fbfcf5fd987bda5d0cfd7fed2925d6ea95b78738
4315
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Konstantin Sykulev
|
9e10c3cc22 |
Surface real error message on android enterprise connect (#46466)
**Related issue:** Resolves #45107 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Android Enterprise connection error messages now surface actual failure reasons to users instead of generic fallback text, enabling more accurate troubleshooting. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46466?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
121a6df417 |
Enable "Show example payload" buttons in GitOps mode (#46355)
We allow this already with "Preview payload" under Settings > Integrations > MDM > End user migration workflow. **Related issue:** Resolves #44719 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually |
||
|
Magnus JensenandClaude
|
b42a154cf6 |
Optimize Apple profile reconciler approach by moving logic to code (#45573)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Closes #46153 This PR is big, but I found it worth it to include in the same PR to keep the mental change context in one place. This PR moves away from our previous version of a big SQL computing the desired state and label membership with big union branches. It does so by switching the model up completely, first: - We batch read hosts (current hardcoded is 5k), and we always iterate 5k hosts and then decide if they have changes, so that means a tick (30s) could read 5k hosts that DOES NOT require changes, but that is computed in code after, rather than relying on a big SQL to do it (twice). - We then for those hosts, bulk fetch label memberships, their related team profiles and current rows. This performs much better as we can lookup everything we need by primary key or super fast indexed columns, simple fetch all these calls. - Then once gathered the information we move to the code to determine if the operation is install, remove, NO-OP (Desired state calculation), then we check the label membership to further determine it's final action. - We then move to what we did before, which is queue the correct command etc. It comes with some slight caveats, which is we now load a lot more data into memory (but before we could spike worse), so when loadtesting we watched CPU/Memory utilization, which never seemed to spike as the datasets are kept as small as possible. _Cleanup will come in a follow-up PR where we remove all the old code._ # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Performance** * Optimized Apple profile and DDM (Declarations) reconciliation engine with batched processing for significantly improved performance in environments with large numbers of Apple-enrolled hosts. * Implemented cursor-based pagination for more efficient reconciliation across large fleets. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45573?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Magnus Jensen
|
0431f52b9e |
support standard and none end user account types (#46179)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45286 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Create local admin account = true Primary account type = none End user auth required = true = No primary account setup screen shown - jumps straight to username/password login which I can login to with the password shown in the UI. Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’` only returns `_fleetadmin` **Note: EACAS is not available on this mac (or this user?)** - however it’s still possible to Wipe via MDM commands. Create local admin account = true Primary account type = standard End user auth required = true = Primary account setup screen shown (also works with IDP info being locked and populated). Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’` returns `_fleetadmin` and my end user (IDP info locked in this case) Opening Settings -> Users & Groups -> Shows my primary account as “Standard” **Note: Benefit of the user can’t do EACAS** (Prompted: “Admin user required”) __fleetadmin also can’t do EACAS_ Create local admin account = false Primary Account type = N/A (but admin) End user auth required = true = Shown primary account setup screen with IDP info populated and locked Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’` only returns my primary user Opening Settings -> Users & groups -> shows my primary account as “Admin" <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * macOS setup now supports end-user account types: `admin`, `standard`, or `none`. * Setup flows and device commands respect the selected primary account type (e.g., create regular user or skip creation). * **Validation** * Configuration now enforces that a local admin account exists/enabled when required by the chosen end-user account type. * **Tests** * Added coverage for `standard` and `none` validation and command behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46179?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin Sykulev
|
87bb4090a8 |
Android profile content checksums (#46276)
**Related issue:** Resolves #43456 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Android MDM profiles now include content checksums; devices are re-synced only when profile content changes, reducing unnecessary deliveries. * **Migrations** * Database schema updated to add and backfill checksum fields for Android configuration and host profiles. * **Tests** * Added and updated tests to validate checksum generation, backfill, and behavior in profile delivery scenarios. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46276?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon Katz
|
1ab42218a8 |
Fix GET /software/versions 422 too many placeholders without per_page (#45737)
Closes #43030 ## Summary - Batches title IDs in `getDisplayNamesByTeamAndTitleIds` (chunks of 32,000) to avoid exceeding MySQL's 65,535 prepared statement placeholder limit - Uses the existing `BatchProcessSimple` utility, matching the pattern already used in `software_titles.go` ## Root cause When `GET /api/v1/fleet/software/versions` is called without a `per_page` parameter, `DefaultPerPage` (1,000,000) is used. `ListSoftware` collects all `titleIDs` from the paginated results and passes them to `getDisplayNamesByTeamAndTitleIds`, which builds an `IN (?)` clause that exceeds MySQL's 65,535 placeholder limit. ## Manual testing 1. Started a local Fleet server with MySQL via `docker compose up` and `fleet serve --dev` 2. Seeded the database with 70,000 software titles, software entries, and software_host_counts records 3. **Before the fix**: `GET /api/latest/fleet/software/versions` (no `per_page`) returned HTTP 422 with `"Prepared statement contains too many placeholders"` 4. **After the fix**: the same request returns HTTP 200 with all 70,000 results 5. `GET /api/latest/fleet/software/versions?per_page=20` continued to work correctly in both cases ## Test plan - [x] Manual reproduction and verification (see above) - [x] `make lint-go-incremental` passes - [x] `go build ./server/datastore/mysql/...` compiles cleanly - [ ] CI passes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed `GET /api/v1/fleet/software/versions` endpoint to prevent errors when returning results from large software inventories. * **Tests** * Added test coverage for high-volume display name queries. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45737?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordan Montgomery
|
c70f6796a0 |
Add cert rollover tool, update Filevault key decryption for rollover process (#46226)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46226 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Add CA certificate rollover CLI to renew MDM CA certs with an extend-years option while preserving the private key and certificate properties. * **Improvements** * Decryption logic updated to accept previously-rolled CA certificates so escrowed disk-encryption keys can be decrypted after rollover. * **Tests** * Expanded tests and mocks to cover rollover and decryption scenarios. * **Chores** * Updated ignore rules and added a changelog entry for the rollover process. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46226?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dante Catalfamo
|
2c47cee122 |
Fix FileVault key escrow on ADE-enrolled Macs (#45928)
After ADE enrollment with enable_disk_encryption: true, hosts reported
as unencrypted with the disk-encryption policy failing and no recovery
key escrowed until the user logged out/in or restarted.
## Root cause
Fleet's shared macOS disk-encryption probe was:
```
SELECT 1 FROM disk_encryption
WHERE user_uuid IS NOT "" AND filevault_status = 'on' LIMIT 1
```
On the osquery disk_encryption table, filevault_status and user_uuid
are populated from independent sources: filevault_status from
`fdesetup status`, user_uuid from `diskutil apfs listCryptoUsers`
(the UUID of a user with SecureToken authority to unlock the volume).
In the post-ADE window, even with ForceEnableInSetupAssistant=true,
SecureToken propagation can lag — filevault_status='on' but
user_uuid='' for a brief period that resolves on a session event.
When the predicate failed, the query returned 0 rows and three
downstream behaviors broke in lockstep:
- host_disks.encrypted flipped to false ("unencrypted")
- the built-in "Full disk encryption enabled (macOS)" policy failed
- mdm_disk_encryption_key_file_*_darwin returned encrypted=0,
gating the PRK ingest and leaving the recovery key un-escrowed
The predicate originated in groob's standard query library entry
from 2021 as a strict compliance check ("is the host actually
protected, with a user able to unlock it?"). When the disk-encryption
status feature shipped in Nov 2022 (PR #8526, issue #3906), the
same string was reused verbatim and later extracted into
usesMacOSDiskEncryptionQuery — never revisited for whether the
SecureToken gate made sense outside the compliance-policy context.
**Related issue:** Resolves #45369
|
||
|
Sharon Katz
|
d498c1e312 |
Hide "Rotate password" button for Observer role in Recovery Lock modal (#45649)
Closes #42249 Supersedes #42247 (stale draft with merge conflicts) ## Summary - Hides the "Rotate password" button entirely in the Recovery Lock password modal when the user has the Observer role (`canRotatePassword` is false), instead of showing a disabled span with a tooltip - Removes unused `TooltipWrapper` import and orphaned SCSS styles for the disabled state - Consistent with the existing pattern in `ManagedAccountModal` which already hides the button for observers ## Changes - `RecoveryLockPasswordModal.tsx`: Return `null` when `!canRotatePassword` instead of rendering disabled tooltip - `_styles.scss`: Remove `__rotate-button--disabled` styles - Added `RecoveryLockPasswordModal.tests.tsx` with two tests covering button visibility based on role ## How I tested - Added unit tests (following the `ManagedAccountModal.tests.tsx` pattern) that verify: - The "Rotate password" button is **not rendered** when `canRotatePassword={false}` (Observer role) - The "Rotate password" button **is rendered** when `canRotatePassword={true}` (Admin/Maintainer role) - Both tests pass locally - ESLint passed clean on all changed files - Webpack build succeeded; verified the built bundle no longer contains the old tooltip text or disabled-button CSS class ## Test plan - [ ] Log in as an Observer, navigate to a macOS host with Recovery Lock, open the Recovery Lock password modal, and confirm the "Rotate password" button is not visible - [ ] Log in as an Admin/Maintainer and confirm the "Rotate password" button still appears and works <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * The "Rotate password" control in the Recovery Lock Password modal is now hidden when password rotation is unavailable (e.g., for Observer role) instead of being shown as a disabled control. * **Tests** * Added tests verifying the rotate-button visibility behavior based on rotation availability/permissions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45649?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
a1d91464ea |
Fix issue with permissions in host activity list for fleet-users (#46362)
**Related issue:** Resolves #46009. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Resolved an authorization issue preventing users from viewing past host activities on hosts that contained user-initiated operations such as lock, wipe, run script, or install software. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46362?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
RachelElysia
|
7c3355295a | Fleet UI: "Fleet spotlight" (Command palette menu) (#43756) | ||
|
Dante Catalfamo
|
dc56776a30 |
Don't process empty vuln data and remove existing records (#46075)
**Related issue:** Resolves #45602 |
||
|
Jonathan Katz
|
f79508580b |
Make software installer edits not cancel setup experience installs (#46236)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42744 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually - Tested setup experience on a macOS virtual machine, see below. This is what happens after the change: - Editing pkg while setup experience is running, whether the package is pending or currently running, doesn't cancel anything. Installs were successful. - Editing pkg while queueing a normal install caused it to cancel with no record. - Deleting while an installer is running causes the row to disappear immediately in the setup experience UI, HSI row removed. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Editing a software installer no longer cancels in-progress setup-experience installs; running setup-experience flows are preserved when installer scripts are updated. * Deleting an installer still removes its associated pending setup-experience entries and related pending host-install records. * GitOps batch updates: editing installers in a batch preserves running setup experiences; omitting an installer from a batch deletes only that installer’s pending entries. * **Tests** * Added/updated integration tests validating edit/delete behavior during setup experience. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46236?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon Katz
|
6a481477e8 |
POST /api/latest/fleet/targets returns more info than needed (#46082)
## Summary Fixes a security issue where `POST /api/latest/fleet/targets` returned sensitive fleet configuration to users with insufficient privileges. Other team-facing endpoints apply proper access controls; the target search path did not. - Replaces the `teamSearchResult` struct with a slim version containing only the non-sensitive fields documented in the API response (`id`, `created_at`, `name`, `description`, `user_count`, `host_count`, `display_text`, `count`). - Removes the `MarshalJSON`/`UnmarshalJSON` methods (~70 lines) that serialized fields the target picker never uses. - Verified that no frontend component, fleetctl client, or integration test reads sensitive fields from the target search response. - Validated the response shape matches the documented API contract in `docs/REST API/rest-api.md`. Closes fleetdm/confidential#16054 Related advisory: GHSA-88p2-jj8w-j8qg ## How we reproduced 1. Started local dev server (`fleet serve --dev --dev_license`) 2. Created a global observer user and a saved query with `observer_can_run = true` 3. Logged in as the observer **Before fix** -- same observer session, same team: ``` GET /api/latest/fleet/fleets/2/secrets -> secret: "********" (correctly masked) POST /api/latest/fleet/targets {"query":"","query_id":7,"selected":{"hosts":[],"labels":[],"teams":[]}} -> sensitive configuration leaked for all teams ``` **After fix** -- rebuilt binary, restarted server, same observer: ``` GET /api/latest/fleet/fleets/2/secrets -> secret: "********" (unchanged) POST /api/latest/fleet/targets (same request) -> only non-sensitive fields returned (id, name, display_text, count, etc.) ``` Also verified admin target search still returns team metadata correctly. ## Test plan - [x] Manual reproduction on local dev server - [x] Manual verification after fix - [x] Admin target search still returns team metadata (id, name, host_count, display_text) - [x] Verified no consumers (frontend, fleetctl, tests) read sensitive fields from target search - [x] Validated response matches documented API contract in `docs/REST API/rest-api.md` - [x] Unit test verifies response contains only documented non-sensitive fields - [x] `go test ./server/service/ -run TestSearchTargets` passes - [ ] CI passes |
||
|
Robert FairburnandMagnus Jensen
|
0c41e29336 |
Cleanup script for failed starts after renumbered migrations (#46177)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] QA'd all new/changed functionality manually ## Database migrations - [X] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a migration cleanup tool to recover from failed starts after migration renumbering. * Supports dry-run mode to preview the SQL changes and apply mode to execute fixes. * Includes secure database connection options and safe, transactional execution with reporting for detected issues. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46177?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Magnus Jensen <magnus@fleetdm.com> |
||
|
Victor Lyuboslavsky
|
33889ec177 | Fixed stale pending MDM profiles reappearing (#46111) | ||
|
Lucas Manuel Rodriguez
|
5b2427d187 |
Add backend changes for continuous automations on policies (#45999)
Resolves #45149 and #45150. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [X] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [X] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [X] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [X] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added team policy setting continuous_automations_enabled (default: false) to re-run software/script automations on every failing evaluation; exposed in APIs and GitOps YAML. Disallowed for "All fleets" and requires a premium license. * **Tests** * Added integration tests for CRUD, GitOps, and re-queuing behavior validating continuous automations. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45999?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin Sykulev
|
6ae04f95b8 |
Better android host names (#46135)
**Related issue:** Resolves #41053 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Android hosts associated with an IdP now display as "{IdP first name}'s {device model}" when IdP fullname is available. * Enrollment now links hosts to an MDM IdP account when enrollment payload includes IdP info. * **Bug Fixes / Behavior** * Unenrollment records and host naming use device brand+model for hardware identification and sensible fallbacks when IdP data is missing. * Re-enrollment updates IdP association without creating duplicate hosts. * **Tests** * Added tests covering display-name and hardware-model behavior with and without IdP data. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46135?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
590bf185c2 |
Fix missing tags for OPA policy (#46203)
Resolves #46009. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed permissions for host activity items by aligning serialized field names used by authorization rules, ensuring fleet-scoped users receive correct access rights when listing and reading host activities. * **Tests** * Added authorization tests validating host activity access control across user roles and team scopes, including denial cases for unauthorized and GitOps-scoped users, and verifying policy evaluation depends on correct serialized field naming. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46203?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
e790260b85 |
Android commands backend (#46031)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41683 Support for Android lock, wipe, and clear passcode commands. Behavior is slightly different between BYOD and CODO. The fleetdm.com proxy isn't wired up, so they only work with direct Google connection. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Clear-passcode CLI plus Android Lock and Wipe commands (Wipe restricted to company-owned devices). * BYO unenroll now removes only the work profile, preserving personal data. * Commands issued with a 10-year duration; UI/CLI show Android-specific messaging and command IDs. * **Improvements** * Host MDM pages reflect command lifecycle transitions (pending → acknowledged or error with code/message) via Pub/Sub updates. * **Documentation** * Updated docs for Android MDM commands, ownership rules, and command duration. * **Tests** * New unit and integration tests for Android MDM flows. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46031?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
484adf3494 |
Fix GitOps policy install software parse function setting the wrong FMA slug field. (#46167)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46164 The policy does parse correctly into a GitOpsPolicySpec struct, but because there were two fields called `fleet_maintained_app_slug` it wasn't obvious that this would happen. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where patch policies with different software application slugs were incorrectly using the slug from the install automation setting instead of the patch policy's own configured slug, causing incorrect policy queries and validation. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46167?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
5d59b0e627 |
Skip VPP label validation in dry runs (#46106)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45844 Skips label validation against the database in dry runs, because if new ones are being applied in the same run then they wouldnt be in the db ahead of time. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually - Added a new label and vpp reference to it, both dry run and real run worked. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes **Bug Fixes** * GitOps dry runs no longer fail when a VPP app references a label that is introduced within the same run. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46106?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
4146978777 |
Windows MDM validation fixes (#46029)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42219 Resolves #42224 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Enhanced Windows MDM profile validation: uploads that are non-XML, empty, or lack required SyncML top-level elements are rejected; LocURI values that are empty, start with `/`, contain `..` path traversal, or are otherwise malformed are now rejected (whitespace-trimmed), preventing later device deployment failures. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46029?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
fc10afe147 | Fixed the "host is offline" banner on the My device page incorrectly appearing (#46091) | ||
|
Jonathan Katz
|
5d9b102a1b |
45190 patch policy wrong installer (#46087)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # Adds a missing `is_active=1` check to get the actual active installer for the software automation's installer. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually - I tested by pinning the version of the app to the older one, then unpinning and back and checked that the policy is associated to the correct installer with the query below. - I did not manually test updating to a new FMA version. It's possible to do that easily by creating a new branch with a newer version and referring FLEET_DEV_MAINTAINED_APPS_BASE_URL to it. ``` SELECT si.id, si.team_id, si.title_id, si.filename, si.version, si.storage_id, si.uploaded_at, si.updated_at, si.url, si.fleet_maintained_app_id, si.install_during_setup, si.is_active, si.patch_query, si.http_etag, p.patch_software_title_id, p.software_installer_id, p.query FROM software_installers si LEFT JOIN policies p on si.id = p.software_installer_id WHERE filename LIKE "%<app name>%" AND platform = "darwin" AND global_or_team_id = <team id>; ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Patch policies using software install automations now correctly prioritize active installers, ensuring deployment uses the latest appropriate version rather than inactive or outdated alternatives. * **Tests** * Added test scenarios to validate policy installer version selection and active status during automation evaluation. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46087?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
3f6f138530 |
Fix duplicate Android host on orbit-enroll when Apple MDM is off (#46008)
The Fleet Android Agent's orbit-enroll did not match the existing AMAPI-created host record on Fleet instances with Apple MDM disabled, creating a duplicate hosts row alongside the AMAPI-enrolled one. The Android-specific UUID match clause in matchHostDuringEnrollment was gated by isMDMEnabled, which only reflects Apple MDM status. Gate the clause on platform="android" instead. The Fleet Android Agent always sends this since PR #43809, and the SELECT itself filters platform=android, so the clause is Android-safe by construction and no longer depends on the Apple-MDM flag. The serial-match clause keeps its existing isMDMEnabled gate. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46001 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Updated tests - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Prevents duplicate host records when enrolling Android devices on instances with Apple MDM disabled. * Improves enrollment host-matching so devices are identified by their platform, reducing misattributed or duplicate hosts during enrollment. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46008?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel RodriguezandCopilot Autofix powered by AI
|
377c5ad127 |
Fix iOS and iPadOS logos in dark theme (#45838)
Resolves: https://github.com/fleetdm/fleet/issues/45839. Dogfood: <img width="778" height="314" alt="Screenshot 2026-05-19 at 5 44 52 PM" src="https://github.com/user-attachments/assets/4a6433bf-612d-42bb-b3ea-961c19f54e90" /> With changes in this PR: <img width="1811" height="373" alt="Screenshot 2026-05-20 at 9 22 58 AM" src="https://github.com/user-attachments/assets/ebf0f432-6592-40a2-bacb-72f6e63f7827" /> <img width="1811" height="373" alt="Screenshot 2026-05-20 at 9 22 44 AM" src="https://github.com/user-attachments/assets/f8bac481-4263-4d95-932d-f8599ed87055" /> - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed iOS and iPadOS icons so they render correctly in dark theme across the operating-system list. * Improved icon visibility and contrast in dark mode to ensure consistent appearance with other platform icons. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45838?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Lucas Manuel Rodriguezandcoderabbitai[bot]
|
aeac57bd04 |
Fix to populate host_emails during Linux/Windows SSO enrollment (#45951)
Resolves #45066. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed user email/device mapping for Windows and Linux hosts enrolling via end-user authentication (browser-based and EUA-token flows). Host listings and device mapping now reliably show the IdP email after enrollment, improving device identification and inventory accuracy. * **Tests** * Expanded integration tests to validate end-to-end enrollment and device mapping across platforms. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45951?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |
||
|
Lucas Manuel Rodriguezandcoderabbitai[bot]
|
4e3f8c0b69 |
Allow technicians to transfer hosts (#45956)
Resolves #41783. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [x] QA'd all new/changed functionality manually. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Technicians can transfer hosts between fleets (Fleet Premium). Global technicians can transfer via the Fleet UI and REST API; fleet-scoped technicians can transfer between fleets they manage via the REST API. * Bulk transfer selection added on the hosts list for eligible global technicians, enabling multi-host transfers while preserving other bulk behaviors. * **Tests** * Added and updated tests covering Transfer visibility and authorization for global and fleet-scoped technician roles. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45956?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |
||
|
Sharon Katz
|
8bb59b71cb |
Fix List certificate templates API docs: parameter name is fleet_id, not fleet (#45969) (#45978)
Closes #45969 ## Summary The `List certificate templates` API endpoint returned `null` for certificates because the **API docs documented the wrong query parameter name**. The docs said `fleet` but the code accepts `fleet_id` (or the deprecated `team_id`). Customers following the docs used `?fleet=11`, which was silently ignored, causing the endpoint to default to team 0 (unassigned) -- which typically has no certificates. - **Docs fix**: Changed the parameter name from `fleet` (string) to `fleet_id` (integer) in the REST API docs, matching how all other list endpoints document this parameter. - **API quality fix**: Initialize the `templates` slice in `GetCertificateTemplatesByTeamID` so that when no templates exist, the JSON response returns `"certificates": []` instead of `"certificates": null`. ## Root cause In `docs/REST API/rest-api.md`, the "List certificate templates" endpoint documented the query parameter as `fleet` (string), but the request struct accepts `fleet_id` or `team_id`: ```go type listCertificateTemplatesRequest struct { TeamID uint `query:"team_id,optional" renameto:"fleet_id"` } ``` When the customer used `?fleet=11` (as documented), the parameter was unrecognized and silently ignored. The endpoint defaulted to `team_id=0` (unassigned), which had no certificates. The nil Go slice then serialized to JSON `null`. Credit to Andrey Kizimenko for identifying the docs mismatch. ## Changes - `docs/REST API/rest-api.md` -- Fix parameter name from `fleet` (string) to `fleet_id` (integer) - `server/datastore/mysql/certificate_templates.go:174` -- Initialize slice to avoid `null` in JSON - `server/datastore/mysql/certificate_templates_test.go:489` -- Add `require.NotNil` regression test ## Testing All tests run locally against a real MySQL (Docker) and Redis instance: | Test suite | Command | Result | |---|---|---| | Datastore integration (all certificate tests) | `MYSQL_TEST=1 go test -run TestCertificates ./server/datastore/mysql/...` | 11 suites, 33 subtests, all PASS | | Service unit tests | `go test -run "TestCreateCertificateTemplate\|TestApplyCertificateTemplateSpecs\|..."` | 4 suites, all PASS | | Enterprise integration (full HTTP) | `MYSQL_TEST=1 REDIS_TEST=1 go test -run "TestIntegrationsEnterprise/TestCertificatesSpecs"` | PASS | | Enterprise integration (team delete) | `MYSQL_TEST=1 REDIS_TEST=1 go test -run "TestIntegrationsEnterprise/TestDeleteTeamCertificateTemplates"` | PASS | | Static analysis | `go build`, `go vet` | Clean | Andrey's reproduction confirmed via screenshots: - `?fleet_id=11` returns certificates correctly - `?fleet=11` (the documented param) returns `null` -- the bug - No param returns results when "unassigned" team has certificates ## QA steps 1. Follow the API docs to list certificate templates using `?fleet_id=<id>` 2. Verify the response contains `"certificates": [...]` with the correct data 3. Call without `fleet_id` and verify `"certificates": []` (not `null`) for a team with no templates <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed the "List certificate templates" API documentation with the correct query parameter name, enabling proper filtering of results. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45978?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
24da012f18 |
Fixed Android Enterprise page not refreshing (#45914)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45862 Speculative fixes since I wasn't able to repro issue locally. Refresh AppContext and the React Query ["config"] cache directly after the SSE/DELETE response so AndroidMdmCard and AndroidMdmPage flip without a manual page reload, with a bounded retry to defeat the 1s cached_mysql.AppConfig TTL. Also harden startSSE to detect the success signal across chunk boundaries and reject (rather than hang) when the stream ends without it. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed Android Enterprise page not refreshing after connecting or disconnecting Android MDM. The Enterprise ID and card state now update automatically without requiring a manual page reload. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45914?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
29f41af47d |
Fix NDES dynamic SCEP regression caused by ntlmssp anonymous probe (#45784)
Fixes #45763 The recent bump of github.com/Azure/go-ntlmssp to v0.1.1 changed the Negotiator to send an unauthenticated probe before NTLM. NTLM is connection-bound on IIS, and the extra round-trip breaks the handshake on NDES setups behind reverse proxies, Okta Access, or a WAF. |
||
|
Lucas Manuel Rodriguez
|
b4e907801f |
Add Android to the OS list (#45834)
Resolves #45711 - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually. <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 30 48 PM" src="https://github.com/user-attachments/assets/05a0a93f-3b5b-4ba9-80c5-b0a91b9de1f3" /> <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 30 37 PM" src="https://github.com/user-attachments/assets/3e23e88e-6a95-46f6-a68f-12fb98f1aefe" /> <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 29 45 PM" src="https://github.com/user-attachments/assets/417ca981-0781-4df5-811b-dafaabbd61a9" /> <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 29 30 PM" src="https://github.com/user-attachments/assets/cf13985d-5cb3-414a-9135-5cf4c5ee0dd1" /> <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 31 33 PM" src="https://github.com/user-attachments/assets/8500e7b2-cc7b-425d-b6b7-bbbf128faac4" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed host listing so filtering by Android OS name and version returns matching hosts. * **New Features** * Android hosts are now included in the operating systems aggregation and UI, with a dedicated Android icon. * Android OS version information is captured during device enrollment and on status reports. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45834?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
851ce172ef | Fix CheckerboardViz relative scale to use cell value instead of percentage (#45791) | ||
|
Scott Gress
|
6f8942f8da |
Skip unneeded query when getting CVE chart (#45813)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45720 # Details When requesting CVE chart data, we were making a call to get the set of tracked CVEs to filter the data by. Currently we're only _collecting_ data for the tracked CVEs, so there's no reason to make this call at all. When we add more filtering options and start collecting more data, we'll need a call like this again, and will likely need to start caching the results. Otherwise it's a multi-second cost per query on large deployments. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - removed some outdated tests - replaced with a test that checks that when an entity filter returns no items (an empty, rather than nil slice) we get empty buckets returned rather than getting data for all entities. This is a regression test for when we add filtering back. - [X] QA'd all new/changed functionality manually - validated that chart still loads and shows the same data. - tried it on a load test env and saw dramatic API request time improvement <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Bug Fixes** * Optimized CVE chart data retrieval by eliminating redundant queries, reducing unnecessary database operations and improving performance. * Fixed entity ID filtering logic to correctly handle edge cases and prevent unintended filter interactions across metrics. * **Tests** * Added test coverage for chart data queries with empty entity filters. * Improved test isolation to ensure metric-specific filtering behavior is properly separated. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45813?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George Karr
|
6e823049bf | Fix Android/Windows profile edits via GitOps rejected when AppConfig is stale (#45752) | ||
|
|
3e10ad717c |
Add optional SES sender domain configuration (#43811)
**Related issue:** Resolves #42288 # Summary This PR adds support for configuring an optional SES sender domain. When the SES email backend is enabled, Fleet can now use a configured sender domain for the `From` address instead of always deriving the domain from `server.server_url`. If the setting is not provided, Fleet keeps the existing behavior. # Impact This gives self-hosted operators a server-side SES configuration option for email sending without changing UI-managed SMTP settings. # Root cause The SES sender path only generated `do-not-reply@<server host>` from the Fleet server URL, so there was no way to override the sender domain through server configuration. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Added/updated automated tests - [x] Setting(s) is/are explicitly excluded from GitOps ## Testing - [x] `go test -tags full,fts5,netgo ./server/mail -run 'Test_(getFromSES|sesSender_SendEmail)$'` - [x] `go test -tags full,fts5,netgo ./server/config -run 'TestConfig(SESSenderDomain|Roundtrip)$'` - [x] `go test -tags full,fts5,netgo ./server/service -run 'TestService_EmailConfig$'` - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added optional SES sender domain configuration. Users can specify a custom domain for the email "From" address via config or environment variable; when unset it falls back to the server hostname. * **Tests** * Added and expanded tests to verify sender-domain precedence, From-header generation, and related error cases. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/43811?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
RachelElysia
|
fdc101e306 | Fleet UI: Add add variable button, update no results live empty state (#45808) | ||
|
Scott Gress
|
d7fa35e417 |
Implement roaring bitmaps for historical data collection (#45709)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45715 # Details This PR refactors the way the charts module stores historical data to use the [roaring bitmap](https://github.com/RoaringBitmap/roaring) package instead of saving raw bitmaps. See [this blurb](https://github.com/RoaringBitmap/roaring#how-does-roaring-compares-with-the-alternatives) to learn how roaring compresses data, but TL;DR for our purposes it represents a huge improvement especially for larger deployments where host ID numbers may be very large. In testing, some data was reduced 96%. The majority of the changes in this PR are straight swapping of types from `[]byte` to `*roaring.Bitmap` in vars and function signatures, and updating the internals of our bit math helpers to use roaring methods instead of native AND and OR methods. I've tried to comment on all functional changes. Since the charts have been shipped already, so there will be data in the wild in the prior "dense" format, the code still handles dense bitmaps on _read_, but will always _write_ roaring bitmaps. The majority of the data will therefore have turned over within 30 days on its own, but I plan on a follow-up PR that will transform open rows when the cron runs so that we should be guaranteed to turn over completely within 30 days. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - Tests updated to accommodate the new format, and existing unchanged tests act as proof against regression - [X] QA'd all new/changed functionality manually - Using a tool that dumps the `host_scd_data` rows data into a JSON file (with the keys being entity_id+data and the values being host IDs on that date), compared the data from main branch and this and confirmed they're identical - With a host count of ~9000, some of which have IDs of over 1,000,000, the data storage requirements were: * 82,558,976 bytes for dense * 2,867,200 for roaring (a 96% decrease) For unreleased bug fixes in a release candidate, one of: - [X] Confirmed that the fix is not expected to adversely impact load test results - should hugely improve - [X] Alerted the release DRI if additional load testing is needed ## Database migrations - [X] Checked schema for all modified table for columns that will auto-update timestamps during migration. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Implemented roaring bitmaps in historical data collection to optimize bitmap handling for chart data aggregation * Added encoding support to bitmap storage schema for flexible data representation <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George KarrandCopilot Autofix powered by AI
|
4d0534a48d |
Adding my device link on host details page with backend logic to generate it if needed (#45659)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43895 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Self-service install/uninstall activities now render in passive voice, omit an actor name, and include a “(self-service)” marker across feeds * Global admins see a "My device" button on host user cards that opens the end‑user device page in a new tab; the link is refreshed/generated as needed * Device page and browser tab header show the end‑user's name when available (fallback: "My device") * **Tests** * Added/updated coverage for self‑service activity rendering and the "My device" flow <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45659?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Sharon KatzandClaude Opus 4.6
|
15a4b16939 |
Fix disk encryption table horizontal scroll at narrow viewports (#45736)
Closes #43637 ## Summary - Adds `min-width: 0` to `.side-nav__card-container` so the flex child can shrink below its content width, enabling horizontal scroll on data tables inside the side-nav layout at narrow viewports. ## Root cause `.side-nav__container` uses `display: flex`, and its child `.side-nav__card-container` has `width: 100%` but no `min-width` override. Flex children default to `min-width: auto`, which prevents them from shrinking below their content width. This means `overflow-x: auto` on `.data-table__wrapper` never activates because the parent chain stretches to fit the table content instead of constraining it. ## Changes **`frontend/pages/admin/components/SideNav/_styles.scss`** -- added `min-width: 0` to `.side-nav__card-container`. ## Manual testing - [x] Built and ran Fleet server locally (`make fleet && ./build/fleet serve --dev --dev_license`) - [x] Navigated to **Controls > Disk encryption** (https://localhost:8080/controls/os-settings/disk-encryption?fleet_id=2) - [x] Enabled disk encryption for the team and confirmed the table rendered - [x] Resized browser to smallest supported viewport width - [x] **Before fix:** table columns were squished/truncated with no horizontal scrollbar - [x] **After fix:** horizontal scrollbar appeared and table content scrolled correctly - [x] Verified other pages using the SideNav component (e.g., Settings) were not affected ## Unit tests - [x] Ran all related frontend test suites (`SideNav`, `DiskEncryption`, `TableContainer`) -- 39 tests, all passing 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Fixed side navigation layout to properly handle content overflow and enable horizontal scrolling when navigation items exceed available space. * **Documentation** * Added note: Disk Encryption > Disk encryption table now supports horizontal scrolling on narrow viewports. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45736?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Tim Lee
|
bbfbea8de2 | Cert renewal for non-proxied SCEP and ACME (Phase 1 + Phase 2) (#45696) | ||
|
Lucas Manuel Rodriguez
|
9e7781a004 |
Update enrolling activities and preserve osquery display name (#45697)
Resolves #36417. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually ## Manual tests performed ✅ MDM enrollment first, then fleetd enrollment (checked both activities match serial and display name is preserved). ✅ fleetd enrollment first, then MDM enrollment (checked both activities match serial and display name is preserved). <img width="520" height="383" alt="activities_mdm_macos_enrollment" src="https://github.com/user-attachments/assets/35c74612-ad80-4245-bfd9-20a3dc5e78bb" /> ✅ Enrolled ABM iPad. <img width="599" height="65" alt="Screenshot 2026-05-18 at 10 57 23 AM" src="https://github.com/user-attachments/assets/b7ad552b-82af-4606-a860-361eedb97483" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enrollment activities now show device serial numbers alongside host display names, avoid duplicating the serial if already included, and fall back to serial/generic messaging when no display name is available. * Fleet enrollment entries no longer show an actor prefix, matching other enrollment activity items. * **Bug Fixes** * Display names set by prior fleetd enrollment are preserved and no longer overwritten during MDM enrollment. * **Tests** * Added and relaxed activity-feed tests covering enrollment message variants. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45697?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
e1512dacc9 |
Fix nil-pointer panic in Android Enterprise Pub/Sub endpoint (#45520)
Fixes #45520 The Pub/Sub status-report and enrollment handlers dereferenced device.HardwareInfo before any nil check, so a payload from Google's Android Management API with hardwareInfo omitted panicked the request goroutine. |
||
|
Juan Fernandez
|
b0d429ef69 |
Fix SAML JIT login failing when role attributes have empty values (#42874)
Fixes #42874 Empty, whitespace-only, and missing `FLEET_JIT_USER_ROLE_*` SAML attribute values are now treated as `null` (ignored) instead of returning an error, matching the literal `"null"` workaround. |
||
|
George Karr
|
9416a81124 |
gkarr 44008 setup experience (#45202)
- **Adding vpp users table** - **Adding ManagedAppleID to HostMDM tables to pull when installing vpp apps to a BYOD user enrolled device** - **Adding user create vpp apis** - **Updating install application to support user enrolled devices** - **Handling already installed gracefully** - **Adding provision user logic** - **Adding logic to associate assets on install** - **Add license managemnt logic** - **Adding self service ui** - **Adding setup experience support** - **Adding setup experience flow** - **Fix issue with fleet's docker image in k8s environments (#44373)** - **Changing how the appleid is captured to use idp mdm users** <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Account-based User Enrollment (iOS/iPadOS) supports VPP and in‑house .ipa installs, including self‑service installs. * Enrollment now applies the selected Setup experience automatically for user‑enrolled hosts. * Installs and license associations are scoped to account user associations (user‑scoped installs). * **Bug Fixes** * Improved error messaging for license/association failures (including per‑user device cap cases). * Mobile UI: self‑service now shows user‑enrolled iOS/iPadOS apps. * “Already installed” install results are treated as acknowledged successes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45202) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
c77d1b4ff4 |
allow gitops mode to be set in yaml (#45537)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45330 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests so many - [X] QA'd all new/changed functionality manually - [X] was able to set gitops mode to enabled via `fleetctl gitops` - [X] attempting to set gitops mode w/out repository_url in `fleetctl gitops` failed w/ helpful error - [X] attempting to set gitops mode w/ invalid repository_url in `fleetctl gitops` failed w/ helpful error - [X] attempting to set gitops exceptions in `fleetctl gitops` failed w/ helpful error - [X] was able to unset gitops mode via `fleetctl gitops` - [X] leaving `gitops:` blank in `fleetctl gitops` left the mode untouched (it would retain its previous value) ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` it is not, but it's not a requirement here and leaving it out is a no-op - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) it is not, nor should it be, as that would clear gitops mode on every customer currently using it - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled n/a, you still need to be able to do gitops mode in the UI <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * GitOps mode and repository URL can now be set via GitOps YAML. * **Bug Fixes** * Server preserves existing GitOps settings during config updates; requires repository URL when enabling and rejects unsupported exceptions in GitOps YAML. * **Tests** * Added tests covering apply behavior, YAML validation, activity emission on mode changes, and license-restricted rejection on free tier. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45537) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Luke Heath
|
79a70480aa | Adding changes for Fleet v4.85.0 (#44228) (#45545) | ||
|
Juan Fernandez
|
ed2b41bd5a |
Add missing header on Fleet free for Conditional Access (#43643)
Fixes #43643 Fixed missing "Conditional access" section header on the Settings > Integrations > Conditional access page on Fleet Free. |
||
|
Juan Fernandez
|
2df64ae9d9 |
Fixed cursor style on timestamps shown on host Vitals (#43645)
**Related issue:** Fixes #43645 Updated timestamps w/ tooltips on host's Vitals component to always have cursor: pointer. |
