="Screenshot 2026-07-28 at 11 16 57 AM" src="https://github.com/user-attachments/assets/8f57d129-f819-4399-8754-18b397a49db8" /> # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- manual macOS verified via simulator; DEP + real-device ADUE pending next week --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * New Features * Added support for rendering “MDM enrolled” in the host activity feed with platform- and actor-aware messaging. * Bug Fixes * Updated Apple “MDM enrolled” activity details to include the correct host identifier and serial/enrollment identifiers. * Ensured host-scoped activity behavior applies only when the host is known (host id present). * Tests * Expanded regression and integration coverage for “MDM enrolled” activity details and feed contents, including VPP-related assertion stability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Magnus Jensen <magnus@fleetdm.com>	2026-07-28 14:27:42 +05:30
Steven Palmesano Copilot Autofix powered by AI Lucas Manuel Rodriguez	bf3e1bab99	Add Apple marketing names to backend, frontend, and an osquery table (#46482 ) Related issue: Resolves https://github.com/fleetdm/fleet/issues/46818 and https://github.com/fleetdm/fleet/issues/48524. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Host lists and Host details now show human‑readable Apple hardware marketing names (macOS, iOS, iPadOS) where available (e.g., "MacBook Pro (16‑inch, 2021)"), replacing raw model identifiers. * Hardware model displays fall back to the original model identifier for non‑Apple or unmapped devices. * Bug Fixes / CSV * Exported host CSVs now align with the UI by using the marketing name for Apple devices when available. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>	2026-07-27 22:26:30 -03:00
LeAnn	84896a5687	Add tooltip explaining missing Refetch button for Android hosts (#50017 ) <img width="632" height="196" alt="Screenshot 2026-07-27 at 3 09 16 PM" src="https://github.com/user-attachments/assets/7bfc1440-48a4-4baf-8747-cc5e848a3a53" /> <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #50001 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added an explanatory tooltip to the “Last fetched” field for Android hosts. * The tooltip clarifies that Android hosts sync automatically and therefore do not have a “Refetch” button. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 15:39:22 -07:00
RachelElysia	29f20aca31	Fleet UI: Fix empty button boxes in batch run script modal (#49997 )	2026-07-27 13:07:01 -07:00
Victor Lyuboslavsky	19efda2d1b	Windows SCEP profiles now fail with non-printable chars (#49887 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #47492 Windows cert profile fails if challenge uses non-printable characters. <img width="987" height="329" alt="image" src="https://github.com/user-attachments/assets/04dc7c78-8e3e-41c8-823e-cb4a961a91eb" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * Bug Fixes * Windows SCEP profiles now fail with a clear error when the certificate authority challenge includes characters not supported by Windows ASN.1 PrintableString. * Prevents misleading “Verified” status when no certificate is installed. * Preserves valid challenge values, including leading/trailing spaces. * Improves Windows error tooltips by showing raw certificate-install error details. * Tests * Added coverage for invalid/valid Windows SCEP challenge scenarios and the updated error tooltip behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 12:49:14 -05:00
Rajendra Kadam	17669eca02	Center-align setup experience app icons (#49962 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #46973 > Draft: on-device QA (Mac/iPhone/iPad) is pending hardware, expected next week. Opening as draft for early review of the approach. ## Description FMA and custom-package app icons were misaligned on the macOS setup experience ("Setting up your device") screen — icons rendered at different sizes and their "Install …" labels didn't line up. Root cause: `SetupSoftwareProcessCell` forced `.software-icon__small { width: $pad-xlarge }` (32px, width only). That class lands on different elements in `SoftwareIcon`'s two render paths, so it hit them differently: - Fleet-maintained / VPP apps (icon URL) → the class is on the wrapper `<div>`; the 24px `<img>` inside stayed 24px, left-aligned. - Custom packages (no URL) → the class is on the fallback SVG itself, which got stretched to 32px wide. Result: different icon sizes/positions by app type → the misalignment. Fix: remove the width override so every app type renders `SoftwareIcon` at its consistent, vertically-centered 24px "small" size. ## Testing Verified in Storybook (added `SetupSoftwareProcessCell.stories.tsx`, `MixedAlignment` story) with real matched brand icons (Chrome, 1Password, VS Code, Zoom), a generic custom-package icon, and a URL/`<img>` icon stacked together: - Before (with the override): icons render at mixed 24/32px sizes; "Install …" labels don't align. <img width="1135" height="398" alt="before" src="https://github.com/user-attachments/assets/fe216ab4-0a7b-4211-b8aa-96e65e6ca3f5" /> - After (this change): all icons render at 24px, centered, labels aligned. <img width="1185" height="425" alt="after" src="https://github.com/user-attachments/assets/28257eb8-df6e-4168-a0bb-28dda4bb40ba" /> On-device QA to follow once hardware is available. ## Notes for reviewer - The `width: $pad-xlarge` (32px) was added in #33770, so 32px may have been the intended icon size. This change makes them a consistent 24px. If a larger icon is desired, that's a follow-up done properly via a real `SoftwareIcon` size (not a width-only override) — flagging for PD input since this is `:product`-labeled. - Included a Storybook story for visual verification/regression; happy to drop it if that's not wanted here. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [ ] QA'd all new/changed functionality manually <!-- pending on-device QA --> - Added a Storybook story for visual verification (not an automated test). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Improved software process cell styling for more consistent icon sizing and alignment. * Tests * Added Storybook scenarios covering fleet-maintained apps, custom packages, uploaded icons, and mixed app layouts. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 19:42:22 +05:30
melpike	af65282522	Align helper text with checkbox/radio labels (#49977 ) Moves changes from #49920 to `main`. Originally targeting `docs-v4.91.0` — retargeted to this branch. Related: #49920 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Improved checkbox and radio button helper-text alignment so it lines up with the associated label. * Adjusted spacing between controls, labels, and helper text for a cleaner form layout. * Documentation * Added component examples demonstrating checkbox and radio buttons with helper text. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 08:07:54 -06:00
Allen Houchins	f96cb9d6c7	Add Windows FMAs (letter I): 17 apps (#49923 ) Related issue: N/A — part of the ongoing Windows Fleet-maintained apps (FMA) parity workstream (letter I). ## What this does Adds 17 Windows Fleet-maintained apps for the letter-I batch. apps.json descriptions follow the house `"<Name> is a …"` convention. IBM Semeru Runtime Open Edition (Java) — 8 apps (MSI, machine, x64): JDK 8/11/17/21 and JRE 8/11/17/21. Per-major detection follows the Eclipse Temurin pattern — `name LIKE 'IBM Semeru Runtime Open Edition (JDK\|JRE)%' AND publisher = 'Semeru' AND version LIKE '<major>.%'` — so majors and JDK/JRE never cross-match. All 8 share the IBM Semeru logo. Other apps (9): - IronPython 3 — MSI; fuzzy `IronPython 3%` (excludes the EOL v2) - ImageGlass — dual-scope MSI, custom `ALLUSERS=1` install - install4j — install4j installer (bundled JRE), `-q` - IrfanView — custom installer `/silent /allusers=1`; versioned+arch name → fuzzy `IrfanView%` - iMazing HEIC Converter, IsoBuster, ImpExpPro — Inno Setup (`/VERYSILENT`) - Infix PDF Editor — Inno, x86 - Ibis Calculeren voor Bouw — InstallShield wrapper; uninstall via the MSI UpgradeCode (`uninstall_type: msi`) ## Dropped from this batch (recorded in the workstream tracker) - IBM Aspera Connect — MSI installs per-user by default (`ALLUSERS=2`/`MSIINSTALLPERUSER=1`, no machine switch in the manifest) + a rolling `/latest/` URL that 404s on the next release. - IcedTea-Web (Azul and AdoptOpenJDK) — both declare a hard, unbundled JRE dependency; it's a JNLP launcher that's dead-on-arrival without Java the FMA won't install (AdoptOpenJDK variant is also archived). - IronPython 2 — EOL (Python 2). install4j 9 — legacy 2022 build. IrfanView PlugIns — add-on that drops DLLs with no independent ARP entry (undetectable) and depends on the base app. - Intermedia Unite and its Teams Desktop Plugin — both use non-versioned "latest" URLs (winget-bot auto-updated; the pinned SHA rots each release); the plugin also depends on Teams + Unite. ## Notes - Ibis Calculeren voor Bouw, ImpExpPro, and Infix PDF Editor ship without a catalog icon — no clean ≥256px first-party logo exists for these niche apps (they fall back to the generic icon). - Ibis carries some risk: its DisplayName couldn't be verified offline (compressed InstallShield payload) and its installer URL is non-versioned — flagging for the validator; will drop if detection/version fails. - IsoBuster uses a non-versioned URL that currently matches the pinned 5.8, so no `ignore_hash`; winget re-ingestion tracks future drift. - Verification (installer type/scope/arch, ProductCode/UpgradeCode, dependencies, silent switches, URL stability, en-US locale) was done per the `new-fma` skill against the winget-pkgs manifests, with several DisplayNames confirmed via `innoextract`/`msitools`. ## Testing - [ ] FMA CI validator (install → detect → uninstall) on the SYSTEM-context Windows runner — pending. - Generated outputs verified locally: all 17 produce valid manifests; per-major Semeru queries and MSI UpgradeCode uninstalls confirmed; all apps.json descriptions present and convention-compliant.	2026-07-24 21:46:12 -05:00
RachelElysia	09fea47ce4	Fleet UI: Handle long fleet names across the Fleets UI (#49216 ) ## Issue Closes #47290 Also implements the "Cap free-text `maxLength` to the backend column length" pattern established in [#49041 (patterns.md thread)](https://github.com/fleetdm/fleet/pull/49041/files#r3572648691). ## Description Fleet name inputs had no `maxLength` cap and no service-layer length check, so a name >255 chars failed with a raw MySQL `Data too long` error, and several UI surfaces didn't handle long names gracefully. This PR fixes all four manifestations called out in the bug, plus a related label-overflow case on the host details page, and hardens adjacent name inputs across the app. Frontend fixes for #47290: - Create/Rename fleet name inputs now cap at 255 characters (matches `teams.name varchar(255)`). - Fleets table Name column uses `LinkCell` with `tooltipTruncate` + `className="w400"` so long names truncate with an ellipsis and full-name tooltip instead of overflowing across the Hosts/Users columns. - Fleet-detail page header (`.team-details__team-header`): h1 gets `overflow: hidden; text-overflow: ellipsis; white-space: nowrap;`, `__team-details` gets `min-width: 0; flex: 1`, and `.action-buttons` gets `flex-shrink: 0` + `white-space: nowrap` on buttons so Manage enroll secrets / Rename / Delete no longer wrap to a second line when the fleet name is long. - Manage enroll secrets modal body — `__description` gets `overflow-wrap: anywhere; min-width: 0` so a long `<b>{fleet name}</b>` wraps within the modal instead of spilling out the right edge. Backend fixes for #47290: - New `fleet.MaxTeamNameLength = 255` constant. - `NewTeam`, `ModifyTeam`, and `ApplyTeamSpecs` now return `fleet.NewInvalidArgumentError("name", "may not exceed 255 characters")` instead of surfacing a raw `Data too long` MySQL error. Covers UI, API, and GitOps entry points. Broader consistency pass (per [#49041 thread](https://github.com/fleetdm/fleet/pull/49041/files#r3572648691)): - New shared `MAX_ENTITY_CHAR_LENGTH = 255` constant in `frontend/utilities/constants.tsx`. - Refactored 8 existing files that had ad-hoc `NAME_MAX_LENGTH = 255` / `MAX_LABEL_NAME_LENGTH = 255` locals to use it. - Slotted it into 16 additional `InputField` name/description inputs that were missing a cap (API user, custom variable, certificate, label name + description, pack name + description, and all 5 CA forms — CustomEST, CustomSCEP, Smallstep, Digicert, Hydrant). - Pruned dead FE length validators that can no longer fire now that the DOM cap enforces the limit (certificate modal, custom variable modal, both label helpers, both category modals). Unusual/shorter caps (e.g. `varchar(64)`, custom business rules) still keep their inline validators — silent truncation is only appropriate for the common 255-char norm. Bonus: fixed the long-label overflow on the host details Labels card by capping the pill button `max-width` at 300px. ## Screenrecording https://github.com/user-attachments/assets/b917b72e-7437-4d0c-a1a1-c49b4b1c28ba https://github.com/user-attachments/assets/3a3efbb2-09d8-4f47-9fd4-f158b3453b9e https://github.com/user-attachments/assets/73e5e022-dc93-4381-82b3-be9549d050e6 Latest - max width 300px long label: <img width="1106" height="262" alt="Screenshot 2026-07-23 at 11 29 24 AM" src="https://github.com/user-attachments/assets/741fddbd-f78d-4578-a025-bddf64a81c25" /> ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Test coverage: - `CreateFleetModal.tests.tsx`, `RenameFleetModal.tests.tsx` — new case per file asserting the name input's `maxLength === 255`. - `AddCertificateModal.tests.tsx`, `Variables.tests.tsx` — the existing "shows too-long error when pasting 256 chars" tests are now unreachable via the DOM cap; converted to `maxLength === 255` assertions. - `ee/server/service/teams_test.go` — `TestNewTeamNameValidation`, `TestModifyTeamNameValidation`, and `TestApplyTeamSpecsNameValidation` each get two new cases (accepts at the limit, rejects one over with the expected error message). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Limited fleet, team, and other user-entered names and descriptions to 255 characters. * Replaced database errors for oversized names with clear validation messages. * Prevented long fleet and label names from overflowing tables, headers, modals, and host details. * Improved modal and dropdown layouts for long text. * Tests * Added coverage for character limits, boundary values, and multibyte names. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-24 11:22:06 -04:00
RachelElysia	3e3097cf49	Fleet UI: Drop I-beam cursor on non-underlined tooltips (#49859 )	2026-07-24 07:01:48 -07:00
Magnus Jensen	122c5d2709	don't stop propagation for react-select (#49878 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves unreleased bug with Fleet dropdown not working https://github.com/user-attachments/assets/6460efe2-2181-48bc-9ca0-67f64241a3e9 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. Unreleased - [ ] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit Bug Fixes * Improved fleet selection behavior so dropdown interactions work reliably without overriding built-in menu handling. * Selecting a fleet now correctly updates the displayed fleet and closes the dropdown menu. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-24 09:58:11 -04:00
Rajendra Kadam	aa572dcca4	Show ABM organization name in edit-fleets success toast (#49877 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #48914 ## Description The success toast shown after editing fleet assignments for an Apple Business Manager (ABM) organization read: > Successfully updated fleets for AB token. The trailing "AB token" made the message unclear. It now names the organization instead, matching the modal's title: > Successfully updated fleets for `<org name>`. The organization name (`token.org_name`) was already available in the component (it's used as the modal title), so this is a copy-only change with no new data plumbing. Note: the issue's expected behavior left the exact wording to Product ("TODO — Product to decide"). This implements Product's written suggestion (`Successfully updated fleets for {org name}`) so the awkward wording isn't blocking; the string is trivial to adjust if Product/design prefer different phrasing in review. ## Testing - Manually QA'd in the UI: with a configured ABM organization, edited a fleet assignment and confirmed the toast now shows the org name. - Existing unit tests for the modal's helpers (`getOptions`, `getSelectedTeamIds`) still pass; no test asserts the toast string. - `eslint` and `prettier` pass on the changed file (added `token.org_name` to the `useCallback` dependency array to satisfy `react-hooks/exhaustive-deps`). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit Bug Fixes * Updated the success notification shown after fleet teams are saved to include the associated organization name. * Ensured the notification always reflects the currently selected organization. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-24 13:30:57 +05:30
RachelElysia	9cfd907be6	Fleet UI: Hide empty host summary card on Free-tier Android hosts (#49848 )	2026-07-23 12:54:18 -07:00
Magnus Jensen	f85187bcd3	Added danger variant to checkbox (#49806 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves https://fleetdm.slack.com/archives/C02A8BRABB5/p1784765147322239?thread_ts=1784727509.435919&cid=C02A8BRABB5 https://github.com/user-attachments/assets/e6bdeeb9-9ec3-4ba6-9669-6ea18ec8362d # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added a danger variant for checkboxes, with red styling for default, hover, and active states. * Updated release and wipe confirmation checkboxes to clearly indicate destructive actions. * Added Storybook controls for checkbox values and variants. * Bug Fixes * Standardized checkbox values to use boolean states only. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-23 19:18:57 +02:00
Carlo	83f3f4b560	Add clear error for Firefox / Firefox ESR conflict (#49714 ) Related issue: Resolves #49682 Mozilla Firefox and Firefox ESR are distinct Fleet-maintained apps that share the macOS bundle identifier `org.mozilla.firefox`, so they resolve to one software title. Adding both to a fleet previously gave a generic conflict error (or no error at all). This adds a clear message — "Only one of Mozilla Firefox or Mozilla Firefox ESR can be added to the same fleet." — on both the single-add and GitOps/batch paths. The check is general (any two FMAs sharing a bundle identifier), with the app names filled in dynamically. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements). ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Bug Fixes* - Prevented adding both Mozilla Firefox and Firefox ESR to the same fleet when they share a bundle identifier. - Updated the UI to show a specific conflict message explaining that only one of the two can be added. - Ensured existing workflows still work for adding new versions of the already-selected app. - Tests - Added backend and frontend test coverage for the new conflict detection and error-message formatting. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-23 12:39:17 -04:00
RachelElysia	86528fa6bf	Fleet UI: Fix TS errors from removed button variants (#49828 )	2026-07-23 08:19:02 -07:00
RachelElysia	968ea20aeb	Fleet UI: Searchable fleets dropdown with add-fleet affordance (#49690 )	2026-07-23 07:26:04 -07:00
Steven Palmesano	62ed3583e6	Clear button styles (#49292 ) Related issue: Resolves #49276 New features - Added new "Secondary" (bordered, off-white fill) and "Subdued" (borderless, low-emphasis) button variants to match the Figma spec, alongside the existing Primary style. - Allowed rows to be selected in Controls > OS updates. Cleanup - Once nothing referenced the old styles anymore, fully removed the old `text-icon`, `brand-inverse-icon`, `inverse-alert`, `inverse`, and `icon` button variants (type, styles, and Storybook entries) from the shared `Button` component. - Removed the `iconStroke` prop, which had become a no-op once the old variants it supported were gone. - Renamed `ActionsDropdown`'s variants (`button`/`brand-button`/`small-button`) to `subdued`/`primary`/`secondary` to match the same naming used everywhere else. - Replaced a one-off dropdown implementation on the Software title page with the shared `ActionsDropdown` component, instead of maintaining duplicate styling logic. - Changed the button name on Host details > Reports > Report details from "View data for all hosts" to "View report for all hosts" (to match the previous page's Actions drop-down options). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <img width="1475" height="241" alt="Screenshot 2026-07-21 at 06 35 49" src="https://github.com/user-attachments/assets/7cfbd444-7837-40e8-854e-bc5989d57d85" /> <img width="661" height="306" alt="Screenshot 2026-07-21 at 06 37 18" src="https://github.com/user-attachments/assets/5d0c4873-8179-4089-b115-7e8cd3a53b4d" /> <img width="1427" height="423" alt="Screenshot 2026-07-21 at 06 37 30" src="https://github.com/user-attachments/assets/a4850a60-f44a-4902-b45e-0094f23a52f8" /> <img width="1427" height="640" alt="Screenshot 2026-07-21 at 06 37 46" src="https://github.com/user-attachments/assets/738a4a7f-cd7d-4162-b659-6f649c32204d" /> <img width="1445" height="479" alt="Screenshot 2026-07-22 at 07 03 22" src="https://github.com/user-attachments/assets/4f672dc0-5c6d-4eb8-8465-ed5233fcd1b2" /> <img width="811" height="871" alt="Screenshot 2026-07-21 at 06 41 20" src="https://github.com/user-attachments/assets/5421c96e-2dab-492a-af26-be0e5a7791ca" />	2026-07-23 07:11:59 -05:00
Juan Fernandez	fbccb8cc59	Emit created/deleted activities for setup experience scripts Setup experience script add/replace/delete now record activities (API and GitOps), skipping no-op re-submissions.	2026-07-23 06:41:51 -04:00
Juan Fernandez	e91a0b2987	Normalize login responses for MFA-enabled accounts Make failed logins for MFA-enabled accounts return a consistent response and timing regardless of the cause, in line with authentication best practices. Guidance for CLI users whose client can't complete email verification is now surfaced by fleetctl on any login failure. Added a `user_mfa_requested` activity, recorded when valid credentials are submitted for an MFA-enabled account and a verification email is sent.	2026-07-23 06:41:27 -04:00
Magnus Jensen	5d8f46bc34	Support release device from AB in the frontend (#49748 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #49368 Video: https://github.com/user-attachments/assets/d73a2146-be13-4bfd-802a-f02eb5681b69 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. Part of backend PR - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added “Release from Apple Business” to eligible host actions, including a confirmation modal with success and error handling. * Added Apple Business release entries to the activity feed. * Bug Fixes * Improved user-facing Apple Business error and “Learn more” messaging, including clearer output when Apple Business device status isn’t accessible. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-23 09:43:50 +02:00
Allen Houchins	1a1b6e786a	Add Box Tools Fleet-maintained app for Windows and macOS (#49779 ) Related issue: Resolves #49738 Adds Box Tools as a Fleet-maintained app for Windows (winget `Box.BoxTools`) and macOS (Homebrew cask `box-tools`). ## Windows details (verified against the real installer) - Installer: `BoxToolsInstaller-AdminInstall.msi` (machine-wide admin MSI, `ALLUSERS=1`), x64. - MSI Property table verified with msitools: `ProductName` = `Box Tools`, `Manufacturer` = `Box`, `ProductVersion` = `4.32.0.1324` — all match the winget manifest, so `unique_identifier: "Box Tools"` and the generated exists query (`name = 'Box Tools' AND publisher = 'Box'`) match what osquery reports from the registry. No `program_publisher` override needed. - The winget manifest has no `Scope`, so `installer_scope: "machine"` is set in the input (confirmed by `ALLUSERS=1`). - ProductCode/UpgradeCode match the manifest; standard auto-generated machine-MSI install + upgrade-code uninstall scripts. - Downloaded SHA256 matches the manifest SHA (`9f5958...c5066`). - No sibling-name collision with the existing Box Drive FMA (its DisplayName is `Box`; matching is exact). ## macOS details Box Tools on macOS is per-user only: the cask installs the app bundles to `~/Library/Application Support/Box/Box Edit/`, Box's admin `.pkg` forbids the local system domain (`enable_localSystem="false"`), and [Box's large-scale deployment docs](https://support.box.com/hc/en-us/articles/360043695834-Large-Scale-Deployments-Box-Tools) instruct running the installer as the console user (multi-user Macs are not a supported configuration). Because the install location is outside osquery's `apps` directory scan paths, detection relies on osquery's LaunchServices enumeration (`_LSCopyAllApplicationURLs` in `genApps`), which surfaces the bundles regardless of location — verified against a live install where all four Box Tools bundles are LaunchServices-registered at the per-user path and appear in the `apps` table. - `unique_identifier: com.Box.Box-Edit` (verified `CFBundleIdentifier` of `Box Edit.app` in the DMG). - Custom install script (the cask's app artifacts are all `target:`-style, which the script generator skips, so the auto-generated script would be a no-op): resolves the console user (falling back to `lastUserName` when run while logged out), quits the Box apps, copies the four app bundles from the DMG's `Install Box Tools.app/Contents/Resources/` into the user's `~/Library/Application Support/Box/Box Edit/` (replicating the cask/pkg payload exactly), chowns them, and registers them with LaunchServices in both root and user contexts so inventory and box.com pick them up without a first manual launch. - Custom uninstall script: quits/kills the Box Tools processes and removes `Box Edit` from every local user's home. The parent `Box` directory is shared with Box Drive, so it is only removed if left empty. - The cask uses `sha256 :no_check` (rolling `currentrelease` URL) — the established FMA convention for such casks (same as Google Chrome/VS Code darwin); the server pins the hash of what it downloads at add time. - Cask version is `4.32` while `CFBundleShortVersionString` is `4.32.0`; the validator's prefix matching and the patched query's `version_compare` both treat these as consistent. ## Shared caveat ⚠️ Both installer URLs are rolling `currentrelease` links. On Windows the pinned SHA will drift when Box ships a new build until the FMA auto-update ingests the new manifest; macOS uses `no_check` per the cask. ## Icon Generated from the official 512×512 Box Tools icon shipped inside the vendor DMG via `tools/software/icons/generate-icons.sh` (frontend `BoxTools.tsx` + map entry, website `app-icon-box-tools-60x60@2x.png`). Both platforms share the icon via the common `name`/slug. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Verified installer identity fields (MSI Property table, Info.plist bundle identifiers/versions) with msitools/PlistBuddy against the live installers; Windows output SHA matches the winget manifest. - [x] Verified on a live macOS install that the per-user Box Tools bundles are LaunchServices-registered and visible to osquery's `apps` table. - [ ] FMA validation CI (Windows + macOS runners) to confirm install/uninstall/detection. - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added Box Tools support for both Windows and macOS. * Added Box Tools install, upgrade, and uninstall handling for the maintained app catalog. * Published Box Tools metadata to the software catalog (including platform-specific entries and version targeting). * Added a Box Tools icon to the software interface for improved name matching. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-22 15:41:21 -05:00
Allen Houchins	a3f6a45fa9	Add Windows FMAs (letter H): 5 apps (#49478 ) Related issue: N/A — part of the ongoing Windows Fleet-maintained apps (FMA) parity workstream (letter H). ## What this does Adds 5 Windows Fleet-maintained apps for the letter-H batch, each with a winget-sourced input, generated output manifest, and a first-party catalog icon. - HashTools — Inno Setup, machine, x64. File-checksum utility (Binary Fortress). Has an evergreen WebView2 dependency (present on virtually all fleets; core hashing works without it). - HeidiSQL — Inno Setup, machine, x64. Custom install passes `/ALLUSERS` for machine scope (the ingester doesn't forward manifest `Custom` switches). - HWMonitor — Inno Setup, machine, x86. ARP DisplayName is `CPUID HWMonitor`; installs a kernel driver removed by its uninstaller. - HP Prime Virtual Calculator — WiX burn bundle, machine, x64. Uses a name-only exists query (the ARP publisher is MORAVIA Consulting, not the manifest's "HP"). - Huddle — InstallShield exe (`/exenoui /quiet`), machine, x86. Uninstall via the MSI UpgradeCode (`uninstall_type: msi`); `ignore_hash` for the non-versioned installer URL. ## Dropped from this batch (recorded in the workstream tracker) - HandBrake — the GUI declares an unbundled `Microsoft.DotNet.DesktopRuntime.10` dependency (won't run without it); the CLI is a portable zip with no Add/Remove Programs entry to detect. - HiPIN (`KPN.HIPIN`) — unbundled VCRedist + WebView2 dependencies, a non-versioned "latest" URL, and no ARP DisplayName/ProductCode. The `binbat.whipinto` candidate is an unrelated WebRTC tool (mismatch). ## Notes - Huddle uses a non-versioned `HuddleSetup.exe` URL — if the vendor ships past 4.8.0.0, osquery version detection may drift (same pattern that failed GoodSync in letter G). Flagging for the validator; will drop if it can't match. - Verification (winget manifest identity, installer type/scope/arch, ProductCode/UpgradeCode, silent switches, dependencies, URL stability) was done per the `new-fma` skill against the winget-pkgs manifests. ## Testing - [ ] FMA CI validator (install → detect → uninstall) on the SYSTEM-context Windows runner — pending. - Generated outputs verified locally: all 5 produce valid manifests; exists/patched queries reviewed; Huddle's MSI UpgradeCode uninstall auto-generated correctly.	2026-07-22 14:34:36 -05:00
Victor Lyuboslavsky	95b535a622	Reverting printableCharacters SCEP validation (#49758 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #49756 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * Bug Fixes * Custom SCEP proxy challenges can again include characters such as underscores. * Apple device enrollment works again with these challenges. * Removed the overly strict printable-character validation from the Custom SCEP configuration form. * The Challenge field now only enforces the required-value rule and no longer shows printable-character validation errors. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-22 13:46:47 -05:00
Dante Catalfamo	932e82e856	Gitops mode disables android MDM connect and turn off buttons (#49685 ) Related issue: Resolves #48226	2026-07-22 11:31:27 -04:00
LeAnn	8677e1cf53	Fix Add API-only user > Specific API endpoints table search (#49613 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #49707 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Improved API endpoint search with relevance-based ranking across endpoint names and paths. * Search results now prioritize exact, prefix, whole-word, and partial matches. * Added path-based matching and clearer empty-state behavior. * Removed pagination in favor of the existing results scrollbar. * Bug Fixes * Preserved relevance ordering instead of applying an incorrect default sort. * Excluded already-selected endpoints from search results. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-22 08:10:02 -07:00
Dante Catalfamo	6d0ecf1b9f	Clarify which OS supports OS Updates (#49716 ) Related issue: Resolves #48960	2026-07-22 10:48:28 -04:00
Magnus Jensen	ba0b1c3bea	Fix resend button not showing on keyboard navigation in OS settings modal (#49728 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves none After: https://github.com/user-attachments/assets/cc9b73be-a015-49dd-adc3-5b516c02ea4c Before: https://github.com/user-attachments/assets/e870bc22-5984-4076-bb21-35699eda45bf # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Improved keyboard accessibility in OS settings tables. * Resend and rotate actions now appear when their table row receives keyboard focus, in addition to mouse hover. * Documentation * Added a change note describing the accessibility improvement. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-22 16:12:29 +02:00
Dante Catalfamo	4d924e2f48	Show managed Android serial number on Hosts page (#49711 ) Related issue: Resolves #48379	2026-07-21 16:50:46 -04:00
Jordan MontgomeryandandymFleet	bd8f1e8afa	48343 edit config profile UI (#49333 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #48343 # Checklist for submitter If some of the following don't apply, delete the relevant line. No changes file as this is covered by the base feature branch - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added the ability to edit existing configuration profiles, including profile contents and targeting labels. * Added file validation for supported profile formats and clearer edit-specific error messages. * Added activity feed entries and filtering for edited configuration profiles. * Updated profile actions with an edit option and improved team-specific label handling. * Bug Fixes * Improved label data refreshing when switching between teams. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: andymFleet <andrewmellor@fleetdm.com>	2026-07-21 08:24:30 -04:00
Carlo	fb0e817bd0	Show .py script-only packages as available for install on macOS hosts (#49457 ) Related issue: Resolves #49455 Offer `.py` script-only packages on macOS hosts, matching `.sh`. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Python (`.py`) installer packages are now treated as compatible alongside shell (`.sh`) installers on macOS and Linux. * Python installers can now appear in software availability, self-service installation, and setup experience selections. * Windows behavior remains unchanged (Unix-script installers are excluded). * Bug Fixes * Improved cross-platform compatibility matching for Unix-like hosts when choosing the first eligible installer package. * Tests * Added and expanded unit/integration coverage for `.py` installer compatibility across platforms and flows. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-20 15:13:50 -04:00
Noah Talerman	ee2ceeab3d	Fix "AB issue" icon color (#49596 ) For the following bug: - https://github.com/fleetdm/fleet/issues/49597	2026-07-20 15:00:06 -04:00

1 2 3 4 5 ...