f7f0cfa98e9be97ded00fc6feaca364bbbacfef0
1128
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Juan Fernandez
|
fbccb8cc59 |
Emit created/deleted activities for setup experience scripts
Setup experience script add/replace/delete now record activities (API and GitOps), skipping no-op re-submissions. |
||
|
George Karrandtest
|
6d68bd6487 |
Adding milestone release calendar sync workflow (#48593)
This is a calendar sync workflow to trigger off of milestones being created or due dates being updated to keep the release calendar automatically in sync example of me running it locally ``` ❯ python sync.py --oauth --client-secret ./gcal-releases-oauth.json --apply # Fleet release calendar sync — 2026-07-01 14:50 Calendar: <redacted>@group.calendar.google.com Repo: fleetdm/fleet ## Milestones 4.88.0 due 2026-07-01 4.89.0 due 2026-07-10 4.90.0 due 2026-07-31 4.91.0 due 2026-08-21 4.92.0 due 2026-09-11 4.93.0 due 2026-10-02 4.94.0 due 2026-10-23 4.95.0 due 2026-11-13 4.96.0 due 2026-12-04 4.97.0 due 2026-12-25 4.98.0 due 2027-01-15 4.99.0 due 2027-02-05 4.100.0 due 2027-02-26 4.101.0 due 2027-03-19 4.102.0 due 2027-04-09 ## Events scanned [develop ] 'Develop (next release - 4.87.0)' start=2026-05-18 end=2026-06-06 [develop ] 'Develop (next release - 4.89.0)' start=2026-06-08 end=2026-06-27 [rc ] 'Release candidate (next release - 4.87.0)' start=2026-06-08 end=2026-06-20 [release_day] 'Release day: minor release - 4.87.0' start=2026-06-19 end=2026-06-20 [develop ] 'Develop (next release - 4.90.0)' start=2026-06-29 end=2026-07-18 [rc ] 'Release candidate (next release - 4.89.0)' start=2026-06-29 end=2026-07-11 [release_day] 'Release day: minor release - 4.89.0' start=2026-07-10 end=2026-07-11 [develop ] 'Develop (next release - 4.91.0)' start=2026-07-20 end=2026-08-08 [rc ] 'Release candidate (next release - 4.90.0)' start=2026-07-20 end=2026-08-01 [release_day] 'Release day: minor release - 4.90.0' start=2026-07-31 end=2026-08-01 [develop ] 'Develop (next release - 4.92.0)' start=2026-08-10 end=2026-08-29 [rc ] 'Release candidate (next release - 4.91.0)' start=2026-08-10 end=2026-08-22 [release_day] 'Release day: minor release - 4.91.0' start=2026-08-21 end=2026-08-22 [develop ] 'Develop (next release - 4.93.0)' start=2026-08-31 end=2026-09-19 [rc ] 'Release candidate (next release - 4.92.0)' start=2026-08-31 end=2026-09-12 [release_day] 'Release day: minor release - 4.92.0' start=2026-09-11 end=2026-09-12 [develop ] 'Develop (next release - 4.94.0)' start=2026-09-21 end=2026-10-10 [rc ] 'Release candidate (next release - 4.93.0)' start=2026-09-21 end=2026-10-03 [release_day] 'Release day: minor release - 4.93.0' start=2026-10-02 end=2026-10-03 [develop ] 'Develop (next release - 4.95.0)' start=2026-10-12 end=2026-10-31 [rc ] 'Release candidate (next release - 4.94.0)' start=2026-10-12 end=2026-10-24 [release_day] 'Release day: minor release - 4.94.0' start=2026-10-23 end=2026-10-24 [develop ] 'Develop (next release - 4.96.0)' start=2026-11-02 end=2026-11-21 [rc ] 'Release candidate (next release - 4.95.0)' start=2026-11-02 end=2026-11-14 [release_day] 'Release day: minor release - 4.95.0' start=2026-11-13 end=2026-11-14 [develop ] 'Develop (next release - 4.97.0)' start=2026-11-23 end=2026-12-12 [rc ] 'Release candidate (next release - 4.96.0)' start=2026-11-23 end=2026-12-05 [release_day] 'Release day: minor release - 4.96.0' start=2026-12-04 end=2026-12-05 [develop ] 'Develop (next release - 4.98.0)' start=2026-12-14 end=2027-01-02 [rc ] 'Release candidate (next release - 4.97.0)' start=2026-12-14 end=2026-12-26 [release_day] 'Release day: minor release - 4.97.0' start=2026-12-25 end=2026-12-26 [rc ] 'Release candidate (next release - 4.90.0)' start=2027-01-04 end=2027-01-16 ## Proposed actions RC 4.98.0: title 'Release candidate (next release - 4.90.0)' -> 'Release candidate (next release - 4.98.0)' + CREATE Release day 4.88.0 on 2026-07-01 + CREATE RC 4.88.0 2026-06-27..2026-07-02 + CREATE Release day 4.98.0 on 2027-01-15 + CREATE Release day 4.99.0 on 2027-02-05 + CREATE RC 4.99.0 2027-02-01..2027-02-06 + CREATE Develop 4.99.0 2027-01-04..2027-01-23 + CREATE Release day 4.100.0 on 2027-02-26 + CREATE RC 4.100.0 2027-02-22..2027-02-27 + CREATE Develop 4.100.0 2027-01-25..2027-02-13 + CREATE Release day 4.101.0 on 2027-03-19 + CREATE RC 4.101.0 2027-03-15..2027-03-20 + CREATE Develop 4.101.0 2027-02-15..2027-03-06 + CREATE Release day 4.102.0 on 2027-04-09 + CREATE RC 4.102.0 2027-04-05..2027-04-10 + CREATE Develop 4.102.0 2027-03-08..2027-03-27 ## Warnings / skipped ! Develop event 'Develop (next release - 4.87.0)' ending 2026-06-05 has no matching minor milestone — skipped ! RC event 'Release candidate (next release - 4.87.0)' ending 2026-06-19 has no matching milestone — skipped ! Release day event 'Release day: minor release - 4.87.0' on 2026-06-19 has no matching milestone (within 5d) — skipped ! Skipping Develop create for 4.88.0: sprint ended 2026-06-17 (past) Total: 1 rename, 0 move, 15 create, 4 warning Applying 16 change(s)... ok: RC 4.98.0: title 'Release candidate (next release - 4.90.0)' -> 'Release candidate (next release - 4.98.0)' ok: + CREATE Release day 4.88.0 on 2026-07-01 ok: + CREATE RC 4.88.0 2026-06-27..2026-07-02 ok: + CREATE Release day 4.98.0 on 2027-01-15 ok: + CREATE Release day 4.99.0 on 2027-02-05 ok: + CREATE RC 4.99.0 2027-02-01..2027-02-06 ok: + CREATE Develop 4.99.0 2027-01-04..2027-01-23 ok: + CREATE Release day 4.100.0 on 2027-02-26 ok: + CREATE RC 4.100.0 2027-02-22..2027-02-27 ok: + CREATE Develop 4.100.0 2027-01-25..2027-02-13 ok: + CREATE Release day 4.101.0 on 2027-03-19 ok: + CREATE RC 4.101.0 2027-03-15..2027-03-20 ok: + CREATE Develop 4.101.0 2027-02-15..2027-03-06 ok: + CREATE Release day 4.102.0 on 2027-04-09 ok: + CREATE RC 4.102.0 2027-04-05..2027-04-10 ok: + CREATE Develop 4.102.0 2027-03-08..2027-03-27 ``` We can now get rid of the recurring unnamed events and just rely on this once it's merged and added to milestone updates to trigger automatically <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a release calendar synchronization tool that aligns Google Calendar events with open release milestone dates. * Supports dry-run previews and an optional apply mode to create, update, and delete events. * Categorizes and matches release-day, release-candidate, and development entries, including duplicate and stale event cleanup. * Added a manually triggered workflow to run the sync securely with configurable apply behavior. * Added support for service-account authentication and optional interactive OAuth. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: test <test@test.com> |
||
|
Magnus Jensen
|
b9136f4da5 |
Release from AB backend support (#49680)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49367 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added “Release from Apple Business” for eligible Apple hosts, including per-device success/failure reporting and activity logging. * Added a new API endpoint to trigger the action and return results for each selected host with clear error details. * Introduced authorization rules for global admins and team admins to release only within allowed scope. * **Bug Fixes** * Improved validation and error handling: rejects oversized selections, reports unknown/ineligible hosts and DEP-related failures per device, and treats assignment-cleanup failures as non-blocking. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Luke Heath
|
c27cccb767 | Handbook: continuous flow for all product groups (4.91.0) (#49500) | ||
|
Luke Heath
|
a2908f4098 |
Cherry-pick #48451: Adding changes for Fleet v4.89.0 (#49379)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA Cherry-pick of #48451 ("Adding changes for Fleet v4.89.0") from `rc-minor-fleet-v4.89.0` into `main`. This brings the v4.89.0 CHANGELOG entry and the corresponding `changes/` cleanup into main. The CHANGELOG conflict was resolved by placing the 4.89.0 section above the existing 4.88.1 section (keeping main's 4.88.1 date of Jul 10, 2026). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added vulnerability filtering by CVSS score and exploitability in Fleet Desktop. * Added default enrollment behavior for fleet-owned Apple devices. * Added additional filtering options to the Vulnerability Exposure chart. * Improved certificate template variables, including IdP values and host platform. * **Bug Fixes** * Fixed policy selection pagination, stale policy/report details, and missing-host reporting. * Corrected SSO and email links when Fleet is hosted under a URL subpath. * Improved Windows profile validation and MDM command labeling. * Fixed several display and accessibility issues, including host counts, checkbox wording, and dark-mode badges. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
82db4d5389 |
macOS & iOS/iPadOS: Rename hosts
Resolves #38806 Add an IT-admin naming convention for macOS/iOS/iPadOS hosts. An admin sets a name template (e.g. "iPad $FLEET_VAR_HOST_HARDWARE_SERIAL") under Controls > OS settings > Host names for a fleet or for "No team"; Fleet resolves it per host, delivers it via an Apple `Settings`/`DeviceName` MDM command, renames its own record on ACK, then verifies the name via osquery (macOS) or a DeviceInformation refetch (iOS/iPadOS). Clearing the template stops enforcement without renaming any host. Fleet Premium only, mirroring disk encryption. |
||
|
Lucas Manuel Rodriguez
|
1c95ad39f7 |
Update go mod in tools/upgrade (#49262)
Fixing an update of the main go.mod breaking the tool. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated internal tooling dependencies to support improved compatibility and functionality. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Carlo
|
5e2b76a3ad |
Rename setup_experience_platforms to singular comma-separated setup_experience_platform (#49245)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #43667 # Summary Renames the unreleased GitOps field `setup_experience_platforms` to singular `setup_experience_platform`, accepting a comma-separated string of `darwin`/`linux` (rejecting the `macos` alias) to match the query/policy/label `platform` convention. # Checklist for submitter - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [ ] Added/updated automated tests - [ ] QA'd all new/changed functionality manually ## New Fleet configuration settings - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Updated software setup-experience platform configuration to use a single comma-separated `setup_experience_platform` value. * Platform values are normalized for casing and whitespace, deduplicated, and validated against supported platforms. * macOS setup selections now use the canonical `darwin` value; the `macos` alias is rejected. * GitOps-generated configurations now use the updated field name and platform format. * **Bug Fixes** * Improved validation messages for invalid setup-experience platform values. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Noah Talerman
|
aba0c2dd2b | Cleanup: Remove software YAML migration tool (#48877) | ||
|
Lucas Manuel Rodriguez
|
60d8f51374 |
Move test/upgrade to tools/ to reduce security scanning noise (#49158)
Two reasons: - It's a testing/QA tool, so it should be under `tools/` - Reduce security-noise because it's just an internal tool (all findings under tools/ should be ignored). Failing dependency review expected because of the security findings in the docker Go packages. (Which can be fixed/updated when a patch is issued but without urgency because this is an internal tool.) ## Testing - [x] QA'd all new/changed functionality manually Ran: ``` cd tools/upgrade FLEET_VERSION_A=v4.87.1 FLEET_VERSION_B=v4.88.1 go test ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added an end-to-end upgrade test scenario across two Fleet versions. * Added a Docker Compose-based upgrade environment (Fleet, MySQL, Redis, osquery) with local TLS certs/keys and osquery flags. * **Tests** * Added automated Fleet readiness checks and host enrollment verification before and after upgrade. * **Chores / Security** * Updated the database upgrade test workflow and Go module tooling for the new upgrade test setup. * Adjusted secret scanning allow-rules and refreshed Go dependencies for the upgrade module. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George Karr
|
a1b764a341 |
Adding changes for Fleet v4.88.1 (#49038)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Released a new Fleet chart and application version. * Updated deployment defaults to use the latest Fleet container image. * **Tests** * Adjusted release-candidate branch expectations to match the new version. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrey Kizimenko
|
6430e6132f |
Add 4.89.0 baseline and migration loadtest results (#49168)
## Summary
Adds the **4.89.0** load test metrics artifacts, following the existing
`tools/loadtest/metrics/runs/` conventions.
### Baseline — `runs/baseline/489loadtest/`
18h run on a fresh RC instance (no data).
- `489loadtest-2026-07-10-210313Z-18h.json` / `.md`
### Migration — `runs/migration/487to489mig/`
4.87 → 4.89 migration, before vs. after.
- `487to489mig-2026-07-10-162812Z-1h.{json,md}` — pre-migration (1h
window)
- `487to489mig-2026-07-10-192738Z-130m.{json,md}` — post-migration (130m
window)
## Results
| Run | Fleet errors | ALB 5xx | Abnormal stops | Threshold checks |
|-----|:---:|:---:|:---:|---|
| Baseline (18h) | 0 | 0 | 0 | RDS Writer Deadlocks avg 0.13
(occasional, retried) |
| Migration pre (1h) | 0 | 0 | 0 | ✅ all within thresholds |
| Migration post (130m) | 0 | 0 | 0 | RDS Writer Deadlocks avg 0.08
(occasional, retried) |
The only flag is a near-zero average of occasional RDS writer deadlocks
(MySQL retries these); everything else is within expected range and
holds steady across the migration. Full per-metric comparison
(`compare-metrics.sh`) is posted on the release QA issue.
Data only — no code changes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added baseline and migration load-test performance reports.
* Included infrastructure, database, Redis, load balancer, network,
container health, error, and SQL performance metrics.
* Added reports covering multiple test durations and migration intervals
for improved performance analysis.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Carlo
|
6cfc4a3611 |
Add GitOps support for macOS script-only packages in setup experience (#49089)
**Related issue:** Resolves #43667 # Summary Adds a `setup_experience_platforms` field to the GitOps software package spec so `.sh` script-only installers can be selected for macOS setup experience declaratively. Reconciles the cross-platform selection table on every batch apply. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added declarative `setup_experience_platforms` to software package definitions to control “setup experience” targets, including selecting script-only installers for macOS (mapped appropriately). * Batch uploads now propagate these cross-platform selections and reconcile installer cross-entries. * **Bug Fixes** * Improved platform normalization (trimming, casing, alias mapping), deduplication, and extension-specific validation. * Enhanced update behavior: omitting the field leaves existing selections unchanged; providing an empty list clears them, with correct setup/installation timing. * **Tests** * Added unit and integration coverage for normalization and batch re-apply/reconcile behavior (nil vs empty, idempotency, mixed updates, and validation failures). <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
790f457bf0 |
SAAD: GitOps for DDM assets (#49046)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48570 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. Added in a previous PR - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added end-to-end Apple DDM asset support in GitOps, including export and GitOps parsing for `macOS settings` assets. * Introduced Apple DDM asset management APIs (list/get/download/create/delete) plus a batch set operation with dry-run. * **Bug Fixes** * Improved Apple MDM/DDM reconciliation so referenced asset updates trigger re-delivery via asset-aware tokening. * Added safer validation around asset type changes and deletion conflicts when assets are still referenced. * **Tests** * Expanded unit and integration coverage for asset parsing, upload/apply behavior, reconciliation, and access control. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George Karr
|
55c1783900 |
dibble: download seed installer fixtures at runtime instead of embedding (#48823)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA — resolves high-severity code-scanning alerts in `tools/dibble` ## Problem The dibble seeder committed 14 installer fixtures under `tools/dibble/pkg/seed/data/installers/` and bundled them into the binary with `//go:embed`. The `.exe`/`.msi`/`.deb`/`.rpm` files tripped **8 high-severity "Binary-Artifacts" code-scanning alerts** on `main`. 11 of the 14 are byte-identical to fixtures already in `server/service/testdata/software-installers/`, but `go:embed` can't reference files outside the package (no `..`, no symlinks), so the copies couldn't simply point at the originals. ## Change Replace the embed with an on-demand fetch that runs **only when seeding software** (`SoftwareCustom`): - Fixtures are downloaded, **SHA-256 verified** against a pinned manifest, and cached under the user cache dir (`os.UserCacheDir()/dibble/installers`) so repeat runs stay offline. - Fixtures shared with Fleet's tests are pulled from `testdata` via `raw.githubusercontent.com` at a **pinned commit**; the 7-Zip and python-manager installers come from their **upstream URLs**. - No binaries remain committed in this module. Checksums for all sources were verified to match the previously-committed bytes exactly, and the download + verify + cache path was smoke-tested locally. ## Tradeoff `dibble software custom` now requires network access on first use (downloads are cached afterward). This only affects the software-seeding path; all other seeders are unchanged. # Checklist for submitter - [x] Input data is properly validated (downloaded fixtures are rejected unless their SHA-256 matches the pinned manifest), `SELECT *` is avoided, SQL injection is prevented, JS inline code is prevented, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops (HTTP client uses a 2-minute timeout; no retry loop). ## Testing - [x] QA'd all new/changed functionality manually (verified download, checksum verification, and cache reuse for testdata- and upstream-hosted fixtures) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Installer fixtures are now downloaded on demand and cached locally for faster repeat runs. * Expanded installer fixture coverage, including additional Windows-signed installers for improved platform support. * **Bug Fixes** * Added SHA-256 integrity verification for cached and newly downloaded installer fixtures. * Improved reliability and safety by re-downloading when cache contents don’t match and by writing downloads atomically to avoid partial files. * **Chores** * Updated indirect dependency versions related to OpenTelemetry and `golang.org/x/*`. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
a33481653d |
macos password sync feature branch (#47422)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45524 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Apple Platform SSO (PSSO) for macOS with device registration, sign-in, and public discovery (JWKS + Apple app-site association) protected by single-use nonces. * Added Apple account provisioning (Platform SSO password sync) configuration with masked client-secret handling and GitOps support. * Added a host-scoped PSSO device registration token variable for Apple MDM profile generation. * **Bug Fixes** * Fixed macOS packaging to correctly build, embed, and sign the Platform SSO extension. * Resetting device Apple MDM data now also clears stored PSSO enrollment records. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Magnus Jensen <magnus@fleetdm.com> |
||
|
Lucas Manuel Rodriguez
|
21c024313a |
Upgrade nfpm package in fleetctl (#48961)
Resolves #48954. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] QA'd all new/changed functionality manually Tested a package generated with new `fleetctl` on Fedora 43, Ubuntu 25.04, and Omarchy. ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary of changes * **Bug Fixes** * Improved Linux RPM packaging consistency, including more reliable output filename normalization and correct platform metadata. * Ensured RPM metadata extraction stays aligned with the updated packaging flow. * **Tests** * Added coverage for RPM filename normalization edge cases. * Updated a CPE rule validation test expectation to match the new error-string format. * **Chores** * Upgraded packaging tooling and refreshed Go dependencies. * **Security** * Removed a previously ignored CVE entry from vulnerability scan ignore settings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
56763d13c1 |
Move fleet-mcp from tools/ to cmd/ (#49044)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #43544. Moves `fleet-mcp` from `tools/fleet-mcp/` to `cmd/fleet-mcp/`. It is becoming a production server used by customers, so it now lives under `cmd/` alongside the other Fleet binaries. Per the module strategy chosen for this move, it **remains a standalone Go module** (keeps its own `go.mod`/`go.sum` and isolated deps such as `mark3labs/mcp-go`, `logrus`, `gorilla/websocket`, `godotenv`) — the root `github.com/fleetdm/fleet/v4` module is unchanged. ### What changed - `git mv tools/fleet-mcp/ → cmd/fleet-mcp/` (history preserved as renames). - Updated all path references: - Root `Makefile` `update-go` module list. - `.github/workflows/test-fleet-mcp.yml` — trigger paths, `go-version-file`, `working-directory`. - `.github/dependabot.yml` — gomod directory. - `cmd/fleet-mcp/render.yaml` — `rootDir`. - `cmd/fleet-mcp/README.md`, `Makefile`, `schema.go` — path comments/links. - `articles/fleet-mcp.md` — README link. - Removed the `fleet-mcp/` row from `tools/README.md`. ### Follow-up (not in this PR) - The Render service's Blueprint file path must be updated from `tools/fleet-mcp/render.yaml` to `cmd/fleet-mcp/render.yaml` in the Render dashboard. ## Testing - `go build .` in `cmd/fleet-mcp` — OK - `go test -race -count=1 ./...` — `ok fleet-mcp` - [x] QA'd all new/changed functionality manually |
||
|
Lucas Manuel Rodriguez
|
703dcf0b4f |
Update go to 1.26.5 (#48993)
Resolves #48988. I ran `make update-go version=1.26.5`. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] QA'd all new/changed functionality manually Fleet: <img width="301" height="102" alt="Screenshot 2026-07-09 at 8 41 49 AM" src="https://github.com/user-attachments/assets/baf76ce7-6192-4506-a9db-52f5318939ee" /> fleetctl: ``` fleetctl --version fleetctl - version orbit-v1.57.0-402-ge3d0c005dc branch: 48988-update-go-1.26.5 revision: e3d0c005dc6698c024ad47a124c99e4f264855a0 build date: 2026-07-09 build user: lucas go version: go1.26.5 ``` Also verified orbit in Linux: <img width="582" height="121" alt="Screenshot 2026-07-09 at 8 51 55 AM" src="https://github.com/user-attachments/assets/65672676-8010-45a1-8c28-9f9959e72134" /> ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the project and all included tooling modules to Go 1.26.5. * Refreshed build images used by desktop Linux, load testing, and related utilities to the newer Go toolchain. * Updated change log entries to reflect the Go version bump. * **Bug Fixes** * Improved the automation that refreshes Go-pinned Docker image references to resolve and apply correct digests, helping prevent broken build images. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
5b2a1b9de0 |
fleet-mcp: use /fleets endpoints instead of legacy /teams (#48791)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Relates to #43544 The Fleet MCP calls the legacy `/api/v1/fleet/teams` routes for fleet and policy lookups. Fleet's current API endpoints catalog only lists the renamed `/fleets` routes, so an endpoint-restricted api-only user cannot be granted `/teams` and those calls return 403. This switches the MCP to the `/fleets` paths, which return the same response shape, so fleet resolution and per-fleet policy compliance work under a least-privilege token. Verified against a running Fleet. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Team-related Fleet data now loads from the correct service endpoints, improving policy and compliance views. * Policy listings and policy detail checks for teams should now return the expected results. * Updated test coverage to match the revised Fleet route behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George Karr
|
af51636bda |
tools: bump x/net and x/crypto to clear high-severity CVE alerts (#48822)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA — resolves high-severity code-scanning alerts in `tools/` Bumps the outdated `golang.org/x/net` and `golang.org/x/crypto` indirect dependencies in the four `tools/` Go modules to clear 39 high-severity code-scanning (SCA) alerts on `main`. Target versions match the root Fleet module. | Module | x/net | x/crypto | | --- | --- | --- | | `tools/dibble` | v0.53.0 → **v0.55.0** | v0.50.0 → **v0.52.0** | | `tools/hangar` | v0.53.0 → **v0.55.0** | v0.50.0 → **v0.52.0** | | `tools/terraform` | v0.48.0 → **v0.55.0** | v0.46.0 → **v0.52.0** | | `tools/github-manage` | v0.38.0 → **v0.55.0** | — | CVEs cleared: - **x/net v0.55.0**: CVE-2026-25681, -27136, -33814, -39821, -42502 - **x/crypto v0.52.0**: CVE-2026-39827, -39828, -39829, -39830, -39832, -39835, -42508, -46595, -46597 All four modules `go mod verify` clean and build. Dependency-only change to internal dev tooling — no product code, no user-visible behavior. > The remaining 8 high-severity alerts in `tools/` are OpenSSF Scorecard > "Binary-Artifacts" findings for embedded dibble seed installers; those are > tracked separately and not addressed here. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated several bundled Go dependencies across internal tooling to newer versions. * This includes refreshes to common networking, cryptography, text, and system packages, plus one added telemetry-related dependency. * No user-facing features or behavior changes were introduced. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
a979c86bbe |
Fix dibble build (#48747)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48746 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Added a CI workflow to run build and race-enabled tests for dibble changes. * Included a dependency consistency check to ensure dibble’s Go module files stay tidy. * Configured CI concurrency to cancel in-progress runs for newer changes. * Updated dibble’s Go dependencies (indirect) to newer versions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
1c1fae8e93 |
Add CachyOS support (part 2/2) (#48688)
**Related issue:** Fully resolves https://github.com/fleetdm/fleet/issues/34591. ## Testing - [X] QA'd all new/changed functionality manually. <img width="533" height="454" alt="Screenshot 2026-07-03 at 10 40 37 AM" src="https://github.com/user-attachments/assets/892fb548-21c6-467c-b270-65f1c9338fdc" /> <img width="1287" height="259" alt="Screenshot 2026-07-03 at 10 41 55 AM" src="https://github.com/user-attachments/assets/d3528b0c-0d05-4ace-8512-ab363241b97c" /> <img width="1077" height="123" alt="Screenshot 2026-07-03 at 10 41 46 AM" src="https://github.com/user-attachments/assets/249e80de-320c-48f3-962a-59c98c736c54" /> <img width="725" height="208" alt="Screenshot 2026-07-03 at 10 41 32 AM" src="https://github.com/user-attachments/assets/361764cf-26fc-4a44-b5d6-489d883a392b" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added CachyOS Linux to rolling-release OS detection and reporting. * Added a CachyOS fleetd package/image variant and a new CachyOS fleetd service for local testing. * **Bug Fixes** * Improved rolling-release OS version labeling for host “Vitals” display. * Updated OS inventory normalization so CachyOS is aggregated with Arch Linux, including correct “rolling” version handling. * **Tests** * Expanded OS version ingest test coverage for rolling-release and CachyOS scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joaquínandnulmete
|
8c544ea826 |
[fix-no-Query-field] fleet-mcp: expose policy SQL in get_policies response (#45513)
## Summary
The `get_policies` MCP tool wasn't returning each policy's osquery SQL,
making it impossible to diagnose policy behavior via MCP — you had to
fall back to `curl` against `GET /api/v1/fleet/global/policies/{id}` to
read the `query` field.
Root cause: the `Policy` struct in
`tools/fleet-mcp/fleet_integration.go` didn't declare a `Query` field,
so Go's JSON decoder silently dropped the key from the Fleet API
response. One-line fix on the struct; the same struct backs both the
global path and the per-team fan-out, so both are covered.
Purely additive — no existing field changes shape, name, or type.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Fleet policies now include a query field so the actual policy
query/SQL content is available with policy metadata.
* **Tests**
* Added integration-style test coverage to confirm the query field is
parsed and returned (including empty queries) and that policy responses
contain the expected entries.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45513)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: nulmete <nicoulmete1@gmail.com>
|
||
|
George Karr
|
73b0485607 | Adding changes for Fleet v4.88.0 (#48446) | ||
|
Lucas Manuel Rodriguez
|
c4a66e6303 |
Update osquery schema and flags to 5.23.1 (#48587)
osquery [5.23.1](https://github.com/osquery/osquery/releases/tag/5.23.1) was released by osquery publicly today, this updates our schema with the changes in it. - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Updated schema support for certificate `subject2` and `issuer2` fields on Linux and macOS. * Documentation generation and download tooling now target osquery `5.23.1`. * **Bug Fixes** * Clarified the `process_open_handles` table behavior by removing outdated default-process wording. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
892363628c |
fix(fleet-mcp): teams filter + policy SQL retrieval (#45542)
Relates to #43544 Resolves #45901 Relates to #45902 (repo hygiene specifically) ## Summary Fixes two production bugs in `tools/fleet-mcp` surfaced via dogfood usage, plus mirrors PR #45513 so the policy-SQL field is available on this branch. ### Bug A — `fleet=<team>` filter silently dropped on platform/label calls `get_endpoints fleet=Workstations platform=windows` returned hosts from every team. Fleet upstream `/api/v1/fleet/labels/:id/hosts` accepts `?team_id=` but discards it: `applyHostLabelFilters` in `server/datastore/mysql/labels.go` reads the RBAC `filter.TeamID`, never `opt.TeamFilter` parsed from the URL. The MCP now intersects label-path results client-side by `host.TeamID` via the new `filterEndpointsByTeamID` helper so the caller's `fleet=` scope is actually applied. Operational-quirk comment updated to match real upstream behavior. ### Bug B — `Total` field showed global count regardless of filters `get_endpoints fleet=Workstations` reported `Total: <global>` even though the returned slice was correctly team-scoped — `GetHostCount` accepts no filters. New `GetHostCountWithFilters` mirrors the listing path's filter dimensions through a shared `buildHostListParams` helper so list + count stay in lockstep: - No label/platform → `/hosts/count?team_id=…&status=…&query=…&policy_id=…&policy_response=…` (Fleet's count endpoint honors these). - Label/platform → reuses the listing fan-out's client-side team intersection (the count endpoint has the same upstream `team_id` bug when `label_id` is set). `mcp_tools_hosts.go` `get_endpoints` handler branches on `anyFilter` and calls the filtered count when any filter dimension is supplied. ### Policy SQL retrieval (mirror of #45513) The `Policy` struct lacked a `Query` field, so Go's JSON decoder silently dropped the `query` key from `/api/v1/fleet/global/policies`. One-line addition; same struct backs both the global path and the per-team fan-out. ### Repo hygiene - Sanitized environment-specific values throughout the package (README, tool descriptions, attribution comments): dogfood URL → `your-fleet.example.com`; team examples drop emoji prefixes; specific real CVE IDs swapped for placeholders; `vetted_queries.go` source attribution now references CIS-8.1 benchmarks instead of a personal-handle GitHub fork; canonical repo link points at `fleetdm/fleet/tree/main/tools/fleet-mcp`. - Re-vendored `osquery_fleet_schema.json` via the `//go:generate` directive so the embedded snapshot matches the canonical monorepo copy. - Deleted `fleet_integration_test.go` and `rate_limit_test.go` per repo policy: production package ships no `_test.go` files. ## Test plan - [x] `go build ./...` clean - [x] `go vet ./...` clean - [x] `gofmt -l .` empty - [x] Manual smoke via Claude Desktop stdio: `get_endpoints fleet=<team>` returns `Total == Returned == team's actual host count` (no longer global) - [x] Manual smoke: `get_endpoints fleet=<team> platform=windows` returns hosts whose `team_id` all match the requested fleet (no longer all-team Windows) - [x] Manual smoke: `get_policies` response contains a non-empty `query` field for each policy <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added new osquery tables for system monitoring: Adobe plugins, open handles, secure boot certificates, and YARA events. * Added host-count and endpoint counting scoped by filters (team, platform, status, query, label, and policy). * **Improvements** * Enhanced host filtering behavior to correctly apply filter scope when computing totals. * Improved label-based host listing responses by optionally populating per-host label details. * Updated tool and schema descriptions/examples for clearer query and CVE guidance. * **Tests** * Extended coverage for policy-filtered label host listing and related behaviors. <!-- end of auto-generated comment: release notes by coderabbit.ai --> @nulmete: - [x] QA'd all new/changed functionality manually --------- Co-authored-by: Luke Heath <luke@fleetdm.com> Co-authored-by: nulmete <nicoulmete1@gmail.com> |
||
|
George Karr
|
92c4e28647 |
Include new tools in update-go and fix dibble (#48461)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the project’s Go version settings to keep tooling in sync across all relevant components. * Running the standard Go update workflow will now apply version updates to an additional part of the codebase. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George Karr
|
4049838dbd |
Adding PR check skip for minor releases, QA issue create, switch version change to perl to support macOS (#48459)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved release preparation and publishing reliability, including more consistent version updates and chart version bumps. * Streamlined milestone cleanup so release tracking issues are closed more predictably. * **Chores** * Added a faster path to create a QA issue during release workflows. * Refined cherry-pick handling for release candidates to better track remaining work. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
a4086dcec0 |
feat(fleet-mcp): add inventory tools (get_software, get_host_users) (#48092)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #47931, Relates to #43544 This PR brings the fleet-mcp inventory tools into Fleet: `get_software` (per-host and cross-host) and `get_host_users`. These were introduced in @karmine05 's repo but were not present in Fleet: - https://github.com/karmine05/fleet-mcp/commit/64d60b7fcdd75e3722d77d269845edc8826b88c6 - https://github.com/karmine05/fleet-mcp/commit/fb753e61e77d65d3b54466ec69e33306e0d6e065 Added on top: a `platform` requires `fleet` guard (Fleet's `/software/titles` rejects `platform` without `team_id`, found via live testing), unit tests for the arg guards and resolvers. # Checklist for submitter - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually `get_host_users` calls: <img width="631" height="882" alt="get_hosts_1" src="https://github.com/user-attachments/assets/36999f93-3276-49c6-9c25-83f67c4b288a" /> <img width="742" height="769" alt="get_hosts_2" src="https://github.com/user-attachments/assets/822b415d-7d61-43b8-a310-a6a6cd22dc27" /> <img width="700" height="892" alt="get_hosts_3" src="https://github.com/user-attachments/assets/d2fde072-bb93-466b-9c1b-07df7e5eb137" /> `get_software` <img width="837" height="1346" alt="Screenshot 2026-06-24 at 11 48 08 AM" src="https://github.com/user-attachments/assets/8c50dade-9d66-4b05-a733-d70a6633e1ba" /> `get_host_policies` (re-tested after the refactoring on this PR) <img width="1432" height="920" alt="Screenshot 2026-06-24 at 11 49 37 AM" src="https://github.com/user-attachments/assets/22e91dff-0ded-4d9e-9488-b6e0f605b5a2" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added software inventory lookup with filtering by source, platform, and vulnerability status. * Added host user data retrieval with optional filtering. * Implemented pagination support for large inventory result sets. * Added host resolution and ambiguity detection for user queries. * Truncation indicators for capped result sets. * **Tests** * Comprehensive integration test coverage for inventory lookups and pagination behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George KarrandCopilot Autofix powered by AI
|
ddbcceb42c |
Adding changes for Fleet v4.87.1 (#48291)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Bumped Fleet to version **v4.87.1** across Helm, Terraform, and the npm package. * Updated deployment image tags so environments using the chart or infrastructure defaults will pick up the new release. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Nico
|
d671cbef99 |
fix(fleet-mcp): security hardening for the MCP server (#47908)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Relates to #43544 Security review + hardening of the experimental Fleet MCP server. Issues were reproduced against a live dev Fleet; this PR fixes the MCP-layer ones. | Finding | Before → After | Where | |---|---|---| | **A** least privilege | No signal about the token's power → startup `/me` check **refuses any non-API-only token** (fails closed if unreachable). API-only users can be scoped to specific endpoints/teams and their token revoked. Who-can-do-what is documented (Fleet RBAC), not inferred at runtime. | `main.go` `requireAPIOnlyUser`; `fleet_integration.go` `WhoAmI` | | **B** rate-limit XFF bypass | Per-IP keyed on spoofable `X-Forwarded-For` → Removed rate-limiting (assuming Fleet handles this). | N/A | | **C** token egress / SSRF | `FLEET_BASE_URL` unchecked → This is configured at deployment time and not per-request, so no action is taken. | N/A | | **D** error-body leak | Raw Fleet JSON (incl. internal `uuid`) → trimmed, e.g. `Fleet API returned HTTP 409: Resource Already Exists`. | `fleet_integration.go` `fleetErrMsg` | | **E** dead code / docs / tests | Removed dead `GetFleetConfig`; README 18→19 / 16→17; added validator/role tests. | `fleet_integration.go`, `README.md`, `*_test.go` | | **F** writes auto-runnable | Only the advisory `destructive=true` annotation → `fleetMCPInstructions` now tells the client to show the SQL + targets and confirm before running `run_live_query`. **Advisory, not a server control.** | `mcp_server.go` | | **G** abrupt SIGTERM shutdown | `ListenAndServe` blocked with no signal handling → on SIGTERM the process was killed immediately (**exit 143**), resetting any in-flight connection at once. Now a signal-aware root context (`signal.NotifyContext`) drains in-flight requests via `http.Server.Shutdown` (10s cap), logs `shutting down`, and **exits 0** — and the startup `/me` check + temp-query sweep + stdio loop all honor it. Matters for Render redeploys (SIGTERM). | `main.go` | ### Key decisions - **Rate limit: removed**: assuming Fleet server handles this. - **`fleetMCPInstructions` / `destructive=true` are advisory** — a prompt-injected or raw client ignores them. The enforceable controls are the token role and `--disable_tables` flag. Added an explicit confirm-before-run instruction for `run_live_query` to `fleetMCPInstructions` as a cross-client complement to the `destructiveHint=true` annotation -- the annotation only prompts on clients that honor it, whereas the instruction reaches any client that forwards server instructions to the model (and raw JSON-RPC callers that have no approval UI at all). Both are advisory; the real bound on writes remains the `FLEET_API_KEY`'s Fleet role. - **Device-side `curl`/`carves` exfil is a Fleet/osquery capability**, equally reachable via the UI/`fleetctl`/REST — not an MCP bug. Comprehensive fix is agent `--disable_tables` (separate Fleet-server/agent issue). ### Residual attack surface (re: *"no new attack vectors"*) None of these is a vector the MCP invents beyond what Fleet already exposes: | Config choice | Residual vector | Mitigation | |---|---|---| | Non-API-only / admin token | Leak = arbitrary osquery everywhere | API-only **required** (refuses to start otherwise); use **observer** for read-only. As an API-only user it can also be **scoped to specific endpoints/teams** and its **token revoked** on leak — neither possible with a UI session token. | | `run_live_query` via an auto-approving / prompt-injected client | Arbitrary osquery on currently-online hosts - read/exfil-capable (`curl`, `curl_certificate`, `file`, `carves`). No data mutation. | Non-advisory: `FLEET_API_KEY` role - **observer-plus** needed to run live queries. A "read-only" deployment (**observer** token) removes the vector entirely; plus agent-side `--disable-tables` to drop exfil tables. Advisory: `destructiveHint=true` + confirm-before-run instruction (F) - an auto-approving client ignores these. | | Live query at all | `curl`/`carves`/`file` device SSRF + exfil | Agent `--disable_tables` (separate issue) — not an MCP-layer fix | | Public SSE, no edge | Unauth flood `429`s operators (shared bucket — fails safe) | We assume Fleet server handles rate-limiting. | **Bottom line:** with an API-only observer/+ token (now enforced) over stdio, `ip` mode, or SSE-behind-an-edge, the MCP adds no new attack vector beyond Fleet's existing live-query capability; the residual `curl`/`carves` risk is a Fleet-layer concern tracked separately. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Startup now verifies the Fleet API key belongs to an **API-only** Fleet user * Added `/healthz` endpoint * Hardened Fleet base URL validation to prevent token leakage to unsafe hosts * Improved rate limiting behavior (429 includes `Retry-After: 1`; per-IP uses the direct client address host) * Signal-driven graceful shutdown and stricter `MCP_AUTH_TOKEN` length checks * More robust schema fetching by blocking cross-host and overly long redirect chains * **Documentation** * Expanded/clarified write-operation guidance and confirmation requirements * **Chores / Tests** * Updated `.env` docs/ignores, added developer Makefile helpers, and refreshed Fleet base URL tests <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
9f3f198e08 |
Google Workspace IdP: QA/load-test tooling (fake Admin SDK server) (#48208)
## Summary **QA / load-test tooling** for the Google Workspace IdP integration — lets QA exercise the real sync path at scale without a Google Workspace tenant. - **`tools/gw-directory-fake`** — a standalone fake of the Google Admin SDK Directory API (not production code): - `generate` — writes an editable JSON fixture (`-users`, `-groups`, `-members-per-group`, `-domain`). - `serve` — serves users/groups/members with real pagination from the fixture, **hot-reloading** the file on change (poll modtime), plus `-latency` / `-error-rate` (429/503) knobs. Responses are built from the real `directory` SDK structs so the schema can't drift. - **Fleet-side seam** (`ee/server/googleworkspace/google_workspace.go`): - honors `token_uri` from the service-account JSON (falls back to Google's endpoint), - `FLEET_TEST_GOOGLE_WORKSPACE_ENDPOINT` redirects the Directory API base to the fake (logs a warning each sync; never set in production), - `seam_test.go` proves the loop end to end (JWT token exchange + paginated Directory calls against a local fake over plain HTTP). ### QA workflow ``` go run ./tools/gw-directory-fake generate -users 50000 -groups 2000 -domain qa.example.com -out fixture.json go run ./tools/gw-directory-fake serve -fixture fixture.json -addr :8091 ``` Set `FLEET_TEST_GOOGLE_WORKSPACE_ENDPOINT=http://<host>:8091` on Fleet and configure the integration with a throwaway service-account JSON whose `token_uri` is `http://<host>:8091/token`. Edit `fixture.json` anytime to change directory state mid-test. > 🥞 **Stacked PR.** Base: `42915-gw-idp-vitals-5-frontend` (top of the feature code stack, #48168). **Related issue:** Resolves #42915 # Checklist for submitter - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [ ] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Google Workspace directory access now supports custom OAuth token endpoints and a configurable API base endpoint for testing and special environments. * Added a local fake Google Workspace Directory server tool for generating sample data and serving directory responses, including pagination and optional fault injection. * **Bug Fixes** * Improved handling for Google Workspace API calls when alternate endpoints are required. * **Tests** * Added coverage for overriding the Google Workspace directory endpoint. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Robert FairburnandCopilot Autofix powered by AI
|
8e80e976bf |
fix mdmproxy build by reverting back to previous but not filtering tags (#48264)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the container build process for the migration proxy so the binary is built during image creation. * Adjusted the runtime image packaging to copy the generated executable from the build output location while keeping runtime behavior unchanged. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Lucas Manuel Rodriguez
|
ef0a051482 |
Google Workspace IdP [2/6]: backend (cron + directory sync) (#48165)
### 🥞 Stack (review/merge bottom-up) 1. #48164 — Activity types (FE+BE) 2. **#48165 — Backend (cron + directory sync) ⬅ this PR** 3. #48166 — Usage statistics 4. #48167 — fleetctl generate-gitops 5. #48168 — Settings UI 📄 Documentation is tracked separately in #48169 (targets `docs-v4.89.0`). --- ## Summary **PR 2 of 6.** Core **backend** for the Google Workspace IdP integration: - Directory sync client (`ee/server/googleworkspace/`) and cron job (`server/cron/google_workspace_cron.go`) reusing the `scim_*` tables (Google Workspace and SCIM are mutually exclusive). - Config types + validation (`server/fleet/google_workspace.go`, `app.go`, `integrations.go`), appconfig handling + activity emission (`server/service/appconfig.go`), cron registration and schedule. - SCIM is ignored while Google Workspace is configured (`ee/server/scim/scim.go`). > 🥞 **Stacked PR.** Base: `42915-gw-idp-vitals-1-activities` (PR 1) — review/merge that first. **Related issue:** Resolves #42915 # Checklist for submitter - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements). - [ ] Timeouts are implemented and retries are limited to avoid infinite loops. ## Testing - [ ] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Google Workspace integration support for syncing users, groups, and host-related identity data. * Added a scheduled sync that keeps directory data up to date automatically. * Added support for configuring Google Workspace in app settings, with validation and masking of sensitive credentials. * **Bug Fixes** * Prevented SCIM provisioning from overwriting data when Google Workspace sync is configured. * Preserved existing Google Workspace credentials when an update omits masked API key values. * Added handling for deleted users and group membership changes during sync. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
005bcdcf87 |
fleet-mcp: run multi-host live queries via ad-hoc campaign so observer_plus works
Resolves #46005 Implement flow for ad-hoc distributed query campaign streamed over the /api/v1/fleet/results/websocket endpoint, the same way the Fleet UI and fleetctl run live queries. |
||
|
Dante Catalfamo
|
1b64b6104a |
Fix NDES not using the same retry clearing method as SmallStep for macos (#48105)
**Related issue:** Resolves #46291 |
||
|
dependabot[bot]
|
8ae024ec41 | Bump tar from 7.5.11 to 7.5.16 in /tools/fleetctl-npm (#47759) | ||
|
Luke Heath
|
7eca15c8f6 | Upgrade OpenSSL in mdmproxy image to clear CVE-2026-34182 (#48209) | ||
|
Scott Gress
|
997a4097c4 | Add docs for chart bounded context (#47877) | ||
|
Scott Gress
|
82f7405f19 | Allow setting default vuln chart filters via GitOps (#47634) | ||
|
Andrey Kizimenko
|
a13cd2c373 |
Remove dead Wails-template scaffolding from tools/hangar (#48126)
**Related issue:** N/A — follow-up cleanup to #46406 (Add Hangar). ## What & why Fleet Hangar is a macOS-only, GUI-only dev tool built natively, but the Wails v3 project template left behind config for modes/platforms it never uses. None of it was referenced by CI, scripts, or the documented build flow (`dev` / `build` / `package` / `dist` / `sign`). Removed: - **Server-mode + Docker tasks** (`build:server`, `run:server`, `build:docker`, `run:docker`, `setup:docker`) in the root and common Taskfiles. They point at `build/docker/Dockerfile.{server,cross}`, which don't exist, and there is no `server` build tag anywhere in the Go code. - **Docker cross-compilation** in `build/darwin` (`build:docker`, `CROSS_IMAGE`, the `build:universal` `lipo:go` fallback). `build:` and `build:universal` now call the native macOS paths directly. - **iOS tasks** (`ios:device:list`, `ios:run:device`) — no iOS project exists. - **`frontend:vendor:puppertino`** — fetched CSS into `frontend/public/puppertino` and rewrote `index.html`; none of those targets exist and no task called it. - **`.gitignore`** lines for `build/linux` and `build/windows` (neither dir exists). - **`config.yml`** template placeholders (commented `ios` / `fileAssociations` blocks, the `My Other Data` `other` entry). The darwin signing vars (`SIGN_IDENTITY`, `KEYCHAIN_PROFILE`, `ENTITLEMENTS`) are now declared as empty strings instead of comments, so removing `CROSS_IMAGE` doesn't leave `vars:` as a null mapping (which the Taskfile schema rejects). Behavior is unchanged — the `sign:` preconditions still guard on non-empty values. Net: **11 insertions, 280 deletions** across 5 files. No change to the real build flow. ## Testing - Verified with `task build` — exit 0, produces `bin/fleet-hangar` (arm64 Mach-O). - `task --list-all` parses all three Taskfiles with no schema errors and no dangling task references. ## Checklist - [x] QA'd manually (`task build`) No changes file: `tools/hangar` is an internal dev tool, so this is not a user-visible change. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Simplified build configuration by removing Puppertino CSS integration and server/Docker/iOS build tasks. * Updated development task with improved process management to prevent orphaned processes. * Streamlined macOS build process to native-only implementation, removing cross-compilation support. * Cleaned up build configuration files and project ignore patterns. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrey KizimenkoandGeorge Karr
|
0f9af89a93 |
Add Hangar: Go/Wails desktop control panel for the Fleet dev environment (#46406)
## Summary Adds `tools/hangar` — a macOS desktop control panel for working on Fleet locally: branch management, `fleet serve` orchestration, log tail, dev MySQL backup/restore, `fleetctl`, GitOps, and `osquery-perf`, all in one window. Built with **Go + [Wails 3](https://v3alpha.wails.io)** — the backend is plain Go (`os/exec`, `syscall`, goroutines) so Fleet engineers can contribute to it; only the desktop shell is Wails. The `internal/` packages are pure and unit-tested. ### History note Hangar started as a Rust/Tauri app. It was ported to Go, and **the Go port is now the canonical `tools/hangar`**. The original Rust/Tauri implementation has been removed from the monorepo (preserved in a standalone repo) — so although this branch's earlier commits add and then replace the Rust app, the net diff is just the Go app at `tools/hangar`. The bundle identifier is `com.fleetdm.fleet-hangar`, matching the original app so existing settings carry over. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops > No `changes/` file: `tools/` is contributor tooling, not a user-visible Fleet change. No DB migrations, no Fleet config settings, no fleetd/orbit changes. ## Testing - [x] Added/updated automated tests (Go unit tests across `internal/`, including a path-traversal regression for backup deletion) - [x] QA'd all new/changed functionality manually ## Test plan - [x] `cd tools/hangar && task dev` launches the app (live-reload) - [x] `task build` produces `bin/fleet-hangar`; `go test ./...` is green - [x] First-run gate discovers a local Fleet clone and runs dep checks - [x] Server tab can run the build chain and start `fleet serve` - [x] Git tab branch search finds an older branch (e.g. a stale `qa-*`) by name <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Introduced Fleet Hangar, a comprehensive desktop application for Fleet development workflows, providing unified controls for server/database management, git operations, configuration, logging, and troubleshooting. * Added database backup management with metadata tracking. * Integrated process orchestration for development services (Docker, ngrok, Python). <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: George Karr <georgekarrv@users.noreply.github.com> |
||
|
Steven Palmesano
|
22c732a249 |
Update build instructions (#46339)
Small updates to our build instructions that I ran into while testing. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated macOS M1 setup instructions with simplified platform configuration guidance for MySQL containers. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46339?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
dependabot[bot]
|
926ecd8f2e | Bump ws from 8.20.1 to 8.21.0 in /tools/fleet-slackbot (#47967) | ||
|
dependabot[bot]
|
a85b1d5200 | Bump js-yaml from 4.1.1 to 4.2.0 in /tools/fleet-slackbot (#47798) | ||
|
dependabot[bot]
|
4e00816216 | Bump form-data from 4.0.5 to 4.0.6 in /tools/fleet-slackbot (#47797) | ||
|
Luke Heath
|
383d20cb26 | Adding changes for Fleet v4.87.0 (#47109) (#47958) | ||
|
Scott Gress
|
c370a9672b |
Add CVE chart filtering and non-critical CVE data collection (backend) (#47470)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44746 # Details * Adds the ability to filter historical CVE data by software type, EPSS, CVSS, CVE ID (exclude only) and "has known exploit" * Hard-codes the CVSS filter to 9.0+ for now, since that's the only data that's been collected thus far * Un-gates the collection code so that it will collect CVE data for _all_ severities (but still in the restricted set of software) Related PRs [update the front-end](https://github.com/fleetdm/fleet/pull/47674) to allow sending these filters, and [update GitOps](https://github.com/fleetdm/fleet/pull/47634) to allow changing the default filters. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually ### Manual test plan — CVE chart filtering (backend smoke test) #### Setup - Premium dev server running with a few hosts carrying vulnerable software (so `cve_meta` / `software_cve` / `operating_system_vulnerabilities` are populated) - Chart data present — collector ran once, or seeded: `go run ./tools/charts-backfill --dataset cve --use-tracked-cves --days 7` - API token exported and helper set: ```bash BASE=https://localhost:8080/api/v1/fleet/charts peak() { curl -sk -H "Authorization: Bearer $TOKEN" "$BASE/$1" | jq '[.data[].value] | max'; } #### Checks (compare against the no-filter baseline) - [x] Baseline returns data — GET /charts/cve?days=7 returns a data series; .filters is empty/default - [x] Severity force-pinned to critical — cve?days=7 and cve?days=7&severity_min=0&severity_max=10 give identical peaks (no low-severity leak; client severity ignored) - [x] Category narrowing — software_categories=browsers ≤ baseline; software_categories=os,browsers,office,adobe == baseline - [x] OS category includes kernel — software_categories=os returns OS-vuln + Linux-kernel CVE counts - [x] Known-exploit narrowing — known_exploit=true ≤ baseline - [x] EPSS narrowing — epss_min=0.9 ≤ baseline; epss_min=0&epss_max=1 == baseline (EPSS is 0.0–1.0 on the API) - [x] Exclude is subtractive + tolerant — excluding a visible CVE lowers/keeps counts; exclude_cves=CVE-0000-00000 == baseline (no-op) - [x] Filters echo back — filtered requests return applied values under .filters - [x] Uptime untouched — GET /charts/uptime?days=7 returns its normal series - [x] Free-tier safety (optional) — on non-Premium, /charts/cve returns an empty series, no error - [x] > 0 rows from: SELECT COUNT(DISTINCT scd.entity_id) AS below_critical FROM host_scd_data scd JOIN cve_meta cm ON cm.cve = scd.entity_id WHERE scd.dataset='cve' AND cm.cvss_score < 9.0; - (confirms lower-severity CVEs are stored) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary of changes * **New Features** * Added advanced CVE chart request filters: software categories, known-exploit flag, EPSS min/max, severity min/max, and excluded CVEs. * Expanded CVE chart coverage to use the full “collectible” CVE set, with filtering applied when serving chart data. * **Tests** * Added coverage for collecting collectible CVEs and resolving chart entities based on filter combinations and exclusions. * **Chores** * Updated CVE chart backfill to use collectible CVE discovery. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
dependabot[bot]
|
ad4847b7da | Bump form-data from 4.0.5 to 4.0.6 in /tools/fleetctl-npm (#47761) |
