ec1d8fb30c690afdaebb4a389cdbc424d05f3547
4410
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Allen Houchins
|
ec1d8fb30c |
Paginate Fleet-maintained apps and filters (#47615)
Fix the Fleet-maintained apps list being cut off by adding server-side pagination and applying platform / "hide added apps" filters across the full library. Introduces MaintainedAppListOptions (with Platform and AvailableOnly) and changes the ListAvailableFleetMaintainedApps / ListFleetMaintainedApps signatures. Datastore now paginates and counts by distinct app name, fetches all platform rows for apps on a page, and returns a count and pagination metadata; default client page size set to 500. Frontend no longer performs client-side filtering or local status/platform state; it relies on the API and uses data.count for totals. Docs, tests, mocks, and various call sites updated (including a new test that verifies pagination, platform and availability filters). <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fleet-maintained apps listing now paginates server-side (100 per page) so entries near the end of the alphabet are reachable. * Platform and “Hide added apps” filters are applied across the entire library, not just the currently loaded subset. * The displayed count now matches results by counting macOS and Windows versions separately. * **New Features** * Listing now supports URL-driven platform and “available” filtering, and the UI consistently reflects the active filter state. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
cbae661149 |
Show actual number of selected hosts (#46334)
**Related issue:** Resolves #40502 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed "select all matching hosts" to display the actual total count instead of showing an estimate like "50+" in table headers and delete confirmation dialogs. * **Tests** * Updated test cases to reflect accurate host count display behavior when selecting all matching hosts. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46334?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George Karr
|
295e0f8501 |
Adding changes for Fleet v4.86.2 (#47219)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Resolved an issue where team-scoped host vitals labels (from IdP attributes) failed to populate associated hosts correctly. * **Chores** * Updated Fleet/Helm chart versions and container image/CLI package tags from v4.86.1 to v4.86.2 across the deployment chart, values, infrastructure defaults, and tooling manifest, with no other configuration changes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
a627f87113 |
Fix scrollbar showing up when not needed in report/policy results tables (#47627)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44272 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually Pages tested: ``` https://<fleet_url>/hosts/<host_id>/reports/<id> https://<fleet_url>/reports/<id>?fleet_id=<fleet_id> https://<fleet_url>/reports/<id>/live?fleet_id=<fleet_id> https://<fleet_url>/policies/<id>/live?fleet_id=<fleet_id> ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed unnecessary horizontal scrollbars appearing in report and policy results tables. Scrollbars now display only when content requires horizontal scrolling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
ed195c860f |
Navigate back to the report details page after saving a report (#46754)
**Related issue:** Resolves #38928 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * After saving report edits, the UI now redirects users back to the report details page. * URL context (host_id and fleet_id) is preserved during this navigation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
1b0001fdd1 |
Positive language checkboxes (#47603)
**Related issue:** Resolves ##39323 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated checkbox labels and tooltips across settings to use positive language (describing enabled outcomes like “Store data” and “Bypass for non-critical policies”). * Adjusted checkbox behavior to match the new checked-state semantics for data retention, feature toggles, and conditional access bypass (including revised default/tooltip copy). * **Tests** * Updated assertions to reflect the new checkbox/help text wording and checked/unchecked expectations in advanced settings and discard-data options. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dante Catalfamo
|
295e2b3af0 |
Filter vulnerable software by cvss on my device page (#47372)
**Related issue:** Resolves #35694 |
||
|
Carlo
|
37493e7d51 |
Show .sh scripts in macOS setup experience (#47629)
Resolves #43667 |
||
|
Nico
|
12d2aba40c |
Fix macOS "Update new hosts to latest" staying enabled in GitOps after clearing version/deadline (#45984) (#47602)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45984 Fix is applied on the GitOps side since that's what I figured the customer was using on the [Slack thread](https://fleetdm.slack.com/archives/C061ZA91Y1J/p1779372669701129). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually #### Before Reproduced on `main`: - Set `update_new_hosts: true` beforehand. - Ran `gitops` with `update_new_hosts` commented out. It was still kept as `true`. https://github.com/user-attachments/assets/f6b41f0d-38e6-468f-a605-b3e66b7b2dbc #### After Running `gitops` with `update_new_hosts` commented out switched its value to `false`. https://github.com/user-attachments/assets/24756063-b3a9-400b-a2cc-208dd816a556 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected GitOps behavior for the macOS “Update new hosts to latest” setting so it no longer stays enabled after clearing `minimum_version` and `deadline`; it now defaults to disabled unless both are set. * **Tests** * Added GitOps test coverage to verify the defaulting outcomes across YAML variations for the macOS update settings, including explicit and empty field combinations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
76de4adfcb |
BYOF: Add support for unique token ADUE (#47407)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45598 1. Apple disregards query params in the 403 WWW-Authenticate URL, so setting it as the ?initiator= does not work, had to make a new route on the frontend to match the same URL but with a dynamic token. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary * **New Features** * Added support for a configured default fleet/team for BYO Apple enrollment. * Enabled account-driven Apple MDM enrollment using per-enrollment tokens. * Added tokenized Apple MDM service discovery and enrollment endpoints. * **Bug Fixes & Improvements** * Added automated daily cleanup of expired enrollment challenges. * Improved BYOD/account-driven enrollment challenge handling, including default team assignment and Managed Apple ID updates. * Reduced unnecessary BYOD MDM profile refetches during reenrollment. * **Tests** * Expanded coverage for token lookup, enrollment challenges, and updated BYOD/account-driven flows. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin Sykulev
|
ab64d0e657 |
Throttling android software installs (#47461)
**Related issue:** Resolves #41910 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Configurable Android app operation batch size (FLEET_MDM_ANDROID_BATCH_SIZE, default 1000) to reduce Android Management API load. * Android software install and app-availability operations now run in batched, staggered jobs across workers to improve reliability and avoid API throttling on large fleets. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
c57e54c529 | Filter OTEL by environment (#47574) | ||
|
Jonathan Katz
|
75a822fb91 |
Show Fleet Premium message when viewing install details modal on Fleet Free (#47551)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44617 Screenshot: <img width="1318" height="528" alt="image" src="https://github.com/user-attachments/assets/4ec4bd85-8efb-4729-86ad-ea3059439b60" /> Note that the uninstall details modal is viewable without any errors on Fleet Free, so maybe we should address that at some point. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * When accessing software install details without a Fleet Premium license, the activity modal now displays a Fleet Premium upsell message with a "Learn more" link instead of a generic error, providing clearer guidance to upgrade. * **Tests** * Added test coverage for the Fleet Premium license requirement scenario in the install details modal. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
4fdd4bd3b4 |
Fixing Windows SCEP issues (#47255)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #47492 and Resolves #46982 - Fixed panic when uploading bad profile - Added validation for SCEP challenge to exclude underscore (and other non-printable characters). # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Prevented a server panic during Windows configuration profile validation when SCEP and non-SCEP elements are mixed; such profiles are now rejected with a clear validation error. * **New Features** * Enforced Windows-compatible printable characters for Custom SCEP proxy challenge values; rejects disallowed characters while preserving legacy values unless changed. * **UI / Validation** * Improved form validation feedback for the Custom SCEP challenge field, showing errors and disabling submit for invalid input while allowing masked/unchanged values. * **Tests** * Added regression and unit tests covering profile validation and challenge character validation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
207d41e995 |
Windows MDM reconciler cleanup and remaining fixes (#47493)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45635 - Refactored setup experience flow to use host-specific reconciler methods - Removed now unneeded reconciler methods # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Windows configuration profiles are now queued immediately when a host enrolls in Windows MDM, so profile delivery happens during the same check-in instead of waiting for the next reconciliation cycle. * Windows MDM enrollment finalization now runs per-host reconciliation and will block release until that reconciliation completes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin Sykulev
|
2ad76714ce |
Throttle requests to AMAPI during profile reconcilation (#47223)
**Related issue:** Resolves #41910 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a configurable env var to limit Android MDM profile reconciliation batch size (FLEET_MDM_ANDROID_PROFILES_BATCH_SIZE; default 1000). * Reconciliation now processes hosts in cursor-based, batched windows and persists a reconciliation cursor to resume/advance work, reducing peak API load and enabling pagination. * **Tests** * Added validation tests for the batch-size config and tests verifying cursor-based pagination and processing. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
ac6aa7329c |
Improve SAMLResponse validation in SSO callbacks (#47463)
- [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security Enhancements** * Enforced strict size limits for SAMLResponse payloads and rejected overly large submissions. * Added protections against deeply nested or excessively large SAML XML documents. * Applied rate limiting to SSO/authentication callback endpoints (configurable via Auth settings). * **Tests** * Added tests verifying SAMLResponse size and XML shape validation behavior. * **Documentation** * Noted these SSO validation and rate-limiting changes in the changelog. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
2c8b21a782 |
Defer Windows MDM profile removals via pending-delete retention (#47156)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46993 Requires #47071 to merge first Loadtest shows reduction of batch delete of 40 profiles for 30K hosts down to ~3.9 seconds. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Bug Fixes** * Resolved timeout issues when removing large numbers of Windows configuration profiles from teams with many hosts. * **New Features** * Windows profile deletions now process asynchronously in the background, enabling faster API responses and consistent behavior with profile delivery operations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Carlo
|
6735479a5d |
Make ctxerr treat 4xx errors as client errors (#47415)
**Related issue:** Resolves #45855 |
||
|
Lucas Manuel Rodriguez
|
cf6a8a29c0 |
Fix command line flags in agent settings UI (#47414)
Resolves #47412. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Agent settings editor now renders empty or null command-line flags visibly (instead of hiding them), preserving their clearing behavior for host-level settings. * **Tests** * Added tests to validate YAML output and formatting for command-line flags, missing keys, and related edge cases. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
b4c32d279e |
Policies: Include/Exclude label targeting in Save policy modal (#33441) (#47213)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46583 Figma: https://www.figma.com/design/0F1sw63SuYaKVWlcL7mnc6/-33441-Policies--Custom-targets-with-%22Include-any%22-and-%22Exclude-any%22?node-id=5303-5687&t=Fszpf83KhcZ7ViWh-0 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Note: policy creation will fail if more than one inclusion/exclusion option is provided. This will be addressed as part of https://github.com/fleetdm/fleet/issues/46582 (we'll relax that check to make sure we can accept a combination). https://github.com/user-attachments/assets/9cfbcbca-54ce-4978-8248-7d550f18785b https://github.com/user-attachments/assets/16138fb1-da7c-4838-8819-f370bf7072c1 Empty state: <img width="850" height="628" alt="Screenshot 2026-06-10 at 11 30 45 AM" src="https://github.com/user-attachments/assets/141c4d26-e464-4ae1-b6ed-94d24a640e1c" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Add optional "exclude all" label targeting for policies (labels_exclude_all) and tab-based Include/Exclude targeting UI. * **Improvements** * In-modal navigation to add new labels; Custom targeting requires at least one selected label to enable Save. * Payloads now include include/exclude label fields when using Custom targeting. * **Tests** * Updated modal tests to cover exclude-tab label selection. * **Style** * Improved empty-state border styling in label selector. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
b4dcea8a82 |
Improved Windows MDM reconciler (#47071)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45635 Moved profile reconciler work from SQL to code, similar to what Apple MDM team did last sprint. The Windows MDM loadtest for 40 profiles with 30K hosts looks much better. ``` ┌──────────────────────────┬─────────────────────────────────────────┬───────────────────────────────────────────┐ │ │ Pre-fix baseline │ This branch │ ├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤ │ Transfer wall time │ ~40–42 min │ ~15.5 min │ ├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤ │ Per work tick │ 215–257s (host-finding query dominated) │ ~48s (host-finding gone; now bulk writes) │ ├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤ │ Ticks > 30s (work ticks) │ ~all │ ~all (16/17, ~48s) │ ├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤ │ Pacing governor │ the host-finding query │ the 2000-host delivery cap + 30s interval │ └──────────────────────────┴─────────────────────────────────────────┴───────────────────────────────────────────┘ ``` The writer spikes briefly to 16 AAS, but has CPU headroom, so I'd say we can claim to support 40 profies on 30K hosts. ``` ┌───────────────┬───────────────┬───────────────────────────┬───────────────────────────────────────┐ │ Instance │ CPU avg / max │ DBLoad avg / max (4 vCPU) │ Read / Write / Commit latency │ ├───────────────┼───────────────┼───────────────────────────┼───────────────────────────────────────┤ │ writer -two │ 67.9% / 74.9% │ 4.84 / 16.0 │ 0.28ms / 2.07ms / 10.6ms (max 12.2ms) │ ├───────────────┼───────────────┼───────────────────────────┼───────────────────────────────────────┤ │ reader -one │ 46.1% / 52.7% │ 1.19 / 5.0 │ 1.59ms / — / — │ ├───────────────┼───────────────┼───────────────────────────┼───────────────────────────────────────┤ │ reader -three │ 65.4% / 70.1% │ 1.77 / 5.0 │ 1.72ms / — / — │ └───────────────┴───────────────┴───────────────────────────┴───────────────────────────────────────┘ ``` # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Reworked Windows MDM reconciliation to a snapshot-based, batched drain-loop, improving responsiveness and reducing database load during large profile operations. * **Performance / Reliability** * Windows MDM profile changes now reach hosts faster; large team-wide profile additions/removals (including host transfers) complete more quickly with lower DB impact. * **Chore / Configuration** * Added tunables to control per-tick delivery caps and scan budgets. * **Tests** * Expanded end-to-end and property tests for install/remove, team/label gating, and multi-window drain behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
251093f6b3 |
Setup experience software policy checks (#47075)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45309 If software is linked to policies, we run the policy during setup experience to determine if software should be installed. We install on failing policies. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Windows/Linux setup experience installers can be gated by team policies: setup will run a policy check and skip installing if the policy already passes; if the policy fails, the installer runs as part of setup. * After gated setup completes, the host’s policy set is re-evaluated promptly so subsequent policy actions run immediately. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordan Montgomery
|
afbbc447bb |
Improve apple MDM parsing (#47344)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enforced request body size limit for Apple MDM operations (≈16 MiB cap). * **Improvements** * Safer Apple MDM plist parsing with bounds and complexity checks to reject malformed/oversized payloads. * Decoder updated to more strictly accept XML check-in/command payloads. * **Tests** * Added unit tests covering bounded plist decoding and XML-only decoding behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott GressandLucas Manuel Rodriguez
|
ffbbb9e866 |
Validate SSO settings correctly for GitOps (#46487)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43371 # Details * Ensures that if `enable_sso: true` is set in a global config, then all required sso keys (`entity_id`, `idp_name` and one of `metadata`/`metadata_url`) are provided * Ensures that if `end_user_authentication: true` is set on a fleet, then all required sso keys (`entity_id`, `idp_name` and one of `metadata`/`metadata_url`) are provided, _even if the fleet's config file is not provided in the gitops run_. * Ensures that if `end_user_authentication: true` is set in a fleet config in a gitops run, then all required sso keys (`entity_id`, `idp_name` and one of `metadata`/`metadata_url`) are provided, _even if the global config file is not provided in the gitops run_. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually ### Org SSO — gitops client validation (`fleetctl gitops`) - [x] `enable_sso: true` with **empty `metadata` and `metadata_url`** → fails (metadata-or-url) - [x] `enable_sso: true` with **empty `idp_name`** → fails (idp_name) - [x] `enable_sso: true` with **empty `entity_id`** → fails (entity_id) - [x] Multiple fields missing at once → **one error line per missing field** - [x] `enable_sso: true` + complete IdP (`metadata_url`) → succeeds - [x] `enable_sso: true` + complete IdP using inline `metadata` (no url) → succeeds - [x] `enable_sso: false` + empty IdP fields → succeeds - [x] `sso_settings` key **omitted entirely** → succeeds, and apply **clears** stored SSO - [x] The literal `generate-gitops` output (`metadata: # TODO: ...`) applied as-is → **rejected** ### MDM EUA — gitops group cross-file validation - [x] Team file enables EUA **+** global file **omits** the EUA IdP block → fails - [x] **#43371 core repro:** stored team EUA on, file NOT in run, global-only run blanks metadata → fails, names the team - [x] Same but the team's file **is** in the run with EUA `false` → succeeds - [x] EUA disabled everywhere + **empty** stored IdP → succeeds ### `--delete-other-fleets` - [x] Run with `--delete-other-fleets` degrading the IdP while a stored not-in-run team has EUA on → succeeds - [x] Confirm the omitted team is actually deleted on apply - [x] Known corner: `--delete-other-fleets` + omitted ABM/VPP team with EUA on + degraded IdP → fails at apply time ### Server-side backstop (REST API) - [x] `PATCH /config` (overwrite=false), `enable_sso:true`, metadata omitted, existing has metadata → **200**, metadata preserved - [x] `PATCH /config?overwrite=true`, `enable_sso:true` + empty metadata/url → **422** field `metadata` - [x] `?overwrite=true`, metadata_url set, empty `entity_id`/`idp_name` → **422** both `required` - [x] `?overwrite=true`, `enable_sso:false` → **200** (no IdP required when disabled); `sso_settings` omitted entirely → clears (covered by gitops POS-2) ### Server-side EUA (`euaStrict` keyed on incoming global flag only) - [x] `?overwrite=true` + incoming **global** EUA enabled + incomplete IdP → **422** `entity_id`/`idp_name` - [x] `?overwrite=true` + global EUA **off** + stored team EUA + payload degrades IdP → **succeeds** (via gitops #43371-OVERRIDE) - [x] `?overwrite=true` + global EUA off + payload **fully clears** IdP while a team has EUA → **422** `end_user_authentication` (IsEmpty guard) ### Regression / false-positive guards - [x] Multi-file gitops `--dry-run` configuring IdP AND enabling team EUA (empty stored IdP) → dry-run passes (EE dry-run skip) - [x] A previously-working gitops run with a complete SSO/EUA config → still applies cleanly ### End state verification - [x] After any **rejected** run, stored SSO/EUA config **unchanged** - [ ] After a valid complete-IdP run, SSO login + ADE/EUA enrollment works end-to-end (live device) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * GitOps now validates SSO and MDM end-user authentication (EUA) configs before applying changes, rejecting incomplete settings when SSO/EUA are enabled globally or for any team. Overwrite (GitOps) mode enforces stricter validation than standard updates; dry-run behavior adjusted to avoid spurious EUA rejections. * **Tests** * Added comprehensive tests covering SSO/EUA validation, overwrite vs patch semantics, cross-file EUA scenarios, and delete-other-fleets behavior. * **Refactor** * Reorganized validation and config-parsing helpers for reuse in GitOps checks. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
|
6d67565b14 |
Update Go to 1.26.4 (#47158)
Resolves #47159. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the Go toolchain to 1.26.4 across modules, Docker build stages, and build/configuration records to standardize the toolchain version used for builds and tooling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Allen HouchinsandNoah Talerman
|
3906398928 |
Schedule calendar remediation events next business day after policy failure (#42435)
This pull request updates the logic for scheduling calendar events to always select the next business day (skipping weekends) instead of scheduling on the next Tuesday. The test suite for this functionality has also been rewritten to reflect the new behavior and to improve clarity. **Business logic update:** * Changed `getPreferredCalendarEventDate` in `calendar_cron.go` to return the next business day after the provided date, skipping weekends, instead of always selecting the next Tuesday. **Test updates:** * Refactored the test cases in `calendar_cron_test.go` to use specific `today` dates and expected results, ensuring coverage for weekday transitions, weekend skipping, and month/year rollovers. The tests now directly check the next business day logic rather than iterating over ranges of days. **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Calendar events now schedule on the next business day (skipping weekends) after a policy failure instead of a fixed weekly day. * **Tests** * Updated unit tests to validate the new next-business-day behavior with explicit expected dates. * **Documentation** * Updated scheduling description to reflect next-business-day remediation timing. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> |
||
|
Jonathan Katz
|
b7adf2751d |
Add detailed error for generate-gitops when a patch policy installer is missing an FMA (#47136)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43770 Just updates the error message to make it say what's wrong and what can be done about it. We still abort the entire export because it would be wrong to create a patch policy not associated to an FMA. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually New error message: ``` $ fleetctl generate-gitops --dir ./my-gitops --fleet Example-Fleet Generating GitOps configuration files... Error generating policies for fleet Example-Fleet: The patch policy "macOS - Zen Browser up to date" references a software installer that is no longer a Fleet-maintained app. Please delete the policy manually. Error: Something's gone wrong. Please try again. If this keeps happening please file an issue: https://github.com/fleetdm/fleet/issues/new/choose ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Enhanced error handling in the `generate-gitops` command to provide clearer messaging when a patch policy references a Fleet-maintained application that has been removed from the catalog. The command will now abort with explicit guidance, instructing users to manually remove the orphaned policy. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dante Catalfamo
|
7ad95ac2c3 |
Fixed the host's Software UI showing a date decades in the past (#46779)
**Related issue:** Resolves #43622 |
||
|
Lucas Manuel Rodriguez
|
95fedf043b |
Fix live query selector X button (#47089)
Resolves #46299. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Bug Fixes * Fixed a UI issue on the live report target selection screen where users were unable to remove selected hosts from their target list. The delete button ("X") next to each selected host now functions correctly, allowing users to easily deselect individual hosts and make adjustments to their overall target selections. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dante Catalfamo
|
ad30812054 |
Speed up /vulnerabilities and filtered /software/versions queries (#45564)
Address 100% DB CPU spikes observed when paginating these endpoints with filters. Two root causes: cve_meta and vulnerability_host_counts lack indexes for the actual filter shapes, and ListVulnerabilities ran correlated scalar subqueries on every row of vulnerability_host_counts that matched the scope (1.1M rows examined per call). Add three online indexes: - cve_meta(cisa_known_exploit, cve) for the exploit filter - cve_meta(cvss_score, cve) for the CVSS range filter - vulnerability_host_counts(global_stats, team_id, host_count, cve) for the scope filter on the vulnerabilities endpoint Refactor ListVulnerabilities into a two-stage query: an inner query filters, sorts, and paginates vulnerability_host_counts (with an optional LEFT JOIN to cve_meta for sort/filter columns), and an outer query enriches only the paginated page with the created_at and source scalar subqueries. Net effect: the heavy subqueries run perPage times (~20-100) instead of millions. Sort-by-created_at falls back to the single-statement form since the sort key is itself the subquery result. CountVulnerabilities drops the redundant DISTINCT (vhc.cve is already unique within a (global_stats, team_id) scope via the existing UNIQUE KEY) and only joins cve_meta when KnownExploit filtering is requested. **Related issue:** Resolves #45415 |
||
|
Nico
|
3f5944626c |
Fix Fleet startup crash on read-only filesystem without S3 bucket (#47099)
**Related issue:** Resolves #47090 Fleet crashes into `CrashLoopBackOff` on startup when deployed on Kubernetes with `readOnlyRootFilesystem: true` and **no** S3 software installers bucket configured: ``` Failed to start: initializing filesystem org logo store: mkdir /tmp/org-logos: read-only file system ``` I realised I was calling `initFatal` when failing to create a directory on the filesystem which doesn't match the pattern of `logging` + `creating a "failing" store` (one that is initialized but fails all operations) as we do for e.g. software title icons (see NewFailingSoftwareTitleIconStore). Per this slack conversation: https://fleetdm.slack.com/archives/C084F4MKYSJ/p1780931127976389, we decided to fall back to a database-backed storage: <img width="737" height="114" alt="Screenshot 2026-06-08 at 3 16 28 PM" src="https://github.com/user-attachments/assets/2a6ff75f-b382-40ba-81d9-3be3cfbd648a" /> # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Commented out this line to force filesystem usage: <img width="615" height="71" alt="Screenshot 2026-06-08 at 1 18 53 PM" src="https://github.com/user-attachments/assets/85043c88-5c8c-48a0-8145-098fba9513bd" /> #### Before Server crashes <img width="1278" height="124" alt="Screenshot 2026-06-08 at 1 18 17 PM" src="https://github.com/user-attachments/assets/7b788a24-131a-47a3-8580-fcd9fda8b449" /> #### After Server starts and logo upload works - Without --dev_license https://github.com/user-attachments/assets/58c5ebf9-cf52-4ba0-ac98-9675e7eef92c - With --dev_license https://github.com/user-attachments/assets/117bb812-31bd-4849-927c-93cafd1a71d7 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** - Organization logos now support database storage as the fallback option when S3 software installers bucket is not configured, replacing local filesystem storage for improved reliability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
20c0963331 |
Fix GitOps when using All fleets in VPP settings (#46855)
**Related issue:** Resolves #46824 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where volume purchasing program assignments failed when "All fleets" was selected; validation and token assignment now treat the "All fleets" label consistently, preventing errors during configuration application. * **Tests** * Added an end-to-end GitOps test case verifying "All fleets" is supported for volume purchasing program entries. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin Sykulev
|
2570e25f0e |
Defer writing team_id on android check-ins (#46929)
**Related issue:** Resolves #44113 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Bug Fixes** * Fixed an issue where Android device check-ins could revert admin team transfers, ensuring team assignments persist correctly after re-enrollment. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
e34126ab3a |
Merge branch 'main' of github.com:fleetdm/fleet into feat/39018-self-service-categories
Bump migration, fix failing test and nilaway check |
||
|
Lucas Manuel Rodriguez
|
6313e75934 |
Fix live policy page to use full width (#47094)
**Related issue:** Resolves #47092. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. `main`: <img width="2550" height="1286" alt="Screenshot 2026-06-08 at 12 27 01 PM" src="https://github.com/user-attachments/assets/b866201d-aff7-44db-913f-1987322405d5" /> <img width="2550" height="1286" alt="Screenshot 2026-06-08 at 12 27 11 PM" src="https://github.com/user-attachments/assets/da56683e-b0e3-4d6d-b38e-3d94d761c5a0" /> With changes in this PR: <img width="2550" height="1162" alt="Screenshot 2026-06-08 at 12 25 30 PM" src="https://github.com/user-attachments/assets/73694cb3-e8ae-42c4-9834-372feadb6e81" /> <img width="2550" height="1286" alt="Screenshot 2026-06-08 at 12 25 54 PM" src="https://github.com/user-attachments/assets/71db9c15-cb32-4650-be77-28559b4ac70c" /> ## Testing - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Bug Fixes * The live policy page now correctly uses the full page width, consistent with the live query page display. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
61064687e4 |
Add Python 3.13 & 3.14 as Windows FMAs and normalize versions (#46873)
This pull request improves the handling of version comparisons for Windows application patch policies in the `winget` ingester, specifically to support installers (like python.org) where the registry's `DisplayVersion` does not match the package's marketing version. It introduces a new option to compare against the `DisplayVersion`, adds robust test coverage for this logic, and onboards Python 3.13 and 3.14 as maintained apps with correct install/uninstall scripts. **Patch policy improvements:** * Added a `UseDisplayVersionForPatch` field to `inputApp` and supporting logic in the ingester to optionally compare patch policy versions against the registry `DisplayVersion` instead of the package version, with error handling if no display version is found. [[1]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R414-R434) [[2]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R566-R571) * Introduced the helper function `firstDisplayVersion` and extended the `appsAndFeaturesEntries` struct to include `DisplayVersion`. [[1]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R448-R458) [[2]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R612) **Test coverage:** * Expanded test cases in `ingester_test.go` to cover the new `UseDisplayVersionForPatch` logic, including both positive and negative scenarios. [[1]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055R347) [[2]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055R374-R424) [[3]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055L410-R470) * Updated test server config and fixtures to support `DisplayVersion` for accurate test simulation. [[1]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055R482) [[2]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055L447-R503) **New maintained apps:** * Added onboarding for Python 3.13 and Python 3.14 as maintained apps, each with a `use_display_version_for_patch` flag, install/uninstall scripts, and appropriate configuration. [[1]](diffhunk://#diff-8a640dba0d8cc9ee50cef0397c5efce6655957dde836df94e6d5fb536f422fecR1-R15) [[2]](diffhunk://#diff-e25e77b6c53c5fcc80a6d7589547873b5007dbcca660decbff3c9579c057b0fbR1-R15) [[3]](diffhunk://#diff-fca224dfb5a7262b0b4ad68061b06552dc5291aeb8e2409fd5c9c6f8d8022dacR1-R32) [[4]](diffhunk://#diff-b2bd0383162063c7923532a2be6b7014310a79fe3b0c681d1647bcd0fa6e3fe8R1-R147) These changes ensure that patch policies correctly flag outdated installs for apps where the registry version format differs from the package version, and Python installs are now robustly managed via Fleet. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #37326 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for Python 3.13 and Python 3.14 on Windows Fleet, including install/uninstall workflows and manifests * Option to use installer-displayed version for patch comparisons * **Improvements** * Normalized Windows-reported Python version strings for consistent inventory and vulnerability matching * Added icons for Python 3.13 and 3.14 in the software catalog <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
RachelElysia
|
175b2419a4 | Fleet UI: Route software title names through getDisplayedSoftwareName (#47084) | ||
|
Nico
|
bab14d7eb5 |
Fix auth token not persisting over HTTP (non-TLS) deployments (#47076)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41641 & Resolves #44276 When Fleet is served over plain HTTP from a non-localhost host (e.g. a Docker deployment accessed by IP), login fails with an "Authentication Required" error. To reproduce this, I ran the server as follows: ``` ./build/fleet serve --dev --dev_license --server_tls=false --server_address=0.0.0.0:8080 ``` And then, go to the Fleet UI using my private IP: ``` http://<my-lan-ip>:8080 ``` https://github.com/user-attachments/assets/09543b9b-b9ee-4d1c-b47e-ebd49c20c699 The auth token is stored client-side in a `__Host-token` cookie with the `Secure` attribute, and browsers silently drop `__Host-`/`Secure` cookies on insecure, non-localhost origins. So, the token was never persisted and the follow-up `GET /config` (and every subsequent request) went out without it. This change keeps the `__Host-token` + `Secure` cookie on HTTPS, and falls back to a plain `token` cookie over HTTP so the token persists. TL;DR: this restores the pre [#40504](https://github.com/fleetdm/fleet/pull/40504) behavior for non-TLS deployments and leaves HTTPS behavior unchanged. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually https://github.com/user-attachments/assets/e7e838f3-f423-4e28-aebd-5f921af08b00 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where login requests would fail with an "Authentication Required" error when Fleet is served over HTTP. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
863363561b |
Fix fleet-scoped host vitals labels (#46953)
**Related issue:** Resolves #46869 - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Host vitals labels based on identity-provider group membership now correctly apply to both global and team-scoped hosts, preventing cross-team leakage. * **Tests** * Added and updated tests to validate IdP-group-backed vitals label membership across global and per-team hosts. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
89965f4f9a |
Extract platform-neutral MDM reconcile label primitives (#47032)
Pure refactor, no behavior change. First step for #45635 (Windows batched in-memory reconciler). - New server/mdm/reconcile package holds the include/exclude label handlers and the team+label applicability dispatcher. The Apple platform gate stays in the Apple wrapper since platform eligibility is platform-specific. - New platform-neutral fleet types (MDMProfileLabelRef, MDMProfileIncludeMode, MDMLabeledEntity); the Apple names are now type aliases so existing code and tests are unchanged. - BulkGetHostLabelMemberships moves from apple_mdm_batched.go to a neutral file; it was already platform-agnostic. - The existing Apple label-scenario tests keep covering the shared logic through the delegating wrappers; the shared package also gets its own handler/dispatcher tests. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45635 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Moved MDM profile include/exclude label logic into a shared, platform-neutral reconciliation flow for consistent behavior across platforms. * Consolidated Apple MDM label handling to reuse the shared reconciliation primitives and improved host label membership lookup behavior. * **Tests** * Added and reorganized unit tests covering MDM label-based profile reconciliation, include/exclude rules, and Apple-specific wrapper behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
CarloandJonathan Katz
|
fb9e4c4701 |
Auth in-house iOS app downloads with install tokens (#46819)
# Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * In-house iOS app manifest and package downloads now use secure per-install tokens embedded in the URL path instead of query parameters * Installation tokens are bound to specific devices and teams, enhancing security * Installation tokens automatically expire after 6 hours <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Jonathan Katz <yehonatankatz@gmail.com> |
||
|
Dante CatalfamoandNoah Talerman
|
48fe442da0 |
Update CVE documentation to list Linux distributions supported (#46828)
**Related issue:** Resolves #45110 --------- Co-authored-by: Noah Talerman <noahtal@umich.edu> |
||
|
Dante Catalfamo
|
e90bcfeaae |
Add rules to deal with some python CVE false positives (#46673)
**Related issue:** Resolves #35148 ## What was added | CVE | Rule | Reason | |-----|------|--------| | **CVE-2017-17522** | `IgnoreAll` | DISPUTED by Python maintainers; not exploitable (`webbrowser.py` uses `subprocess.Popen` with `shell=False`). Broad NVD CPE matched modern Python. | | **CVE-2023-36632** | `IgnoreAll` | NVD-DISPUTED — Python states it's "neither a vulnerability nor a bug" (intentional `RecursionError` in `email.utils.parseaddr`). | | **CVE-2024-3219** | `IgnoreIf target_sw != "windows"` | Only affects platforms lacking AF_UNIX (Windows). Linux/macOS unaffected, but NVD/VulnCheck CPE uses `target_sw=*`. | **Files touched:** - `cpe_matching_rules.go` — three new rules - `cpe_matching_rule_test.go` — assertions covering all three (incl. Windows-vs-macOS/Linux distinction for CVE-2024-3219) - `changes/35148-python-cve-false-positives` — changelog **Correctness note:** `target_sw` derives from software *source* (`apps`/`homebrew_packages` → `macos`, `programs` → `windows`), so the CVE-2024-3219 rule suppresses on macOS while preserving the genuine Windows positive. ## What was skipped, and why | CVE | Why skipped | |-----|-------------| | **CVE-2024-12718** | Conflicting evidence: getvictor confirmed it's a **true positive** (3.9.22 < fixed 3.9.23), contradicting the customer's "only 3.12+ affected" reasoning. Needs a product/security ruling, not a code change. | | **CVE-2025-1795** | Likely a VulnCheck patch-level miss (customer says 3.10.17 has the backported fix). Needs the actual VulnCheck version range to fix safely. | | **CVE-2023-32681** | Affects `python:requests` and is **correctly matched**; the customer dismissed it on deployment grounds ("corporate servers only"). Not a detection bug. | | **CVE-2007-4559** | Real tarfile path-traversal (CVSS 9.8, **not disputed**); the customer labeled it "Other issue," not a false positive. Suppressing it would hide a genuine vulnerability. | |
||
|
Dante Catalfamo
|
49db931ffb |
Auto-clean duplicate Okta CA SCEP cert after profile install (#46172)
**Related issue:** Resolves #42757 ## Summary Resending or renewing the Okta conditional access profile leaves an orphaned SCEP certificate in the per-user macOS keychain, accumulating duplicates with every renewal. This PR auto-runs an existing keychain-cleanup script after a successful `InstallProfile` ack for the Okta CA profile, so admins no longer have to find and run the script manually. ## Root cause Investigation in the issue thread isolated the trigger: - The Okta CA `.mobileconfig` bundles `com.apple.security.scep` with `com.apple.security.identitypreference` in a single profile (macOS rejects the alternative — `Identity payload not found in same profile as identity preference payload`). - The Identity Preference payload creates a keychain-resident preference item that keeps the *old* cert pinned across profile replacement, even though the rewritten Identity Preference now points to the fresh SCEP enrollment. - EAP-TLS Wi-Fi profiles renew cleanly because they reference the cert via SystemConfiguration (`PayloadCertificateUUID`), not the keychain — so this isn't a generic SCEP-bundling issue. The team decision in the issue (`@sharon-fdm`) was to delete the duplicate certificate rather than restructure the profile. A standalone cleanup script already shipped at `docs/solutions/macos/scripts/delete-duplicate-scep-certificates.sh` and was linked from the Okta CA guide; admins had to find and run it. ## Approach Hook the existing Apple MDM `InstallProfile` ack path in `MDMAppleCheckinAndCommandService.CommandAndReportResults`, parallel to the existing ACME `CertificateList` follow-up. When the ack is for the Okta CA profile and status is `verifying`, enqueue an internal host script run that executes the cleanup script targeting the host's per-user MDM enrollment short name. Key properties: - **Single hook, three paths covered.** Admin "Resend" nulls the profile status and the reconciliation cron re-enqueues an `InstallProfile`; the SCEP renewal cron also re-issues `InstallProfile`. Both flow through the same ack handler this hook attaches to. - **Idempotent.** The cleanup script no-ops when only one matching cert is present, so triggering on initial installs (not just renewals) is safe and removes the need to distinguish "is this a renewal". - **Tightly gated.** Single indexed lookup keyed on `(host_uuid, command_uuid, profile_identifier, platform='darwin')`. Other SCEP-bearing profiles do not trigger the script. No work happens for hosts with no per-user enrollment. - **Internal-script semantics** (matches lock/unlock/wipe prior art). Runs even when scripts are globally disabled. Does not appear in the user-facing host activity feed. - **Failure-isolated.** Enqueue errors are logged but do not break the ack path; the renewal itself is what matters. - **Defense in depth on the shell call.** The macOS short name is validated against a strict regex (`^[A-Za-z0-9_][A-Za-z0-9_.-]*$`, ≤31 chars) before being interpolated, and POSIX single-quote-escaped on the way through. ## Files **New** - `server/service/conditional_access_cleanup.go` — `//go:embed` of the cleanup script, the hook helper `maybeRunOktaCACleanupScript`, the validated shell-wrapper builder, and the POSIX single-quote escape helper. - `server/service/conditional_access_cleanup_test.go` — unit coverage for username validation, shell escaping, the routing decisions of the hook helper (mock-based), and an embed-sync assertion against the docs copy. - `server/service/embedded_scripts/delete-duplicate-scep-certificates.sh` — embed source-of-truth copy, byte-for-byte equal to the public `docs/solutions/macos/scripts/` script. - `changes/42757-okta-conditional-access-duplicate-scep-cert-cleanup` — user-visible changes note. **Datastore** - `server/datastore/mysql/mdm.go` — `OktaCACleanupTargetForInstallCommand`: single SQL lookup that returns `(host_id, user_short_name, ok)` for the new hook. Returns `ok=false` for non-Okta profiles, non-darwin hosts, or hosts without a user-channel enrollment. - `server/datastore/mysql/scripts.go` — `NewInternalHostScriptExecutionRequest`: thin wrapper that routes through the existing internal-script codepath (`isInternal=true`) used by lock/unlock/wipe. Refactored the existing public method to share an internal helper. **Interface / mocks** - `server/fleet/conditional_access_idp.go` — exported `ConditionalAccessOktaProfileIdentifier`, `ConditionalAccessOktaCertificateCN`, and the new `OktaCACleanupTarget` struct, so both the template-render path and the SQL lookup can reference the same source of truth. - `server/fleet/datastore.go` — `OktaCACleanupTargetForInstallCommand` and `NewInternalHostScriptExecutionRequest` added to the `Datastore` interface. - `server/mock/datastore_mock.go` — regenerated (additions only). **Wiring** - `server/service/apple_mdm.go` — call into `maybeRunOktaCACleanupScript` from the InstallProfile `MDMDeliveryVerifying` branch, alongside the existing ACME `maybeQueueCertificateListForACMEProfile` follow-up. Warns on error rather than failing the ack. - `server/service/conditional_access_idp.go` — use the new `fleet.ConditionalAccessOktaCertificateCN` constant when rendering the profile template, eliminating the magic string duplication. **Tests touched** - `server/datastore/mysql/mdm_test.go` — integration test `testOktaCACleanupTargetForInstallCommand` covering the happy path, non-Okta profile, device-only enrollment, and unknown command. - `server/datastore/mysql/scripts_test.go` — `testNewInternalHostScriptExecutionRequest` confirming the internal flag is set correctly and the new entry only appears under the internal-only listing filter. - `server/service/apple_mdm_test.go` — added the new mock stub for `OktaCACleanupTargetForInstallCommandFunc` to `TestMDMCommandAndReportResultsProfileHandling` so the existing test continues to pass with the new hook in the codepath. - `server/service/conditional_access_idp_test.go` — the rendered-profile assertion now also pins on the shared `ConditionalAccessOktaProfileIdentifier` and `ConditionalAccessOktaCertificateCN` constants so the template can't drift from the SQL lookup. |
||
|
Juan Fernandez
|
eb42b22230 |
Fix custom variable modal clearing when switching browser focus
Fixes #44805 Fixed a bug where the "Add custom variable" modal would clear entered values when switching focus to another browser tab or application window due to network refetches. |
||
|
Konstantin Sykulev
|
b02fa180b2 |
Preserve android device team assignment (#46868)
**Related issue:** Resolves #45263 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Android devices no longer lose team assignments or certificate configuration when a host is deleted and the device re-enrolls. * Re-enrollment restores a device’s previously known team when available, preserving certificate templates and team-specific settings. * Team transfers for Android devices now reliably update device records so certificates and access remain consistent. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
f19c9a6696 |
Optimize ListLabels host-count query
Fixes #4890 * Optimized listing labels query by refactoring correlated subquery. * Optimized aggregate that counts host's labels to executed once, and skip the join to hosts entirely when the team filter allows all hosts. |
||
|
Dante Catalfamo
|
8cb7f8af67 |
Add macos_applications filter for host software list (#46223)
Adds a `macos_applications` boolean query parameter to the list host
software endpoint (`GET /api/_version_/fleet/hosts/{id}/software`). When
true, results are restricted to apps installed at the top level of the
macOS /Applications folder, hiding helper apps, system apps,
command-line tools, and user-local apps. The filter applies only to
macOS hosts and is ignored on other platforms.
The filter is applied by pruning the in-memory software maps in
ListHostSoftware down to the title IDs that have a top-level
`/Applications` bundle, so the count and paginated queries stay
consistent and the filter applies uniformly across regular, VPP, and
in-house apps. Top-level is determined from
`host_software_installed_paths` via
`installed_path LIKE '/Applications/%' AND NOT LIKE '/Applications/%/%'
on source 'apps'`.
**Related issue:** Resolves #39017
|
||
|
Josh RoskosandScott Gress
|
49b86438bb |
feat: replace osquery column with agent column on hosts page (#44811)
for #44846 for #43458 - UPDATE: @noahtalerman: For the following story: - https://github.com/fleetdm/fleet/issues/44846 --- # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Added a new Agent column on the Hosts page displaying Orbit version with tooltips showing Osquery, Orbit, and Fleet Desktop versions for comprehensive version visibility. * **Improvements** * Updated default column visibility on the Hosts page—Issues and Private IP columns are now hidden by default for a cleaner view. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Scott Gress <scott@fleetdm.com> |
