Juan Fernandez aeb56916ee Block host enrollment with empty enroll secrets ...

VerifyEnrollSecret matched by exact string, so an empty enroll_secret
matched any stored empty secret and issued a valid node key. Guard the
shared chokepoint: reject empty/whitespace secrets before matching,
closing all enrollment paths (osquery, Orbit, Apple MDM, Android). Add a
migration to delete pre-existing empty secrets.

2026-07-24 10:29:46 -04:00

..

.keep

…

4842-search-public-ip

…

16770-mfa-token-race

Make MFA token redemption atomic to prevent multiple sessions

2026-07-23 09:52:07 -04:00

16771-gitops-team-secret-leak

Mask team enroll secrets in team write responses (#49422)

2026-07-17 16:45:40 -04:00

16774-setup-experience-script-activities

Emit created/deleted activities for setup experience scripts

2026-07-23 06:41:51 -04:00

16778-scim-deprovisioning-mutated-identifiers

Fix SCIM deprovisioning edge case during user deactivation

2026-07-21 11:33:08 -04:00

16779-secret-variable-spec-activities

Added audit activities when secret variables are upserted

2026-07-16 18:54:04 -04:00

16783-sso-invite-password-acceptance

Harden user creation from invite

2026-07-22 07:29:15 -04:00

16788-race-condition-one-time-installer-token

Fix race condition in one-time software installer download token

2026-07-21 11:33:46 -04:00

16789-modify-label-atomic-membership

Fix label update consistency issue

2026-07-23 06:41:07 -04:00

16793-scim-forbidden-last-request

Fix SCIM middleware persisting authorization failures to last_request

2026-07-21 11:32:36 -04:00

16794-login-password-oracle-mfa

Normalize login responses for MFA-enabled accounts

2026-07-23 06:41:27 -04:00

16799-password-reset-token-race

Harden password reset token handling

2026-07-22 12:46:16 -04:00

16800-reject-empty-enroll-secrets

Block host enrollment with empty enroll secrets

2026-07-24 10:29:46 -04:00

16880-windows-tos-redirect-uri-xss

Added redirect_uri validation for Windows TOS endpoint. (#49699)

2026-07-22 09:24:40 -05:00

23242-apple-byod-enrollment-permissions

…

25217-turn-off-mdm-offline-macos

…

25574-splunk-log-destination

…

28108-multiple-custom-packages

add changes

2026-07-10 14:37:59 -04:00

31294-windows-host-certificates

…

34368-searchable-fleets-dropdown

Fleet UI: Searchable fleets dropdown with add-fleet affordance (#49690)

2026-07-23 07:26:04 -07:00

34591-add-cachyos-support

…

34984-spinner-elevated-background

Fleet UI: Remove elevated background on loading spinner (#49289)

2026-07-15 06:56:32 -07:00

35075-android-os-versions-vulnerabilities

Software > OS: Show Android versions and vulnerabilities (#49399)

2026-07-16 10:37:57 -04:00

35328-update-text-link-styles

Update CustomLink styles (#48838)

2026-07-13 17:07:39 +02:00

37972-improve-settings-subnav

Show individual settings sections in user menu (#48197)

2026-07-16 06:34:46 -05:00

38214-clarify-vitals-refetch-timeout-banner

Update host vitals refresh error banner (#49526)

2026-07-17 14:53:00 -07:00

38214-improve-ux-delayed-host-vitals-refetch

Update the refetching host error banner to reflect uncertainty (#49382)

2026-07-16 08:47:55 -07:00

38806-macos-iosipados-rename-hosts

macOS & iOS/iPadOS: Rename hosts

2026-07-14 10:28:19 -04:00

38874-macos-enroll-url

…

38986-support-ddm-assets

…

39346-certificates-list

…

40410-webhook-url-validation-onblur.md

…

40639-non-proxied-cert-renewal

Docs: non-proxied cert renewal (#45695)

2026-07-10 17:37:50 -05:00

41056-remove-windows-sts-auth-endpoint.md

…

41470-python-script-only-packages

Allow Python script-only packages (#49070)

2026-07-16 14:20:03 -04:00

41790-citrix-ltsr-cumulative-updates

…

42473-sso-button-overflow

…

42827-macos-mdm-certificate-ingestion

Docs: non-proxied cert renewal (#45695)

2026-07-10 17:37:50 -05:00

43097-more-detailed-error-without-server-private-key

Surface a more detailed error message if user doesn't have server_private_key configured (#49238)

2026-07-14 11:52:15 -07:00

43328-python3-prefix-cpe

Fix CPE matching for python3-prefixed packages on Ubuntu/Debian (#48599)

2026-07-13 09:46:49 -04:00

43379-windows-mdm-end-user-experience-labels

…

43518-enable-disk-encryption-bitlocker

…

44199-embedded-bundle-title-name

…

44352-500-error-page

…

44428-tpm-backed-disk-encryption.md

…

44624-policies-automations-filter-unassigned

Fix Policies automations filter disappearing for the Unassigned fleet (#49224)

2026-07-13 15:58:53 -03:00

44800-ollama-resolved-in-version

…

44954-custom-host-vitals.md

44954 custom host vitals (#49334)

2026-07-15 19:35:27 -03:00

45524-macos-password-sync

…

45550-surface-windows-scep-proxy-failures.md

…

45650-windows-mdm-command-results-insert-perf.md

…

45682-cache-control-static-assets

…

45710-zorin-os-support

…

45729-self-service-show-version

Add installed and available versions to self-service (#47526)

2026-07-16 06:33:05 -05:00

46057-vpp-tokens-maintainer-authz

…

46077-newly-created-reports-do-not-show-up

Refresh reports list cache after report create/update (#49402)

2026-07-16 10:46:35 -03:00

46193-duplicate-patch-policy-gitops-check

…

46227-luks-key-escrow-any-slot

…

46235-dep-syncer-cursor-not-advanced-on-callback-error

…

46282-handle-client-error-decoding-errors

handle client error decoding errors in ACME urls (#49137)

2026-07-10 12:31:17 -04:00

46380-ndes-error-location

Fix NDES invalid credentials error to point to correct settings location (#49298)

2026-07-15 12:34:59 -04:00

46387-windows-mdm-enrollment-auth-error

…

46399-query-errors-can-cause-label-membership-unassigned.md

Fix label membership being cleared when a label query errors (#49403)

2026-07-20 10:31:09 -03:00

46644-bypass-end-user-auth

Flag to bypass end user auth (#49683)

2026-07-22 15:32:58 -05:00

46811-citrix-workspace-cpe

…

46959-fpsso-configure-ui

46959 Add Account Provisioning settings to UI for FPSSO configuration (#47655)

2026-07-10 16:19:47 -04:00

46965-time-ago-timestamps-use-days

…

47303-redis-moved-errors-query-results-counts

…

47388-getclientconfig-nil-map-panic

…

47430-specific-API-endpoints-search-improvements

Fix Add API-only user > Specific API endpoints table search (#49613)

2026-07-22 08:10:02 -07:00

47488-render-mysql-version

…

47530-my-device-policy-click-highlight

Fleet UI: Remove blue click flash on clickable table rows (#49228)

2026-07-14 07:47:28 -07:00

47626-use-generated-uuid-for-mdm_idp_account

Use generated UUID for mdm_idp_account table on Linux and Windows (#49215)

2026-07-13 14:43:39 -03:00

47633-release-ab-device

Release from AB backend support (#49680)

2026-07-22 20:01:41 +02:00

47661-hosts-online-chart-include-mobile-by-default

…

47683-windows-mdm-fleetd-install-ordering

…

47699-entra-conditional-access-self-hosted

Allow Microsoft conditional access on premium self-hosted (#49414)

2026-07-17 10:59:32 -03:00

47722-host-device-mapping-reader-load

…

47922-fix-jumping-symbol

Disable Inter contextual alternates in input fields (#49358)

2026-07-15 16:37:51 -04:00

47943-premium-calls-on-fleet-free

…

47963-enroll-500-os-updates-settings-not-found

Fix 500 on Apple MDM enroll when host has no DEP assignment (#47963) (#49623)

2026-07-22 09:18:57 -05:00

48003-trim-whitespace-mdm-sso

trim MDM SSO whitespace in GitOps and API (#49378)

2026-07-22 19:19:48 +02:00

48054-fma-duplicate-software-titles

…

48077-observer-managed-account-action.md

…

48102-fix-msix-detecting-as-ipa

…

48125-tooltip-not-showing-idp

…

48129-404-page

…

48177-rename-create-buttons-to-add

…

48226-gitops-android-mdm-buttons

Gitops mode disables android MDM connect and turn off buttons (#49685)

2026-07-22 11:31:27 -04:00

48229-inconsistent-font-size-tooltip

…

48314-updated-missed-abm-references

…

48340-windows-config-profiles-summary-scale

Improved the performance of the configuration profiles status summary (#48873)

2026-07-23 11:59:37 -05:00

48342-edit-config-profile-endpoint

48342 edit config profile endpoint (#49141)

2026-07-21 08:20:03 -04:00

48349-windows-batch-modify-async

…

48379-android-serial-hosts-page

Show managed Android serial number on Hosts page (#49711)

2026-07-21 16:50:46 -04:00

48448-remove-bomutils-docker

Drop Docker fleetdm/bomutils dependency in fleetctl when generating pkg fleetd installers (#48915)

2026-07-15 10:14:57 -03:00

48485-hide-install-all-on-all-category

Supress install all for all/undefined software category (#48999)

2026-07-13 10:51:12 -04:00

48486-scep-renew

…

48497-cron-interrupted-run-status

…

48531-dark-mode-hover-state

Fix invisible hover state in dark mode (#49001)

2026-07-10 12:48:12 -04:00

48542-table-reload-on-window-focus

Fix tables losing row selection on window focus (#48742)

2026-07-13 13:10:33 -03:00

48567-user-scoped-declarations

…

48614-hide-empty-self-service-categories

…

48641-policies-empty-page-after-delete

…

48653-empty-ab-when-only-updated-via-ui

create new appCfg entry on AB fleet updates if not found (#49559)

2026-07-21 21:33:36 +02:00

48685-mdm-enrolled-host-usage-stats

…

48689-firefox-developer-edition-cpe.md

Generate CPE for Firefox Developer Edition on macOS

2026-07-22 08:04:38 -04:00

48752-windows-reserved-locuri-scopeless-bypass

…

48845-dont-reconcile-profiles-for-non-mdm-enrolled-hosts

Don't queue profiles for non host_mdm.enrolled Apple hosts (#49611)

2026-07-21 21:33:29 +02:00

48883-nano-queue-index

Add better index to nano_enrollment_queue (#48865)

2026-07-10 15:51:14 -04:00

48914-ab-toast-org-name.md

Show ABM organization name in edit-fleets success toast (#49877)

2026-07-24 13:30:57 +05:30

48948-delete-cert-modal-overflow

…

48951-certificate-ca-dropdown-scep-only

Filter Add certificate CA dropdown to custom SCEP only (#49020)

2026-07-10 11:14:28 -06:00

48960-android-os-updates-mdm-message

Clarify which OS supports OS Updates (#49716)

2026-07-22 10:48:28 -04:00

48987-vulnerabilities-tooltip

Fleet UI: Show tooltip for truncated vulnerabilities list in Update details modal (#49236)

2026-07-13 15:37:07 -07:00

49134-windows-esp-user-release-retry

Fix Windows Autopilot ESP hang: gate release on user-scope ack (#49134) (#49542)

2026-07-21 09:03:54 -05:00

49260-swupdate

Speculative fix for iOS/iPadOS enrollment w/ required sw update (#49280)

2026-07-15 17:52:57 -07:00

49276-secondary-subdued-button-styles

Clear button styles (#49292)

2026-07-23 07:11:59 -05:00

49297-free-tier-linux-summary-cards

Fleet UI: Restore dashboard cards hidden despite the API returning their data (#49349)

2026-07-15 13:22:13 -07:00

49329-windows-discovery-request-version

Windows MDM: accept discovery RequestVersion >= 4.0 (#49329) (#49380)

2026-07-15 17:42:22 -07:00

49474-fix-patch-policy-query-not-updating

Fix FMA pinning not changing patch policy (#49519)

2026-07-17 19:00:13 -04:00

49475-failed-installs-reported-successful

Fix false-success reporting for failed software installs (#49515)

2026-07-17 17:59:14 -04:00

49489-custom-host-vitals-in-name-templates

Support custom host vitals in host name templates (#49586)

2026-07-22 09:38:24 -03:00

49495-stale-fma-installer-version

Redirect FMA installs to the active version after auto-update (#49525)

2026-07-18 06:01:45 -04:00

49682-firefox-esr-conflict-message

Add clear error for Firefox / Firefox ESR conflict (#49714)

2026-07-23 12:39:17 -04:00

49756-revert-scep-challenge-printable-validation

Reverting printableCharacters SCEP validation (#49758)

2026-07-22 13:46:47 -05:00

add-missing-error-fma-dynamic-policy

…

allow-network-blocking-bypass-in-prod

Allow bypassing network blocking in production via config (#49747)

2026-07-22 13:23:21 -03:00

api-endpoints-add-reports-run

…

batch-extension-label-check

Batch extension label-membership checks in GetOrbitConfig (#49154)

2026-07-15 09:55:54 -04:00

cache-pack-config-json

Cache pack config JSON per team to reduce redundant marshaling (#48702)

2026-07-13 13:51:02 -04:00

cis-win10-benchmark-v4

Update Windows 10 CIS benchmark policies to v4.0.0 (#48986)

2026-07-13 12:52:38 -04:00

fix-48277-live-results-translate-crash

…

fix-49438-issues-count-text-cursor

Fleet UI: Drop I-beam cursor on non-underlined tooltips (#49859)

2026-07-24 07:01:48 -07:00

fix-49441-free-tier-empty-summary-card

Fleet UI: Hide empty host summary card on Free-tier Android hosts (#49848)

2026-07-23 12:54:18 -07:00

fix-chart-api-only-enforcement

Enforce API-only endpoint restrictions on chart routes (#49477)

2026-07-23 10:44:13 -04:00

fix-delete-host-response-mismatch

Stop the delete host endpoint from revealing out-of-fleet host existence (#49645)

2026-07-22 11:12:16 -03:00

fix-enroll-page-styling

Fix enroll page and Add hosts modal styling issues (#48968)

2026-07-14 17:32:04 -07:00

fix-hosts-software-title-filter-response

Stop leaking cross-team software title names via the hosts endpoint (#49638)

2026-07-24 10:39:13 -03:00

fix-macos-software-memory-recursive-cask-glob

…

fix-undeletable-ddm-declarations.md

Fix undeletable Apple DDM declarations when allowed types change (#49810)

2026-07-24 11:10:38 +05:30

friendly-base64-error-mobileconfig

…

gitops-windows-profiles-mdm-state

…

missing-keyboard-accessibility-os-settings

Fix resend button not showing on keyboard navigation in OS settings modal (#49728)

2026-07-22 16:12:29 +02:00

my-device-applications-filter

Add macOS app filter to My device software (#48637)

2026-07-13 09:08:26 -05:00

normalize-locuri-validation

Normalize LocURI values before validation in Windows profiles (#49708)

2026-07-21 17:20:53 -04:00

optimize-query-aggregated-stats

…

policies-targeted-platforms-filter

Add Targeted platforms column and platform filter to Policies page (#44125)

2026-07-10 13:32:16 -05:00

scim-admin-only-access

…

scim-idp-associate-all-matching-hosts

…

stale-policy-membership-cleanup.md

…