Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 8 Packages Projects Releases Wiki Activity
25,396 Commits 2 Branches 0 Tags
e4025a81935cdc230c75c42ca4edeb5ddc915d61
Commit Graph
4418 Commits
Author SHA1 Message Date
Victor Lyuboslavsky e4025a8193 Always display Windows ESP error when software install fails (#47522) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45948

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
* Updated Windows ESP failure copy with clearer “Reset your device to
try again…” wording.
* When not all apps are required, added a **“Reset PC and Continue
Anyway”** soft-block option and continuable error text that lists failed
app names with truncation (“N more”).
* **Bug Fixes**
* Improved SyncML generation by escaping XML-sensitive characters in
embedded text.
* **Tests**
* Added/expanded unit and property-based tests covering continuable
error formatting, soft-block behavior, and SyncML XML escaping.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-18 06:35:57 +01:00
Steven PalmesanoandJuan Fernandez 435c6e130b Display instructions needed for SSO-enabled accounts with fleetctl (#46768) 
**Related issue:** Resolves #21818

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* The CLI now detects when SSO is enabled on the server and shows a
warning directing users to authenticate with an API token (with guidance
link) instead of email/password.

* **Bug Fixes**
* Authentication error messaging is now SSO-aware, improving guidance
when credential login fails.

* **Tests**
* Added coverage to verify the authentication guidance changes correctly
based on whether SSO is enabled.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Juan Fernandez <juan@fleetdm.com>
 2026-06-17 18:19:00 -04:00
Magnus Jensen e14f6e67c1 fix gitops relative paths for unassigned and org_settings (#47512) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45661

I couldn't really find another good solution that would solve it all, as
the path resolution is spread out, plus unassigned merging into global
config definitely makes it more complex (root cause of the issue).

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed GitOps relative path resolution so controls and nested
organization settings correctly resolve referenced files from their
source directory, including cases with `unassigned.yml`.
* Corrected macOS setup assistant uploads to use the base filename
instead of the full configured path/URL.
* **Tests**
* Added regression coverage for GitOps relative path handling across
working-directory and nested-file scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-17 18:32:06 +02:00
Konstantin Sykulev ead9d40293 Added FLEET_VAR_HOST to android configs (#47642) 
**Related issue:** Resolves #45353

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

* **New Features**
* Added support for `$FLEET_VAR_HOST_*` variables in Android managed app
configurations, including host UUID, hardware serial, platform, and
end-user IdP details.

* **Improvements**
* Android app configurations are now validated to reject unsupported
Fleet variables.
* Fleet variables are substituted with real per-host values during
Android app configuration deployment, including batch/GitOps and
host-specific workflows.

* **Tests**
* Added unit and integration coverage for supported/unsupported
variables, substitution behavior, and JSON escaping.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-17 11:10:03 -05:00
Konstantin Sykulev 8e3f17804e Clear idp cookie after succesful SSO (#47569) 
**Related issue:** Resolves #47343

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for providing an identity provider (IdP) UUID in
enrollment-token requests via an `idp_uuid` query parameter, affecting
both fully-managed and non-fully-managed flows.
* Enrollment OTA now carries the IdP UUID into the enrollment flow and
token request, with server-rendered pages exposing the selected IdP when
applicable.

* **Bug Fixes**
* For fully-managed enrollments, the IdP/SSO cookie is cleared after
successful authentication to avoid stale IdP selection.

* **Tests**
* Extended coverage for `idp_uuid` precedence over the IdP cookie and
for cookie-clearing behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-17 11:09:21 -05:00
Carlo a189b5328d Fix self-service update button flashing (#47749) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44645

# Summary

On the My device > Self-service page, apps that just finished updating
briefly flashed the "Update" button again during the inventory refetch.
The "recently updated" flag was only set by the pending-poll, so other
refetch paths could surface a completed-but-stale app before it was
flagged. Now a `selfServiceData`-keyed effect flags completed user
actions on every data change, so the card holds "Updated" through the
refetch instead of reverting.

  # Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or
`ee/fleetd-chrome/changes`. See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

  ## Testing

  - [x] Added/updated automated tests
  - [x] QA'd all new/changed functionality manually



https://github.com/user-attachments/assets/c9a6ee13-c1f9-4ba0-a704-a578552a5dcd



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Resolved an issue on the **My device > Self-service** page where the
**“Update”** button could briefly reappear after app updates, even
though the card should remain in the **“Updated”** state until the
software inventory refresh completes.
* **Tests**
* Added coverage to ensure the **“Updated”** UI state persists while
inventory refetch is pending, and that the **“Update”** button does not
render during that window.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-17 12:07:14 -04:00
Magnus Jensen fe4d74edc2 Join MDM for missing status for non osquery devices (#47672) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46243 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed incorrect reporting of iOS, iPadOS, and Android hosts as missing
(including MIA and missing-over-30-days counts).
* Host status filtering and dashboard cards now correctly fall back to
Apple MDM activity when OSQuery “last seen” data is unavailable,
preventing recently active devices from being flagged.
* **Tests**
* Added coverage to verify iOS/iPadOS hosts aren’t treated as missing
when Apple MDM “last seen” is recent, and are flagged once it becomes
stale.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-17 16:20:54 +02:00
Steven Palmesano ef0aed3b3f Move tooltip for vulnerability support to "Not supported" (#47074) 
**Related issue:** Resolves #44109

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements**
* Updated the Vulnerabilities column on the Software > OS page: "Not
supported" cells now include a tooltip relocated to the unsupported
indicator that explains which platforms support vulnerability detection,
and a "Learn more" link to Fleet documentation. Copy clarified to make
platform support and next steps more visible to users.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-16 16:29:17 -05:00
Allen Houchins ec1d8fb30c Paginate Fleet-maintained apps and filters (#47615) 
Fix the Fleet-maintained apps list being cut off by adding server-side
pagination and applying platform / "hide added apps" filters across the
full library. Introduces MaintainedAppListOptions (with Platform and
AvailableOnly) and changes the ListAvailableFleetMaintainedApps /
ListFleetMaintainedApps signatures. Datastore now paginates and counts
by distinct app name, fetches all platform rows for apps on a page, and
returns a count and pagination metadata; default client page size set to
500. Frontend no longer performs client-side filtering or local
status/platform state; it relies on the API and uses data.count for
totals. Docs, tests, mocks, and various call sites updated (including a
new test that verifies pagination, platform and availability filters).

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fleet-maintained apps listing now paginates server-side (100 per page)
so entries near the end of the alphabet are reachable.
* Platform and “Hide added apps” filters are applied across the entire
library, not just the currently loaded subset.
* The displayed count now matches results by counting macOS and Windows
versions separately.

* **New Features**
* Listing now supports URL-driven platform and “available” filtering,
and the UI consistently reflects the active filter state.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-16 15:58:24 -05:00
Steven Palmesano cbae661149 Show actual number of selected hosts (#46334) 
**Related issue:** Resolves #40502

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.


## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed "select all matching hosts" to display the actual total count
instead of showing an estimate like "50+" in table headers and delete
confirmation dialogs.

* **Tests**
* Updated test cases to reflect accurate host count display behavior
when selecting all matching hosts.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46334?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-16 15:04:25 -05:00
George Karr 295e0f8501 Adding changes for Fleet v4.86.2 (#47219) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Resolved an issue where team-scoped host vitals labels (from IdP
attributes) failed to populate associated hosts correctly.

* **Chores**
* Updated Fleet/Helm chart versions and container image/CLI package tags
from v4.86.1 to v4.86.2 across the deployment chart, values,
infrastructure defaults, and tooling manifest, with no other
configuration changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-16 15:02:47 -05:00
Jonathan Katz a627f87113 Fix scrollbar showing up when not needed in report/policy results tables (#47627) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44272 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually
Pages  tested:
```
https://<fleet_url>/hosts/<host_id>/reports/<id>
https://<fleet_url>/reports/<id>?fleet_id=<fleet_id>
https://<fleet_url>/reports/<id>/live?fleet_id=<fleet_id>
https://<fleet_url>/policies/<id>/live?fleet_id=<fleet_id>
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed unnecessary horizontal scrollbars appearing in report and policy
results tables. Scrollbars now display only when content requires
horizontal scrolling.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-16 14:04:45 -04:00
Steven Palmesano ed195c860f Navigate back to the report details page after saving a report (#46754) 
**Related issue:** Resolves #38928

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.


## Testing

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* After saving report edits, the UI now redirects users back to the
report details page.
* URL context (host_id and fleet_id) is preserved during this
navigation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-16 10:29:26 -05:00
Steven Palmesano 1b0001fdd1 Positive language checkboxes (#47603) 
**Related issue:** Resolves ##39323

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.


## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Style**
* Updated checkbox labels and tooltips across settings to use positive
language (describing enabled outcomes like “Store data” and “Bypass for
non-critical policies”).
* Adjusted checkbox behavior to match the new checked-state semantics
for data retention, feature toggles, and conditional access bypass
(including revised default/tooltip copy).
* **Tests**
* Updated assertions to reflect the new checkbox/help text wording and
checked/unchecked expectations in advanced settings and discard-data
options.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-16 10:28:44 -05:00
Dante Catalfamo 295e2b3af0 Filter vulnerable software by cvss on my device page (#47372) 
**Related issue:** Resolves #35694
 2026-06-16 11:28:06 -04:00
Carlo 37493e7d51 Show .sh scripts in macOS setup experience (#47629) 
Resolves #43667
 2026-06-16 10:55:23 -04:00
Nico 12d2aba40c Fix macOS "Update new hosts to latest" staying enabled in GitOps after clearing version/deadline (#45984) (#47602) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45984 

Fix is applied on the GitOps side since that's what I figured the
customer was using on the [Slack
thread](https://fleetdm.slack.com/archives/C061ZA91Y1J/p1779372669701129).

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

#### Before

Reproduced on `main`:
- Set `update_new_hosts: true` beforehand.
- Ran `gitops` with `update_new_hosts` commented out. It was still kept
as `true`.



https://github.com/user-attachments/assets/f6b41f0d-38e6-468f-a605-b3e66b7b2dbc

#### After

Running `gitops` with `update_new_hosts` commented out switched its
value to `false`.



https://github.com/user-attachments/assets/24756063-b3a9-400b-a2cc-208dd816a556



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Corrected GitOps behavior for the macOS “Update new hosts to latest”
setting so it no longer stays enabled after clearing `minimum_version`
and `deadline`; it now defaults to disabled unless both are set.

* **Tests**
* Added GitOps test coverage to verify the defaulting outcomes across
YAML variations for the macOS update settings, including explicit and
empty field combinations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-16 10:21:20 -03:00
Magnus Jensen 76de4adfcb BYOF: Add support for unique token ADUE (#47407) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45598 

1. Apple disregards query params in the 403 WWW-Authenticate URL, so
setting it as the ?initiator= does not work, had to make a new route on
the frontend to match the same URL but with a dynamic token.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary

* **New Features**
* Added support for a configured default fleet/team for BYO Apple
enrollment.
* Enabled account-driven Apple MDM enrollment using per-enrollment
tokens.
* Added tokenized Apple MDM service discovery and enrollment endpoints.

* **Bug Fixes & Improvements**
  * Added automated daily cleanup of expired enrollment challenges.
* Improved BYOD/account-driven enrollment challenge handling, including
default team assignment and Managed Apple ID updates.
  * Reduced unnecessary BYOD MDM profile refetches during reenrollment.

* **Tests**
* Expanded coverage for token lookup, enrollment challenges, and updated
BYOD/account-driven flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-16 14:56:11 +02:00
Konstantin Sykulev ab64d0e657 Throttling android software installs (#47461) 
**Related issue:** Resolves #41910

# Checklist for submitter

If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Configurable Android app operation batch size
(FLEET_MDM_ANDROID_BATCH_SIZE, default 1000) to reduce Android
Management API load.
* Android software install and app-availability operations now run in
batched, staggered jobs across workers to improve reliability and avoid
API throttling on large fleets.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-15 19:54:23 -05:00
Victor Lyuboslavsky c57e54c529 Filter OTEL by environment (#47574) 2026-06-15 20:44:05 +01:00
Jonathan Katz 75a822fb91 Show Fleet Premium message when viewing install details modal on Fleet Free (#47551) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44617
Screenshot:
<img width="1318" height="528" alt="image"
src="https://github.com/user-attachments/assets/4ec4bd85-8efb-4729-86ad-ea3059439b60"
/>

Note that the uninstall details modal is viewable without any errors on
Fleet Free, so maybe we should address that at some point.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* When accessing software install details without a Fleet Premium
license, the activity modal now displays a Fleet Premium upsell message
with a "Learn more" link instead of a generic error, providing clearer
guidance to upgrade.

* **Tests**
* Added test coverage for the Fleet Premium license requirement scenario
in the install details modal.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-15 12:33:16 -04:00
Victor Lyuboslavsky 4fdd4bd3b4 Fixing Windows SCEP issues (#47255) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #47492 and Resolves #46982

- Fixed panic when uploading bad profile
- Added validation for SCEP challenge to exclude underscore (and other
non-printable characters).

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Prevented a server panic during Windows configuration profile
validation when SCEP and non-SCEP elements are mixed; such profiles are
now rejected with a clear validation error.

* **New Features**
* Enforced Windows-compatible printable characters for Custom SCEP proxy
challenge values; rejects disallowed characters while preserving legacy
values unless changed.

* **UI / Validation**
* Improved form validation feedback for the Custom SCEP challenge field,
showing errors and disabling submit for invalid input while allowing
masked/unchanged values.

* **Tests**
* Added regression and unit tests covering profile validation and
challenge character validation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-15 08:52:25 +01:00
Victor Lyuboslavsky 207d41e995 Windows MDM reconciler cleanup and remaining fixes (#47493) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45635 

- Refactored setup experience flow to use host-specific reconciler
methods
- Removed now unneeded reconciler methods

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
  
## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Windows configuration profiles are now queued immediately when a host
enrolls in Windows MDM, so profile delivery happens during the same
check-in instead of waiting for the next reconciliation cycle.
* Windows MDM enrollment finalization now runs per-host reconciliation
and will block release until that reconciliation completes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-12 22:30:58 +01:00
Konstantin Sykulev 2ad76714ce Throttle requests to AMAPI during profile reconcilation (#47223) 
**Related issue:** Resolves #41910

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a configurable env var to limit Android MDM profile
reconciliation batch size (FLEET_MDM_ANDROID_PROFILES_BATCH_SIZE;
default 1000).
* Reconciliation now processes hosts in cursor-based, batched windows
and persists a reconciliation cursor to resume/advance work, reducing
peak API load and enabling pagination.
* **Tests**
* Added validation tests for the batch-size config and tests verifying
cursor-based pagination and processing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-12 13:13:29 -05:00
Lucas Manuel Rodriguez ac6aa7329c Improve SAMLResponse validation in SSO callbacks (#47463) 
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Security Enhancements**
* Enforced strict size limits for SAMLResponse payloads and rejected
overly large submissions.
* Added protections against deeply nested or excessively large SAML XML
documents.
* Applied rate limiting to SSO/authentication callback endpoints
(configurable via Auth settings).
* **Tests**
* Added tests verifying SAMLResponse size and XML shape validation
behavior.
* **Documentation**
* Noted these SSO validation and rate-limiting changes in the changelog.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-12 10:53:19 -03:00
Victor Lyuboslavsky 2c8b21a782 Defer Windows MDM profile removals via pending-delete retention (#47156) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46993 

Requires #47071 to merge first

Loadtest shows reduction of batch delete of 40 profiles for 30K hosts
down to ~3.9 seconds.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

* **Bug Fixes**
* Resolved timeout issues when removing large numbers of Windows
configuration profiles from teams with many hosts.

* **New Features**
* Windows profile deletions now process asynchronously in the
background, enabling faster API responses and consistent behavior with
profile delivery operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-11 22:27:15 +01:00
Carlo 6735479a5d Make ctxerr treat 4xx errors as client errors (#47415) 
**Related issue:** Resolves #45855
 2026-06-11 15:42:35 -04:00
Lucas Manuel Rodriguez cf6a8a29c0 Fix command line flags in agent settings UI (#47414) 
Resolves #47412.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Agent settings editor now renders empty or null command-line flags
visibly (instead of hiding them), preserving their clearing behavior for
host-level settings.

* **Tests**
* Added tests to validate YAML output and formatting for command-line
flags, missing keys, and related edge cases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-11 11:13:08 -03:00
Nico b4c32d279e Policies: Include/Exclude label targeting in Save policy modal (#33441) (#47213) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46583 

Figma:
https://www.figma.com/design/0F1sw63SuYaKVWlcL7mnc6/-33441-Policies--Custom-targets-with-%22Include-any%22-and-%22Exclude-any%22?node-id=5303-5687&t=Fszpf83KhcZ7ViWh-0

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

Note: policy creation will fail if more than one inclusion/exclusion
option is provided. This will be addressed as part of
https://github.com/fleetdm/fleet/issues/46582 (we'll relax that check to
make sure we can accept a combination).



https://github.com/user-attachments/assets/9cfbcbca-54ce-4978-8248-7d550f18785b



https://github.com/user-attachments/assets/16138fb1-da7c-4838-8819-f370bf7072c1

Empty state:

<img width="850" height="628" alt="Screenshot 2026-06-10 at 11 30 45 AM"
src="https://github.com/user-attachments/assets/141c4d26-e464-4ae1-b6ed-94d24a640e1c"
/>



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Add optional "exclude all" label targeting for policies
(labels_exclude_all) and tab-based Include/Exclude targeting UI.

* **Improvements**
* In-modal navigation to add new labels; Custom targeting requires at
least one selected label to enable Save.
* Payloads now include include/exclude label fields when using Custom
targeting.

* **Tests**
  * Updated modal tests to cover exclude-tab label selection.

* **Style**
  * Improved empty-state border styling in label selector.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-11 10:00:30 -03:00
Victor Lyuboslavsky b4dcea8a82 Improved Windows MDM reconciler (#47071) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45635 

Moved profile reconciler work from SQL to code, similar to what Apple
MDM team did last sprint.

The Windows MDM loadtest for 40 profiles with 30K hosts looks much
better.

```
  ┌──────────────────────────┬─────────────────────────────────────────┬───────────────────────────────────────────┐
  │                          │            Pre-fix baseline             │                This branch                │
  ├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤
  │ Transfer wall time       │ ~40–42 min                              │ ~15.5 min                                 │
  ├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤
  │ Per work tick            │ 215–257s (host-finding query dominated) │ ~48s (host-finding gone; now bulk writes) │
  ├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤
  │ Ticks > 30s (work ticks) │ ~all                                    │ ~all (16/17, ~48s)                        │
  ├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤
  │ Pacing governor          │ the host-finding query                  │ the 2000-host delivery cap + 30s interval │
  └──────────────────────────┴─────────────────────────────────────────┴───────────────────────────────────────────┘
```

The writer spikes briefly to 16 AAS, but has CPU headroom, so I'd say we
can claim to support 40 profies on 30K hosts.

```
  ┌───────────────┬───────────────┬───────────────────────────┬───────────────────────────────────────┐
  │   Instance    │ CPU avg / max │ DBLoad avg / max (4 vCPU) │     Read / Write / Commit latency     │
  ├───────────────┼───────────────┼───────────────────────────┼───────────────────────────────────────┤
  │ writer -two   │ 67.9% / 74.9% │ 4.84 / 16.0               │ 0.28ms / 2.07ms / 10.6ms (max 12.2ms) │
  ├───────────────┼───────────────┼───────────────────────────┼───────────────────────────────────────┤
  │ reader -one   │ 46.1% / 52.7% │ 1.19 / 5.0                │ 1.59ms / — / —                        │
  ├───────────────┼───────────────┼───────────────────────────┼───────────────────────────────────────┤
  │ reader -three │ 65.4% / 70.1% │ 1.77 / 5.0                │ 1.72ms / — / —                        │
  └───────────────┴───────────────┴───────────────────────────┴───────────────────────────────────────┘

```

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Reworked Windows MDM reconciliation to a snapshot-based, batched
drain-loop, improving responsiveness and reducing database load during
large profile operations.

* **Performance / Reliability**
* Windows MDM profile changes now reach hosts faster; large team-wide
profile additions/removals (including host transfers) complete more
quickly with lower DB impact.

* **Chore / Configuration**
  * Added tunables to control per-tick delivery caps and scan budgets.

* **Tests**
* Expanded end-to-end and property tests for install/remove, team/label
gating, and multi-window drain behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-11 07:03:28 +01:00
Victor Lyuboslavsky 251093f6b3 Setup experience software policy checks (#47075) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45309 

If software is linked to policies, we run the policy during setup
experience to determine if software should be installed. We install on
failing policies.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Windows/Linux setup experience installers can be gated by team
policies: setup will run a policy check and skip installing if the
policy already passes; if the policy fails, the installer runs as part
of setup.
* After gated setup completes, the host’s policy set is re-evaluated
promptly so subsequent policy actions run immediately.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-10 21:16:37 +01:00
Jordan Montgomery afbbc447bb Improve apple MDM parsing (#47344) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Enforced request body size limit for Apple MDM operations (≈16 MiB
cap).

* **Improvements**
* Safer Apple MDM plist parsing with bounds and complexity checks to
reject malformed/oversized payloads.
* Decoder updated to more strictly accept XML check-in/command payloads.

* **Tests**
* Added unit tests covering bounded plist decoding and XML-only decoding
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-10 15:35:04 -04:00
Scott GressandLucas Manuel Rodriguez ffbbb9e866 Validate SSO settings correctly for GitOps (#46487) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43371 

# Details

* Ensures that if `enable_sso: true` is set in a global config, then all
required sso keys (`entity_id`, `idp_name` and one of
`metadata`/`metadata_url`) are provided
* Ensures that if `end_user_authentication: true` is set on a fleet,
then all required sso keys (`entity_id`, `idp_name` and one of
`metadata`/`metadata_url`) are provided, _even if the fleet's config
file is not provided in the gitops run_.
* Ensures that if `end_user_authentication: true` is set in a fleet
config in a gitops run, then all required sso keys (`entity_id`,
`idp_name` and one of `metadata`/`metadata_url`) are provided, _even if
the global config file is not provided in the gitops run_.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
  ### Org SSO — gitops client validation (`fleetctl gitops`)
- [x] `enable_sso: true` with **empty `metadata` and `metadata_url`** →
fails (metadata-or-url)
  - [x] `enable_sso: true` with **empty `idp_name`** → fails (idp_name)
- [x] `enable_sso: true` with **empty `entity_id`** → fails (entity_id)
- [x] Multiple fields missing at once → **one error line per missing
field**
  - [x] `enable_sso: true` + complete IdP (`metadata_url`) → succeeds
- [x] `enable_sso: true` + complete IdP using inline `metadata` (no url)
→ succeeds
  - [x] `enable_sso: false` + empty IdP fields → succeeds
- [x] `sso_settings` key **omitted entirely** → succeeds, and apply
**clears** stored SSO
- [x] The literal `generate-gitops` output (`metadata: # TODO: ...`)
applied as-is → **rejected**

  ### MDM EUA — gitops group cross-file validation
- [x] Team file enables EUA **+** global file **omits** the EUA IdP
block → fails
- [x] **#43371 core repro:** stored team EUA on, file NOT in run,
global-only run blanks metadata → fails, names the team
- [x] Same but the team's file **is** in the run with EUA `false` →
succeeds
  - [x] EUA disabled everywhere + **empty** stored IdP → succeeds

  ### `--delete-other-fleets`
- [x] Run with `--delete-other-fleets` degrading the IdP while a stored
not-in-run team has EUA on → succeeds
  - [x] Confirm the omitted team is actually deleted on apply
- [x] Known corner: `--delete-other-fleets` + omitted ABM/VPP team with
EUA on + degraded IdP → fails at apply time

  ### Server-side backstop (REST API)
- [x] `PATCH /config` (overwrite=false), `enable_sso:true`, metadata
omitted, existing has metadata → **200**, metadata preserved
- [x] `PATCH /config?overwrite=true`, `enable_sso:true` + empty
metadata/url → **422** field `metadata`
- [x] `?overwrite=true`, metadata_url set, empty `entity_id`/`idp_name`
→ **422** both `required`
- [x] `?overwrite=true`, `enable_sso:false` → **200** (no IdP required
when disabled); `sso_settings` omitted entirely → clears (covered by
gitops POS-2)

  ### Server-side EUA (`euaStrict` keyed on incoming global flag only)
- [x] `?overwrite=true` + incoming **global** EUA enabled + incomplete
IdP → **422** `entity_id`/`idp_name`
- [x] `?overwrite=true` + global EUA **off** + stored team EUA + payload
degrades IdP → **succeeds** (via gitops #43371-OVERRIDE)
- [x] `?overwrite=true` + global EUA off + payload **fully clears** IdP
while a team has EUA → **422** `end_user_authentication` (IsEmpty guard)

  ### Regression / false-positive guards
- [x] Multi-file gitops `--dry-run` configuring IdP AND enabling team
EUA (empty stored IdP) → dry-run passes (EE dry-run skip)
- [x] A previously-working gitops run with a complete SSO/EUA config →
still applies cleanly

  ### End state verification
  - [x] After any **rejected** run, stored SSO/EUA config **unchanged**
- [ ] After a valid complete-IdP run, SSO login + ADE/EUA enrollment
works end-to-end (live device)



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* GitOps now validates SSO and MDM end-user authentication (EUA) configs
before applying changes, rejecting incomplete settings when SSO/EUA are
enabled globally or for any team. Overwrite (GitOps) mode enforces
stricter validation than standard updates; dry-run behavior adjusted to
avoid spurious EUA rejections.

* **Tests**
* Added comprehensive tests covering SSO/EUA validation, overwrite vs
patch semantics, cross-file EUA scenarios, and delete-other-fleets
behavior.

* **Refactor**
* Reorganized validation and config-parsing helpers for reuse in GitOps
checks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
 2026-06-09 11:38:48 -05:00
Lucas Manuel RodriguezVictor LyuboslavskyCopilot Autofix powered by AI
 		6d67565b14 Update Go to 1.26.4 (#47158) 
Resolves #47159.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated the Go toolchain to 1.26.4 across modules, Docker build
stages, and build/configuration records to standardize the toolchain
version used for builds and tooling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-06-09 12:55:10 -03:00
Allen HouchinsandNoah Talerman 3906398928 Schedule calendar remediation events next business day after policy failure (#42435) 
This pull request updates the logic for scheduling calendar events to
always select the next business day (skipping weekends) instead of
scheduling on the next Tuesday. The test suite for this functionality
has also been rewritten to reflect the new behavior and to improve
clarity.

**Business logic update:**

* Changed `getPreferredCalendarEventDate` in `calendar_cron.go` to
return the next business day after the provided date, skipping weekends,
instead of always selecting the next Tuesday.

**Test updates:**

* Refactored the test cases in `calendar_cron_test.go` to use specific
`today` dates and expected results, ensuring coverage for weekday
transitions, weekend skipping, and month/year rollovers. The tests now
directly check the next business day logic rather than iterating over
ranges of days.

**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Calendar events now schedule on the next business day (skipping
weekends) after a policy failure instead of a fixed weekly day.

* **Tests**
* Updated unit tests to validate the new next-business-day behavior with
explicit expected dates.

* **Documentation**
* Updated scheduling description to reflect next-business-day
remediation timing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
 2026-06-09 09:15:47 -05:00
Jonathan Katz b7adf2751d Add detailed error for generate-gitops when a patch policy installer is missing an FMA (#47136) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43770
Just updates the error message to make it say what's wrong and what can
be done about it. We still abort the entire export because it would be
wrong to create a patch policy not associated to an FMA.


# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually


New error message:
```
$ fleetctl generate-gitops --dir ./my-gitops --fleet Example-Fleet
Generating GitOps configuration files...
Error generating policies for fleet Example-Fleet: The patch policy "macOS - Zen Browser up to date" references a software installer that is no longer a Fleet-maintained app. Please delete the policy manually.
Error: Something's gone wrong. Please try again. If this keeps happening please file an issue:
https://github.com/fleetdm/fleet/issues/new/choose
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Enhanced error handling in the `generate-gitops` command to provide
clearer messaging when a patch policy references a Fleet-maintained
application that has been removed from the catalog. The command will now
abort with explicit guidance, instructing users to manually remove the
orphaned policy.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 17:49:02 -04:00
Dante Catalfamo 7ad95ac2c3 Fixed the host's Software UI showing a date decades in the past (#46779) 
**Related issue:** Resolves #43622
 2026-06-08 17:24:05 -04:00
Lucas Manuel Rodriguez 95fedf043b Fix live query selector X button (#47089) 
Resolves #46299.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Bug Fixes
* Fixed a UI issue on the live report target selection screen where
users were unable to remove selected hosts from their target list. The
delete button ("X") next to each selected host now functions correctly,
allowing users to easily deselect individual hosts and make adjustments
to their overall target selections.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 18:05:14 -03:00
Dante Catalfamo ad30812054 Speed up /vulnerabilities and filtered /software/versions queries (#45564) 
Address 100% DB CPU spikes observed when paginating these endpoints with
filters. Two root causes: cve_meta and vulnerability_host_counts lack
indexes for the actual filter shapes, and ListVulnerabilities ran
correlated scalar subqueries on every row of vulnerability_host_counts
that matched the scope (1.1M rows examined per call).

Add three online indexes:
- cve_meta(cisa_known_exploit, cve) for the exploit filter
- cve_meta(cvss_score, cve) for the CVSS range filter
- vulnerability_host_counts(global_stats, team_id, host_count, cve) for
the scope filter on the vulnerabilities endpoint

Refactor ListVulnerabilities into a two-stage query: an inner query
filters, sorts, and paginates vulnerability_host_counts (with an
optional LEFT JOIN to cve_meta for sort/filter columns), and an outer
query enriches only the paginated page with the created_at and source
scalar subqueries. Net effect: the heavy subqueries run perPage times
(~20-100) instead of millions. Sort-by-created_at falls back to the
single-statement form since the sort key is itself the subquery result.

CountVulnerabilities drops the redundant DISTINCT (vhc.cve is already
unique within a (global_stats, team_id) scope via the existing UNIQUE
KEY) and only joins cve_meta when KnownExploit filtering is requested.

**Related issue:** Resolves #45415
 2026-06-08 17:02:47 -04:00
Nico 3f5944626c Fix Fleet startup crash on read-only filesystem without S3 bucket (#47099) 
**Related issue:** Resolves #47090

Fleet crashes into `CrashLoopBackOff` on startup when deployed on
Kubernetes with `readOnlyRootFilesystem: true` and **no** S3 software
installers bucket configured:

```
Failed to start: initializing filesystem org logo store: mkdir /tmp/org-logos: read-only file system
```

I realised I was calling `initFatal` when failing to create a directory
on the filesystem which doesn't match the pattern of `logging` +
`creating a "failing" store` (one that is initialized but fails all
operations) as we do for e.g. software title icons (see
NewFailingSoftwareTitleIconStore).

Per this slack conversation:
https://fleetdm.slack.com/archives/C084F4MKYSJ/p1780931127976389, we
decided to fall back to a database-backed storage:

<img width="737" height="114" alt="Screenshot 2026-06-08 at 3 16 28 PM"
src="https://github.com/user-attachments/assets/2a6ff75f-b382-40ba-81d9-3be3cfbd648a"
/>


# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

Commented out this line to force filesystem usage:

<img width="615" height="71" alt="Screenshot 2026-06-08 at 1 18 53 PM"
src="https://github.com/user-attachments/assets/85043c88-5c8c-48a0-8145-098fba9513bd"
/>


#### Before

Server crashes

<img width="1278" height="124" alt="Screenshot 2026-06-08 at 1 18 17 PM"
src="https://github.com/user-attachments/assets/7b788a24-131a-47a3-8580-fcd9fda8b449"
/>


#### After

Server starts and logo upload works

- Without --dev_license



https://github.com/user-attachments/assets/58c5ebf9-cf52-4ba0-ac98-9675e7eef92c



- With --dev_license




https://github.com/user-attachments/assets/117bb812-31bd-4849-927c-93cafd1a71d7








<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

* **New Features**
- Organization logos now support database storage as the fallback option
when S3 software installers bucket is not configured, replacing local
filesystem storage for improved reliability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 17:15:14 -03:00
Steven Palmesano 20c0963331 Fix GitOps when using All fleets in VPP settings (#46855) 
**Related issue:** Resolves #46824

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed an issue where volume purchasing program assignments failed when
"All fleets" was selected; validation and token assignment now treat the
"All fleets" label consistently, preventing errors during configuration
application.
* **Tests**
* Added an end-to-end GitOps test case verifying "All fleets" is
supported for volume purchasing program entries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 13:27:57 -05:00
Konstantin Sykulev 2570e25f0e Defer writing team_id on android check-ins (#46929) 
**Related issue:** Resolves #44113

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Bug Fixes**
* Fixed an issue where Android device check-ins could revert admin team
transfers, ensuring team assignments persist correctly after
re-enrollment.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 11:55:26 -05:00
Jonathan Katz e34126ab3a Merge branch 'main' of github.com:fleetdm/fleet into feat/39018-self-service-categories 
Bump migration, fix failing test and nilaway check
 2026-06-08 12:12:33 -04:00
Lucas Manuel Rodriguez 6313e75934 Fix live policy page to use full width (#47094) 
**Related issue:** Resolves #47092.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

`main`:
<img width="2550" height="1286" alt="Screenshot 2026-06-08 at 12 27
01 PM"
src="https://github.com/user-attachments/assets/b866201d-aff7-44db-913f-1987322405d5"
/>
<img width="2550" height="1286" alt="Screenshot 2026-06-08 at 12 27
11 PM"
src="https://github.com/user-attachments/assets/da56683e-b0e3-4d6d-b38e-3d94d761c5a0"
/>

With changes in this PR:
<img width="2550" height="1162" alt="Screenshot 2026-06-08 at 12 25
30 PM"
src="https://github.com/user-attachments/assets/73694cb3-e8ae-42c4-9834-372feadb6e81"
/>
<img width="2550" height="1286" alt="Screenshot 2026-06-08 at 12 25
54 PM"
src="https://github.com/user-attachments/assets/71db9c15-cb32-4650-be77-28559b4ac70c"
/>

## Testing

- [X] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Bug Fixes
* The live policy page now correctly uses the full page width,
consistent with the live query page display.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 12:53:04 -03:00
Allen Houchins 61064687e4 Add Python 3.13 & 3.14 as Windows FMAs and normalize versions (#46873) 
This pull request improves the handling of version comparisons for
Windows application patch policies in the `winget` ingester,
specifically to support installers (like python.org) where the
registry's `DisplayVersion` does not match the package's marketing
version. It introduces a new option to compare against the
`DisplayVersion`, adds robust test coverage for this logic, and onboards
Python 3.13 and 3.14 as maintained apps with correct install/uninstall
scripts.

**Patch policy improvements:**

* Added a `UseDisplayVersionForPatch` field to `inputApp` and supporting
logic in the ingester to optionally compare patch policy versions
against the registry `DisplayVersion` instead of the package version,
with error handling if no display version is found.
[[1]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R414-R434)
[[2]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R566-R571)
* Introduced the helper function `firstDisplayVersion` and extended the
`appsAndFeaturesEntries` struct to include `DisplayVersion`.
[[1]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R448-R458)
[[2]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R612)

**Test coverage:**

* Expanded test cases in `ingester_test.go` to cover the new
`UseDisplayVersionForPatch` logic, including both positive and negative
scenarios.
[[1]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055R347)
[[2]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055R374-R424)
[[3]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055L410-R470)
* Updated test server config and fixtures to support `DisplayVersion`
for accurate test simulation.
[[1]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055R482)
[[2]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055L447-R503)

**New maintained apps:**

* Added onboarding for Python 3.13 and Python 3.14 as maintained apps,
each with a `use_display_version_for_patch` flag, install/uninstall
scripts, and appropriate configuration.
[[1]](diffhunk://#diff-8a640dba0d8cc9ee50cef0397c5efce6655957dde836df94e6d5fb536f422fecR1-R15)
[[2]](diffhunk://#diff-e25e77b6c53c5fcc80a6d7589547873b5007dbcca660decbff3c9579c057b0fbR1-R15)
[[3]](diffhunk://#diff-fca224dfb5a7262b0b4ad68061b06552dc5291aeb8e2409fd5c9c6f8d8022dacR1-R32)
[[4]](diffhunk://#diff-b2bd0383162063c7923532a2be6b7014310a79fe3b0c681d1647bcd0fa6e3fe8R1-R147)

These changes ensure that patch policies correctly flag outdated
installs for apps where the registry version format differs from the
package version, and Python installs are now robustly managed via Fleet.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #37326

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for Python 3.13 and Python 3.14 on Windows Fleet,
including install/uninstall workflows and manifests
  * Option to use installer-displayed version for patch comparisons

* **Improvements**
* Normalized Windows-reported Python version strings for consistent
inventory and vulnerability matching
  * Added icons for Python 3.13 and 3.14 in the software catalog
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 10:51:32 -05:00
RachelElysia 175b2419a4 Fleet UI: Route software title names through getDisplayedSoftwareName (#47084) 2026-06-08 11:14:39 -04:00
Nico bab14d7eb5 Fix auth token not persisting over HTTP (non-TLS) deployments (#47076) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41641 & Resolves #44276

When Fleet is served over plain HTTP from a non-localhost host (e.g. a
Docker deployment accessed by IP), login fails with an "Authentication
Required" error.

To reproduce this, I ran the server as follows:

```
./build/fleet serve --dev --dev_license --server_tls=false --server_address=0.0.0.0:8080
```

And then, go to the Fleet UI using my private IP:

```
http://<my-lan-ip>:8080
```



https://github.com/user-attachments/assets/09543b9b-b9ee-4d1c-b47e-ebd49c20c699



The auth token is stored client-side in a `__Host-token` cookie with the
`Secure` attribute, and browsers silently drop `__Host-`/`Secure`
cookies on insecure, non-localhost origins. So, the token was never
persisted and the follow-up `GET /config` (and every subsequent request)
went out without it.

This change keeps the `__Host-token` + `Secure` cookie on HTTPS, and
falls back to a plain `token` cookie over HTTP so the token persists.
TL;DR: this restores the pre
[#40504](https://github.com/fleetdm/fleet/pull/40504) behavior for
non-TLS deployments and leaves HTTPS behavior unchanged.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] QA'd all new/changed functionality manually



https://github.com/user-attachments/assets/e7e838f3-f423-4e28-aebd-5f921af08b00




<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed an issue where login requests would fail with an "Authentication
Required" error when Fleet is served over HTTP.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 11:45:51 -03:00
Lucas Manuel Rodriguez 863363561b Fix fleet-scoped host vitals labels (#46953) 
**Related issue:** Resolves #46869

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Host vitals labels based on identity-provider group membership now
correctly apply to both global and team-scoped hosts, preventing
cross-team leakage.

* **Tests**
* Added and updated tests to validate IdP-group-backed vitals label
membership across global and per-team hosts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 10:46:56 -03:00
Victor Lyuboslavsky 89965f4f9a Extract platform-neutral MDM reconcile label primitives (#47032) 
Pure refactor, no behavior change. First step for #45635 (Windows
batched in-memory reconciler).

- New server/mdm/reconcile package holds the include/exclude label
handlers and the team+label applicability dispatcher. The Apple platform
gate stays in the Apple wrapper since platform eligibility is
platform-specific.
- New platform-neutral fleet types (MDMProfileLabelRef,
MDMProfileIncludeMode, MDMLabeledEntity); the Apple names are now type
aliases so existing code and tests are unchanged.
- BulkGetHostLabelMemberships moves from apple_mdm_batched.go to a
neutral file; it was already platform-agnostic.
- The existing Apple label-scenario tests keep covering the shared logic
through the delegating wrappers; the shared package also gets its own
handler/dispatcher tests.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45635 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Moved MDM profile include/exclude label logic into a shared,
platform-neutral reconciliation flow for consistent behavior across
platforms.
* Consolidated Apple MDM label handling to reuse the shared
reconciliation primitives and improved host label membership lookup
behavior.

* **Tests**
* Added and reorganized unit tests covering MDM label-based profile
reconciliation, include/exclude rules, and Apple-specific wrapper
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-08 12:28:27 +01:00
CarloandJonathan Katz fb9e4c4701 Auth in-house iOS app downloads with install tokens (#46819) 
# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

  ## Testing

  - [x] Added/updated automated tests
  - [x] QA'd all new/changed functionality manually

  ## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

* **New Features**
* In-house iOS app manifest and package downloads now use secure
per-install tokens embedded in the URL path instead of query parameters
* Installation tokens are bound to specific devices and teams, enhancing
security
  * Installation tokens automatically expire after 6 hours
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Jonathan Katz <yehonatankatz@gmail.com>
 2026-06-05 16:34:20 -04:00