<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#33110
**Related issue:** Resolves#33109
# Details
This PR implements the new "cancel setup if any software fails on macos"
flag, including both backend and frontend logic.
Half of the file changes are updating test expectations / auto-generated
schema.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
`macos_setup` is still excluded from generate-girtops
- [X] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
Documented [here](https://github.com/fleetdm/fleet/pull/33016/files)
- [X] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [X] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- New Features
- Added a macOS setup option: “Cancel setup if software install fails.”
- Configure at global or team level; team settings override global.
- Toggle available in Setup Experience > Install software > Advanced
options.
- Saved state persists and can be updated without leaving the page.
- Devices honor the resolved setting during provisioning.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ian Littman <iansltx@gmail.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** For #33111
# Details
This PR updates the setup experience for MacOS to use a web view pointed
at the device's "Setting up your device" page rather than using native
MacOS UI elements, bringing it more in line with Linux and Windows setup
experiences.
This covers only the new web UI for the setup experience progress, _not_
the UI for the new case of blocking the device when a piece of software
fails to install. I'll add that in a separate PR.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
Added tests for the updates to the token rotation code.
- [X] QA'd all new/changed functionality manually
A new tool is provided to allow testing this code against a virtual
machine if a separate host that you can wipe and run setup on is not
available. See
https://github.com/fleetdm/fleet/blob/sgress454/new-setup-experience/tools/mdm/apple/setupexperience/README.md
for details.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- New Features
- macOS setup experience moved to a new web-based UI.
- Automatic device token rotation during setup to keep sessions valid.
- Bug Fixes
- More reliable setup flow with improved dialog lifecycle and cleaner
handoff to web content.
- Dialog elements hidden/cleared appropriately when transitioning to the
browser.
- Documentation
- Added guide and tool to simulate the macOS setup experience on a VM,
with prerequisites and usage steps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
If the total requested common software is 10,000 and there are 200
hosts. Instead of all hosts having 10,000 pieces of software, each host
will have a 50 software slice of the 10,000 total requested. This is
controlled by `common_software_count`. If you wish to have each host
have a certain amount of software, use the `unique_software_count`
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#33668
**Related issue:** Resolves#33701
Adds the UI needed to install software for ios and ipad during the setup
experience.
> NOTE: the video still needs to be recorded and placed in the code for
ios and ipad
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [ ] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
> Closes#33581
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked table schema to confirm autoupdate
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
---------
Co-authored-by: RachelElysia <rachel@fleetdm.com>
Added information about Secure Enclave being the default key storage
since august 2025.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
Resolves#33254
This can be reproduced locally by running the following "high load"
test:
Run 500 hosts using osquery-perf:
```
go run ./cmd/osquery-perf --enroll_secret ... \
--host_count 500 \
--server_url https://localhost:8080 \
--live_query_fail_prob 0.0 \
--live_query_no_results_prob 0.0 \
--orbit_prob 0.0 \
--http_message_signature_prob 0.0
```
Run `stress_test_live_queries.sh`:
```
#!/bin/bash
while true; do
curl -v -k -X POST -H "Authorization: Bearer $TEST_TOKEN" https://localhost:8080/api/latest/fleet/queries/$SAVED_QUERY_ID/run -d '{"host_ids": [<500 comma-separated host ids>]}'
done
```
Use "Redis Insight" or the like and you will start to see
`livequery:{$CAMPAIGN_ID}` keys with `No limit` (which is the bug):
<img width="1380" height="227" alt="Screenshot 2025-10-07 at 3 10 26 PM"
src="https://github.com/user-attachments/assets/30434348-3217-40c4-8ebc-bab5ceb4daa9"
/>
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- Bug Fixes
- Prevent lingering Redis keys for live queries by ensuring keys are
cleaned up and not recreated when completing/canceling non-existent
queries.
- Improves resource usage and avoids stale state in live query
processing.
- Tests
- Added tests verifying proper retrieval/completion behavior and that no
Redis key is created for non-existent live queries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ian Littman <iansltx@gmail.com>
**Related issue:** Resolves#31397
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
---------
Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
After talking with eng team and @nonpunctual, the /assets folder is
reserved for things inside the fleet app, so creating a new folder in
`/docs/solutions`
@AdamBaali - I updated your article paths and moved the assets to the
new folder, do you mind taking a peek and making sure it looks good?
Note: brock, we should also update handbook for new ritual to add
articles with assets like this.
---------
Co-authored-by: Brock Walters <153771548+nonpunctual@users.noreply.github.com>
As part of https://github.com/fleetdm/fleet/issues/25798, we planned to
rename "Single sign-on options" to "Single sign-on (SSO)". However, we
missed adding a check for the copy change in the test plan, so we didn't
catch that the change didn't make it in.
The documentation/guide changes referencing the new page name were
already merged as part of 4.71.
## Issue
Closes#33580
Part of Story #33060
## Description
- Anything related to adding "android_apps" into the FE code
- Add to frontend interfaces `interfaces/platform.ts` for platforms that
do not support vuln scanning
- Add `application_id` key and `source: "android_apps"` value to
`ISoftware`
- Add source type conversion `android_apps: "Application (Android)"` for
rendering type in UI
- Add to `INSTALLABLE_SOURCE_PLATFORM_CONVERSION`
- Show unsupported vuln empty state in software details page for
`source: "android_apps"`
- Add android icon to software icons
- Use android icon as default fallback for `source: "android_apps"`
software
- Show android host details page > software library tab, but with
unsupported empty state correct showing android link instead of hiding
tab all together
- Show android host details page > software inventory tab > vuln filter
on, vuln not supported empty state
## Testing
- [x] QA'd all new/changed functionality manually
-
> FE code was manually QAed with hard coded data but will require BE
changes to be merged to E2E QA
**Related issue:** Fixes#33807
Adds missing host platform key to mdm enrolled and mdm unenrolled
activity details api response data. This allows the UI to display the
activities properly
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For #32072. Should be cherry-picked to 4.75 since that's where the
support was added.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
Closes: https://github.com/fleetdm/fleet/issues/33608
Changes:
- Replaced the rows of logos on the /contact page with the
`<logo-carousel>` component
- Updated the layout of the contact page at <990px screen width
Related to
https://github.com/fleetdm/fleet/pull/32434#pullrequestreview-3172873391
I re-edited the guide to follow an easier-to-scan, step-by-step format.
- Rewrote steps into shorter, directive numbered lists in the imperative
mood.
- I added intro lines and note blocks to separate essential instructions
from the supporting context.
- Reorganized post-setup sections into clearer buckets: Disabling,
troubleshooting, end-user experience, and advanced GitOps setup.
- Tightened up UI references using bold instead of quotes.
No technical meaning was changed (I hope). The goal was to make the
guide easier to scan, follow, and maintain, as part of an ongoing effort
to improve doc content consistency and readability.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#33876
Modifies the migration to check for the old constraint before deleting
it in case it was created on mysql 5.7
No changes file since this is an unreleased bug
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
## Database migrations
- [x] Checked table schema to confirm autoupdate
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
RachelElysia