Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 38 Packages Projects Releases Wiki Activity
Files
0a98ce5582a4e0764a0f2191de22bf579f5adf63
fleet/changes
T
History
NicoandClaude Sonnet 4.6 0a98ce5582 Enable JIT provisioning for Technician role (#41286) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41242

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

Configured SAML app in Okta following
https://fleetdm.com/docs/deploy/single-sign-on-sso#okta (needs update):

<img width="1069" height="790" alt="Screenshot 2026-03-10 at 9 10 05 AM"
src="https://github.com/user-attachments/assets/7a160599-524e-4118-922b-5f9b601129eb"
/>

Defined a Custom SAML Attribute Statement following
https://support.okta.com/help/s/article/How-to-define-and-configure-a-custom-SAML-attribute-statement?language=en_US.
This is to add `FLEET_JIT_USER_ROLE_GLOBAL` to the default User profile.

<img width="2536" height="1299" alt="Screenshot 2026-03-10 at 9 22
03 AM"
src="https://github.com/user-attachments/assets/68193815-4abd-4a3b-9e95-147b1b3105d3"
/>

Within the new Okta app > Sign On tab, added this expression:

<img width="765" height="444" alt="Screenshot 2026-03-10 at 9 35 41 AM"
src="https://github.com/user-attachments/assets/40073cfc-931c-492e-bd5f-e8e89434b107"
/>

Within Okta, added a new user in Directory > People and assigned it to
the new Okta app.

<img width="1050" height="515" alt="Screenshot 2026-03-10 at 9 36 14 AM"
src="https://github.com/user-attachments/assets/1b0a2847-208a-4251-8d9c-6bd0cba33d13"
/>

Logged in to fleet with the new user via SSO and verified its role is
Technician:

<img width="714" height="507" alt="Screenshot 2026-03-10 at 9 32 15 AM"
src="https://github.com/user-attachments/assets/cf44d99c-78bc-4d7c-9f46-5c25fc745778"
/>

<img width="1356" height="339" alt="Screenshot 2026-03-10 at 9 37 11 AM"
src="https://github.com/user-attachments/assets/baa028cb-6b3b-4c9b-b02e-ac2e16ec9262"
/>



For unreleased bug fixes in a release candidate, one of:

- [x] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-10 10:15:01 -03:00
..
.keep
…
14276-post-json-redact-response-body
Log response body in PostJSONWithTimeout error case (#40509)
2026-02-25 15:35:29 -06:00
14323-order-by
Order By Vulnerability (#40143)
2026-02-23 09:42:36 -07:00
14489-host-transfer-validations
Improved validation for host transfers (#40345)
2026-02-24 12:15:59 -03:00
25080-show-manage-automations-queries-policies-pages
Show Manage Automations disabled button with tooltip on Policies page (#39392)
2026-02-09 15:41:31 -03:00
26405-jetbrains
Fix Jetbrains versions - Take 2 (#40928)
2026-03-06 12:30:20 -07:00
29076-vuln-freetier-webhook
Allow vulnerability webhook to fire for fleet free (#39810)
2026-02-16 11:02:48 -06:00
30670-python-cve
Updated Python cve product (#39756)
2026-02-12 12:11:01 -06:00
30967-disable-calendar-manage-policy-automations-no-team
Disable Calendar option in Policy > Manage automations for No team (#39784)
2026-02-12 15:15:02 -08:00
31919-rollback
FMA version rollback (#40038)
2026-02-24 14:00:32 -05:00
31919-surface-latest-fma-version
FMA version rollback (#40038)
2026-02-24 14:00:32 -05:00
31921-windows-profile-verification-without-osquery
remove windows profile osquery verification (#40539)
2026-02-27 12:21:45 -05:00
32026-last-opened-time
Decrease last opened time diff (#40506)
2026-03-02 09:18:30 -07:00
33045-fleet-free-targetting-queries-by-label
Added license checks when targeting queries by label (33045) (#41255)
2026-03-09 16:54:53 -04:00
33427-batch-script-run-deleted-hosts-tooltip
Added tooltip to batch run host count
2026-02-26 07:43:24 -04:00
33519-url-team-id-param
Fleet UI: Host details page includes team_id param in URL (#39801)
2026-02-13 16:42:17 -05:00
33990-rhel-kernel-vulns
Scan goval-dict for rhel kernel vulnerabilities(#39749)
2026-02-12 15:21:59 -07:00
34068-software-install-retries
Add retries for software installs (#39827)
2026-02-23 08:48:53 -05:00
34122-remove-stable-scrollbar-gutters
Remove stable scrollbar gutters from the UI (#39850)
2026-02-13 13:34:02 -08:00
34370-vert-padding-ossettings
Improved spacing on the Controls > OS Settings page (#40188)
2026-02-20 08:34:22 -08:00
34620-trim-app-fix
Fixed a bug where certain macOS app names could be ingested as empty strings due to incorrect ".app" suffix removal. (#39563)
2026-02-10 13:03:23 -06:00
34748-tooltip-truncated-host-software-type
Improve host software inventory table's handling of long "Type" values. (#39732)
2026-02-12 10:15:26 -08:00
34990-improve-apns-query-efficiency
improve APNS query efficiency (#39614)
2026-02-10 15:40:44 -05:00
35044-2-vuln-jobs
Fix issue with vuln jobs running in parallel. (#39806)
2026-02-16 13:59:40 -06:00
35528-wrong-title-platform
Check platform when matching title ID to software installer (#39933)
2026-02-18 12:52:06 -05:00
35561-move-textarea-copy-icons
Move copy UI for InputFields with type="textarea" in line with the label (#39885)
2026-02-16 12:11:40 -08:00
35613-android-profiles-pending
Put Android profiles in pending immediately on upload (#39330)
2026-02-04 14:18:06 -05:00
35659-android-profiles-dont-reverify
Reverify Android profiles that previously failed (#39025)
2026-02-04 13:08:22 -05:00
35799-software-titles
Optimized api/latest/fleet/software/titles endpoint (#40458)
2026-02-27 14:30:05 -06:00
35805-zero-host-counts
Fixed dead rows accumulating in software host counts tables (#40288)
2026-02-24 15:35:02 -06:00
36032-eua-account-name
Add lock end user info migrations, API support and AccountConfiguration command updates (#40551)
2026-03-02 12:16:31 -05:00
36093-live-report-cross-team-targeting
Fix observer query bypass: prevent cross-team targeting (#40717)
2026-03-05 15:12:04 -03:00
36355-activities-max-per_page
Max per_page for activities is now 10,000 (#39828)
2026-02-13 13:32:09 -06:00
36361-more-debug-logging-for-ca-profiles
add additional logging for SCEP proxy and SCEP profiles (#39501)
2026-02-09 14:46:30 -05:00
36682-orphan-mdm-command-refs
Log orphan MDM command references instead of returning 500 (#40877)
2026-03-09 09:54:14 -03:00
36755-add-activity-for-modified-enroll-secrets
Add activity for modified enroll secrets (#39292)
2026-02-07 09:21:10 -04:00
37182-update-policy-membership-when-labels-change
Update policy membership when policy labels change (#39201)
2026-02-11 08:56:01 -06:00
37219-fix
Add help text below InstallerStatusTable to explain the meanings of counts (#38994)
2026-02-05 17:11:09 +01:00
37249-use-username-idp-email-for-maintenance-windows
Prioritize using IdP email address when available for maintenance window scheduling (#37250)
2026-02-27 14:57:43 -04:00
37306-fix-certificate-field-truncation
Fix: certificate field too long error due to osquery not encoding non-ascii characters (#40095)
2026-02-19 13:05:04 -03:00
37802-fix-windows-fma-list
Match Windows Fleet maintained apps by similar name (#40544)
2026-02-26 12:47:52 -05:00
37804-filtering-fmas
Fleet UI: Add Software > FMA table - Add platform and status filter (#37805)
2026-02-04 09:16:11 -05:00
38254-new-app-categories-on-older-builds
Allow FMAs to be added when default categories don't exist (#38303)
2026-03-03 14:29:28 -05:00
38343-use-custom-icon-display-name-in-setup-experience
Bugfix: use custom software title icon and display name in setup experience UI (#39223)
2026-02-03 14:56:16 -05:00
38351-token-auth
Extend device token valid window. (#39995)
2026-02-18 12:53:24 -06:00
38356-fix-pkg-metadata-extraction
Bugfix: ignore nested .app files in .pkg metadata extraction (#40851)
2026-03-03 12:33:31 -05:00
38366-contributor-flag-for-allowing-all-declarations
Skip MDM Declaration Validation logic with Configuration. (#38212)
2026-02-27 16:07:33 -05:00
38431-enforce-setup-experience-restrictions
Enforce GitOps setup experience when manual agent install is enabled (#39775)
2026-02-13 16:21:39 -05:00
38432-dont-allow-mai-without-bootstrap
don't allow manual_agent_install without bootstrap package (#40812)
2026-03-02 15:25:46 -05:00
38514-android-mdm-empty-state
Fleet UI: Show CTA to turn on Android MDM (#39763)
2026-02-13 09:20:56 -05:00
38534-fleet-activities-2
Activity bounded context: Complete read operations (#38555)
2026-02-09 15:29:12 -06:00
38536-new-activity-bc
Move NewActivity to activity bounded context (#39521)
2026-02-25 14:11:03 -06:00
38543-disk-encryption-miscounts
38543 disk encryption miscount (#39497)
2026-02-06 14:45:58 -05:00
38554-populate-idp-host-vitals-android
Fix: IdP host vitals not automatically populated for Android hosts (#39254)
2026-02-06 09:15:30 -03:00
38593-block-self-service-personal-enrollments
block self service on personal enrollments (#41054)
2026-03-06 10:23:15 -05:00
38607-otel-logs
Added OTEL log export support (#39279)
2026-02-06 18:57:28 -06:00
38611-remove-unused-var
Remove unused/confusing --mdm_apple_scep_signer_allow_renewal_days config (#40800)
2026-03-04 11:53:59 -05:00
38621-add-technician-role
Add new Technician role (#39564)
2026-02-11 15:00:10 -03:00
38659-script-path-support
Add path support to script files (#40821)
2026-03-04 13:22:44 -05:00
38699-ca-cert-country
Added Country:US to new CA certs created by Fleet. (#40081)
2026-02-19 09:26:22 -06:00
38766-uninstall-android-apps-on-fleet-remove
RAA: Support removing an android app from managed google play (self-service) on deletion (#39343)
2026-02-11 11:35:00 -05:00
38779-collect-fma-usage
Add Fleet-maintained apps to usage statistics payload (#38779)
2026-02-25 09:43:08 -04:00
38834-update-apple-os-update-time
…
38878-fully-managed-android
Add support for fully-managed android devices (#39388)
2026-02-06 10:46:25 -05:00
38889-slog-1
Migrate HTTP request logging from go-kit/log to slog (#39729)
2026-02-14 13:04:41 -06:00
38911-nextcloud-cve
Fixed false positive CVE for Nextcloud Desktop (#39360)
2026-02-05 13:13:38 -06:00
38947-handle-renaming-labels-in-gitops
Add warning message on gitops label rename (#40008)
2026-02-18 12:52:21 -04:00
38949-policy-automations-stale-data-after-save
Fix: Policy automations revert to old value in UI after saving (#40012)
2026-02-18 18:16:56 -03:00
38955-bulk-team-transfer-cause-long-db-locks
Refactored query used when bulk deleting Apple MDM profiles to rely only on primary keys. (#39705)
2026-02-18 10:13:47 -04:00
38965-preserve-team-context
refactor path generation (#41126)
2026-03-06 12:11:37 -05:00
39000-ca-bypass-per-policy
UI: Allow conditional access bypass per-policy (#39667)
2026-02-11 18:55:59 -08:00
39048-only-default-if-update-new-hosts-not-explictly-set
Only default update_new_hosts key if not explicitly set (#39202)
2026-02-03 12:41:52 -05:00
39083-gitops-label-platform-validation
Label validation not catching invalid platform (#39964)
2026-02-17 14:04:07 -04:00
39150-cleanup-host-isssues-on-host-delete
clean up host_issues on host deletion (#40827)
2026-03-03 14:14:29 -05:00
39228-db-failover
Improve error handling on AWS DB failover (#39841)
2026-02-17 07:10:52 -06:00
39247-retry
retry software installer download and upload during gitops (#40643)
2026-02-27 14:05:15 -05:00
39260-fix-enroll-secrets-ui
Fix enroll secrets UI (#40004)
2026-02-18 08:11:33 -06:00
39264-entra-tenants
Add entra tenant IDs migration (#39420)
2026-02-09 12:48:19 -05:00
39273-filter-button-hover-fix
Fix label button hover state (#39425)
2026-02-06 11:06:22 -06:00
39324-digicert-upn-host-isolation
Fix DigiCert CA UPN variable substitution cross-host contamination (#40474)
2026-02-27 10:34:46 -05:00
39325-dropdown-bugginess
Fleet UI: Fix dropdown rendering (#40418)
2026-02-26 11:42:00 -05:00
39329-rename-teams-and-queries
Rename teams and queries to fleets and reports in UI (#39572)
2026-02-17 15:19:33 -06:00
39344-deprecate-some-api-fields
Deprecate "team" and "query" API params (#39873)
2026-02-19 13:53:32 -06:00
39419-disable-gitops-edit-fma
Fleet UI (GitOps Mode): Disable edit software modal fields for FMAs, add GitOps tooltips on Save buttons (#39335)
2026-02-06 11:19:35 -05:00
39423-left-align-critical-checkbox-save-policy
Left align Critical checkbox in Save policy modal (#39786)
2026-02-13 16:42:09 -03:00
39437-tarballs-ui-status
Fleet UI: Tarballs and script packages skip recent updates UI statuses (#39437)
2026-02-11 14:07:11 -05:00
39465-transparency-url
Fleet UI: Fix dropdown rendering (#40418)
2026-02-26 11:42:00 -05:00
39522-build-workflow
🤖 Improve build version population based on git branch (#39523)
2026-02-09 08:43:02 -06:00
39608-server-worker
Reworked how we handle server/worker delays to fix flaky tests (#39609)
2026-02-10 20:26:43 -06:00
39613-host-name-not-displayed-hostpage-software-tab
Fixed bug with Host detail software tab page title (#39941)
2026-02-17 13:20:24 -04:00
39737-dup-kernel
Remove duplicate RHEL kernel in os_version (#39746)
2026-02-12 09:13:24 -07:00
39745-notepad-cve
Fixed false negative CVE-2026-20841 on Windows Notepad. (#39931)
2026-02-17 19:54:36 -06:00
39794-alphabetize-host-vitals
Dynamically alphabetize vitals on the host details page (#39946)
2026-02-16 15:31:20 -08:00
39858-use-upgrade-code-for-title-matching
Handle upgrade code in installer software title matching (#40129)
2026-02-20 17:09:41 -05:00
39871-dep-profile-removed
39871: Handle DEP "profile_status": removed events (#40016)
2026-02-18 12:02:19 -05:00
39921-fix-slow-queries-spec-teams
Improve long processing times for POST /api/latest/fleet/spec/fleets (#40100)
2026-02-19 16:05:29 -03:00
40021-ubuntu-python-false-positive
Fixed python package false positives on Ubuntu (#40199)
2026-02-25 15:52:09 -06:00
40024-endpoint-to-create-android-webapp
Android WebApps: endpoint to create one, prevent android app configuration on webApps (#40329)
2026-03-02 15:14:19 -05:00
40028-otel-client-errors
Fixed client-side errors being incorrectly reported as server errors in OTEL telemetry (#40051)
2026-02-19 16:06:00 -06:00
40054-slog-2
Migrating MDM files to slog method signatures. (#40263)
2026-02-23 09:26:58 -06:00
40108-avoid-double-encoding-fleet-secrets
avoid double encoding $FLEET_SECRET in GitOps (#40866)
2026-03-03 14:14:58 -05:00
40124-add-log-topics
Add ability to enable/disable logs by topic (#40126)
2026-02-20 17:22:50 -06:00
40189-update-used-by-heading
Update host "Used by" column heading (#40190)
2026-02-20 12:21:55 -06:00
40284-android-certs
Modified Android certificate renewal logic to make it easier to test. (#40635)
2026-03-02 16:25:48 -08:00
40287-fix-certificate-details-modal-tooltip-alignment
Fix 'rolling' alignment on host vitals and key-value pairs alignment on Certificate details modal (#41124)
2026-03-06 14:02:51 -03:00
40302-support-glob-for-scripts
Support globs in script paths in GitOps (#40799)
2026-03-02 22:18:36 -06:00
40327-filter
always show the filters and search bar (#41163)
2026-03-09 09:05:36 -04:00
40415-conditional-access-critical-policy-rework
Rework conditional access policy bypass conditions to use critical column (#40736)
2026-03-05 17:05:03 -05:00
40433-deprecate-no-team-yml
Allow "unassigned.yml" in GitOps (#40414)
2026-02-26 07:47:12 -06:00
40476-fix-query-results-cleanup-placeholder-limit
Batch select query in CleanupExcessQueryResultRows (#40491)
2026-02-25 18:01:47 -03:00
40488-add-more-aliases
Add aliases for macos fields (#40959)
2026-03-05 18:08:54 -06:00
40489-reorder-host-columns
Reorder columns on Host page (#41180)
2026-03-07 17:32:59 -06:00
40496-detect-unknown-fields
Detect unknown keys in GitOps (phase 1) (#40963)
2026-03-06 16:16:17 -06:00
40564-otel-http-client
Added OTEL instrumentation to Fleet's internal HTTP client. (#40568)
2026-02-26 12:49:52 -06:00
40606-invalidate-software-titles
Fix: Refresh required in order for software inventory to update (#40608)
2026-02-26 14:12:22 -03:00
40641-fix-arch-linux-rolling-tooltip-alignment
Fix 'rolling' alignment on host vitals and key-value pairs alignment on Certificate details modal (#41124)
2026-03-06 14:02:51 -03:00
40685-smallstep-proxy
Added Content-Type header to Smallstep authorization requests (#40686)
2026-02-27 08:37:07 -06:00
40725-fix-macos-setup
Remove "do not enqueue setup experience items >24 hours after enrollment" logic for macOS hosts (#40739)
2026-02-27 16:15:34 -06:00
40789-fix-select-all-header-checkbox
Fix select-all header checkbox not selecting rows in a specific case (#40940)
2026-03-04 11:39:04 -03:00
40807-fix-label-edits-not-reflected-until-refresh
Fix caching issues on Labels and Software name edits (#40815)
2026-03-02 16:38:52 -03:00
40811-fix-software-edit-not-reflected-until-refresh
Fix caching issues on Labels and Software name edits (#40815)
2026-03-02 16:38:52 -03:00
40813-increase-osquery-log-endpoint-body-size
Increase body size limits for osquerylog and osquery/dist/write endpoints (#40946)
2026-03-09 13:49:07 -04:00
40855-policy-replica-lag
Policy automation replica lag (#40906)
2026-03-03 17:44:49 -06:00
40859-update-stored-results-ui
Update stored results setting UI (#40874)
2026-03-04 09:58:27 -06:00
40887-fix-file-permission-self-heal
Fix orbit crash loop on incorrect file permissions (#40887)
2026-03-06 17:41:31 -03:00
40900-allow-omitting-secrets-key-in-gitops
Allow secrets: key to be optional in GitOps (#40901)
2026-03-03 17:16:10 -06:00
40944-fix-gitops-policy-linked-to-software-with-env-var
Bugfix: gitops policy linked to software package with env var fails to apply (#40944)
2026-03-04 14:03:34 -05:00
41006-support-more-globs
Add glob support to more labels, policies and reports (#41141)
2026-03-09 15:39:13 -05:00
41012-allow-omitting-top-level-gitops-keys
Make most GitOps top-level optional (#41138)
2026-03-09 08:56:05 -05:00
41073-update-table-heading-styles
UI: Update table heading and result filter styles (#41072)
2026-03-06 17:41:28 -06:00
41111-fix-table-footer-rendering
Do not show table footer under Target specific hosts table (#41252)
2026-03-09 17:23:44 -03:00
41233-host-software-has-results
Fixed pagination on the host software page incorrectly disabling the "Next" button when a software title has multiple installer versions (#41271)
2026-03-09 16:43:50 -05:00
41242-jit-technician-role
Enable JIT provisioning for Technician role (#41286)
2026-03-10 10:15:01 -03:00
bump-mysql
Bump supported MySQL versions (#40892)
2026-03-04 12:25:20 -06:00
fix-end-user-auth-clear-form
Fix end user auth form: allow saving cleared IdP settings (#40424)
2026-02-27 17:09:54 -03:00
fix-query-results-cleanup-placeholder-limit
Batch select query in CleanupExcessQueryResultRows (#40491)
2026-02-25 18:01:47 -03:00
fix-report-creation-timestamps
Fix report creation response timestamp values (#40195)
2026-02-23 09:14:07 -03:00
host-search-always-match-email
Improve host search by end user email address (#40197)
2026-02-24 11:25:00 -03:00
increase-script-timeout-to-5-hours
Increase script execution timeout from 1 hour to 5 hours (#39939)
2026-02-19 16:36:47 -05:00
issue-14401-update-auth-token-storage
update auth token storage (#40504)
2026-02-26 17:05:13 +00:00
issue-38546-fix-mdm-page-update
fix issue where mdm page wasnt updating properly when turning off apple mdm (#40854)
2026-03-05 17:02:21 +00:00
issue-38654-table-wrapping-mdm-card
fix whitespace wrapping on status table in mdm card on dashboard page (#39955)
2026-02-18 12:00:17 +00:00
issue-39184-apns-banner-fix
show apns expiration banner in UI for free tier (#40936)
2026-03-04 13:12:33 +00:00
issue-39266-update-ui-for-multiple-entra-tenant-ids
add UI for adding and removing multiple microsoft entra tenant ids (#39910)
2026-02-19 13:19:52 +00:00
issue-40684-no-resend-button
allow ios and ipados hosts profiles to be resent (#40684)
2026-02-27 17:03:52 +00:00
issue-40697-fix-os-setting-overflow
fix overflow of button off the table on the os settings modal (#40697)
2026-02-27 17:04:14 +00:00
nats-bump
Bump github.com/nats-io/nats-server/v2 from 2.12.1 to 2.12.3 (#40406)
2026-02-24 12:51:48 -06:00
rds-iam-custom-ca-tls
Allow MySQL IAM authentication when a custom TLS CA/TLS config is set (#39808)
2026-02-18 08:15:29 -06:00
rdsmysql-govcloud-certs
Bump shogo82148/rdsmysql/v2 v2.4.0 to v2.5.0 (#40103)
2026-02-20 10:33:27 -06:00