Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-04-21 13:37:30 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 91
fleet/changes
History
Scott Gress ddc0ee703d
Update policy membership when policy labels change (#39201) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #37182 

# Details

The `policy_membership` table records pass/fail status for each (host,
policy) tuple where the policy targets that host and has run at least
once on the host. It's used to get the # of failing policies for a host,
for the Fleet Desktop icon menu as well as the Policies badge on the
host details page.

When a policy changes materially (e.g. the query changed) we wipe all of
the `policy_membership` records for it, and if the `platform` changes we
_selectively_ wiped records for hosts that no longer met the platform
requirements. This PR adds logic to selectively wipe records for hosts
that no longer meet _label_ requirements when those requirements change.
This fixes issues where a policy would change which labels it applied
to, but hosts that weren't members of the new label set would still show
failures for that policy when clicking the Fleet Desktop icon.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)

## Testing

- [X] Added/updated automated tests
- [X] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [X] QA'd all new/changed functionality manually
2026-02-11 08:56:01 -06:00
..
victor Fixed issue where different variations of the same software weren't linked to the same software title. (#38926) 2026-01-30 23:04:10 +01:00
.keep Issue 1009 calculate diff software (#1305) 2021-07-08 13:57:43 -03:00
13800-obfuscate-calendar-key Obfuscate calendar key (#38687) 2026-01-26 16:59:13 -07:00
13836-cert-batch-del Optimizing certificate template batch delete auth (#38650) 2026-01-24 17:47:17 -06:00
14087-authenticate-carve-block-endpoint-before-parsing-data Authenticate carve block endpoint before parsing the "data" field (#39353) 2026-02-05 15:55:03 -03:00
14115-fix-panic-in-grpc-launcher Fix panic in gRPC launcher API handler (#39409) 2026-02-06 09:31:14 -03:00
14236-bootstrap-puppet Fix bootstrap assignment in preassign endpoint (#39619) 2026-02-10 16:55:00 -05:00
17972-move-entra-instructions #17972 Move Windows automatic enrollment configuration instructions out of Fleet UI (#38949) 2026-01-30 10:05:07 -06:00
25080-show-manage-automations-queries-policies-pages Show Manage Automations disabled button with tooltip on Policies page (#39392) 2026-02-09 15:41:31 -03:00
27432-add-ipod-support Add support for iPods under iOS devices (#27432) 2026-01-29 13:54:37 -05:00
30392-surface-failed-install-details Populate LastInstall for failed installs (#38655) 2026-01-23 18:07:28 -05:00
30691-remove-vpp-install-data-host-delete Remove host's VPP install rows when removing host (#38344) 2026-01-22 13:04:11 -05:00
31160-fix-setting-automation Fleet UI: Fix software/script policy update logic (#38664) 2026-01-28 22:10:25 -05:00
31663-installed-sw-failure Fleet UI: installed sw in inventory do not show failures (#38458) 2026-02-02 12:19:55 -05:00
31922-do-not-send-windows-profiles-atomically Allow <Atomic> windows profiles (#38272) 2026-01-14 14:44:47 -05:00
32619-gitops make generate-gitops export FMAs correctly (#38420) 2026-01-20 16:31:41 -05:00
32965-hash-package-name-filters Add hash_sha256 and package_name filters (#38474) 2026-01-20 09:50:56 -05:00
32997-categories send categories from gitops (#38294) 2026-01-14 11:04:02 -05:00
33005-macvim created mac vim mapping software transformer (#38333) 2026-01-21 12:33:14 -06:00
33272-delete-software-pending-installs-nuance Fleet UI: Clarify delete VPP app pending install nuance (#38376) 2026-01-20 12:49:18 -05:00
33296-disk-encryption Limited disk encryption key escrowing when setting enabled (#39047) 2026-02-02 10:50:30 -06:00
33762-ability-to-set-alternative-browser-host Ability to set fleet desktop alternative browser host in org settings (#38409) 2026-01-19 16:25:22 -04:00
33815-fix-missing-installer-from-inventory-after-wipe-reenroll Bugfix: Fix query to ignore host_software_installs rows where host is deleted (#38250) 2026-01-14 08:32:30 -05:00
34114-packs-page Fleet UI: Styling updates to Packs flow (legacy feature) (#38856) 2026-01-29 09:24:28 -05:00
34359-long-script-names-overflow-tables Long script names overflow tables (#38594) 2026-01-23 16:41:53 -04:00
34398-consistent-icon-buttons Fleet UI: Update icon buttons for consistency (#38639) 2026-01-22 17:21:02 -05:00
34521-dynamic-scep-challenges-for-okta-certs Dynamic SCEP Challenges For Okta Certs (#38908) 2026-01-28 13:28:39 -08:00
34620-trim-app-fix Fixed a bug where certain macOS app names could be ingested as empty strings due to incorrect ".app" suffix removal. (#39563) 2026-02-10 13:03:23 -06:00
34635-fix-cte-syntax-for-frontend Use forked node-sql-parser, fix CTE issues in parsed SQL (#38744) 2026-01-28 16:08:33 -06:00
34990-improve-apns-query-efficiency improve APNS query efficiency (#39614) 2026-02-10 15:40:44 -05:00
35086-fix-pkg-decoder-error 35086 use charset reader xar (#38459) 2026-01-16 17:19:20 -05:00
35141-table-sizes Optionally output database table sizes after migrations complete (#38620) 2026-01-26 17:55:55 -06:00
35191-git-cve-false-positive Fixed false positive git CVEs (#38657) 2026-01-26 12:35:08 -06:00
35192-imp-correct-classification Differentiate between imp and Integrative Modeling Platform (#38396) 2026-01-20 16:39:50 -06:00
35193-libtiff Libtiff false positive vuln (#38703) 2026-01-23 13:08:58 -07:00
35194-safari-cve-false-positives Fixed Safari cve false positives (#38903) 2026-01-29 15:51:01 -06:00
35281-msrc-companion-apps Fixed false positive for msrc companion apps (#38824) 2026-01-28 13:02:31 -06:00
35366-false-negative-adobe-acrobat-reader-dc False negative vulnerability for Adobe Acrobat Reader DC (#39131) 2026-02-05 07:20:16 -04:00
35447-fix-cpe-translation-error-logging Fixed unnecessary error logging when no CPE match is found (#38754) 2026-01-26 13:52:52 -06:00
35603-optimize-query-results Improve performance when recording schedule query results (#38524) 2026-01-27 10:33:47 -06:00
35613-android-profiles-pending Put Android profiles in pending immediately on upload (#39330) 2026-02-04 14:18:06 -05:00
35659-android-profiles-dont-reverify Reverify Android profiles that previously failed (#39025) 2026-02-04 13:08:22 -05:00
35717-dont-enqueue-setup-experience-on-previously-enrolled-hosts Don't run setup experience on host that was previously enrolled (#38318) 2026-01-28 08:44:42 -06:00
36069-fix-patch-categories-software-installer Bugfix: patch categories for software installer (#38334) 2026-01-20 09:39:13 -05:00
36313-fix-timestamps-label-and-teams-creation Fix: incorrect timestamps returned for Label and Team creation (#38846) 2026-01-27 18:02:48 -03:00
36324-fix-permission-issue-custom-software-installer-icon Custom software installer icons: fix permission issue (#38326) 2026-01-14 16:24:05 -05:00
36333-android-google-errors Surface Google err message for policy failures after retries (#38923) 2026-02-04 08:16:29 -05:00
36335-7-zip-false-negative-cve Fixed false negative CVE for 7-Zip installed with MSI installer (#38922) 2026-01-28 14:06:13 -06:00
36342-scroll-yml-in-gitops-mode Fleet UI: Allow users to scroll through disabled yml fields (#38715) 2026-01-26 09:35:22 -05:00
36361-more-debug-logging-for-ca-profiles add additional logging for SCEP proxy and SCEP profiles (#39501) 2026-02-09 14:46:30 -05:00
36541-missing-vpp-version-add-software Fleet UI: Show VPP version for software setup (#38412) 2026-01-15 21:33:52 -05:00
36755-add-activity-for-modified-enroll-secrets Add activity for modified enroll secrets (#39292) 2026-02-07 09:21:10 -04:00
36770-limit-process-dep-cooldowns limit DEP cooldowns to sync limit and order by oldest first (#38535) 2026-01-21 09:25:55 -05:00
36862-fix-flash-message-link-color Fleet UI: Fixed hover color of links in error flash messages (#38634) 2026-01-22 11:25:21 -05:00
37006-fix-broken-disk-space-sort Fleet UI: Fixed broken disk space sort header on hosts table (#38732) 2026-01-26 09:35:43 -05:00
37008-manual-agent-install-only-blocks-macos-se-software manual agent install should only block macOS SE software (#38434) 2026-01-20 11:37:39 -05:00
37072-dep-sync Update server-proto version to 9, implement THROTTLED w/ 24h cooldown (#38920) 2026-01-29 15:31:28 -05:00
37111-ninxsoft-mist-cve Fixed CVE false positive on ninxsoft/Mist. (#38849) 2026-01-28 07:06:39 -06:00
37130-archived-disk-err-msg Add error message for decryption failures (#38919) 2026-02-03 17:08:44 -05:00
37146-create-builtin-label-error-msg Fix: Show error reason when trying to edit a label that conflicts with a built-in label name (#39259) 2026-02-03 17:24:28 -03:00
37155-force-end-user-authentication-host-reenrollment Fix: Deleting a host from Fleet does not delete related IdP records (#38530) 2026-01-28 10:10:00 -03:00
37182-update-policy-membership-when-labels-change Update policy membership when policy labels change (#39201) 2026-02-11 08:56:01 -06:00
37183-unclear-missing-label-error improve missing label error message (#38636) 2026-01-26 12:55:26 -05:00
37219-fix Add help text below InstallerStatusTable to explain the meanings of counts (#38994) 2026-02-05 17:11:09 +01:00
37264-gitops-fma-icons Use custom icons in GitOps for Fleet Maintained Apps (#38497) 2026-01-20 11:56:40 -05:00
37278-okta-fail-my-device-page Redirect to my device page if device fails okta cond. access (#38342) 2026-01-15 11:02:35 -05:00
37290-fix-xcode-vpp-verification Bugfix: apply a special-case for Xcode VPP app verification (#38539) 2026-01-21 17:16:13 -05:00
37464-installer-size Bump installer max size, make configurable (#38122) 2026-01-19 13:36:01 -06:00
37508-gitops-team-software-display_name GitOps: Allow team yml to apply display_name to software package (#38364) 2026-01-20 09:32:25 -05:00
37597-ignore-build-version-compare Fleet UI: Strip build from compareVersion x.x (build x.x) (#38433) 2026-01-16 10:59:46 -05:00
37710-package-parsing Compare pkg-info bundle id with bundles in pkg parsing (#38577) 2026-01-21 13:43:38 -05:00
37804-filtering-fmas Fleet UI: Add Software > FMA table - Add platform and status filter (#37805) 2026-02-04 09:16:11 -05:00
37806-fleet-activities Activity bounded context: /api/latest/fleet/activities (1 of 2) (#38115) 2026-01-19 09:07:14 -05:00
37944-gzip-responses Add gzip support to API handlers (#38675) 2026-01-29 08:21:18 -03:00
37957-pgadmin-vulnerability Fixed false negative CVE for pgAdmin 4. (#38813) 2026-01-28 13:30:44 -06:00
38035-android-reenroll Android app re-enroll on 401 (#38690) 2026-01-27 09:01:01 -07:00
38094-ability-to-set-alternative-browser-host Ability to set fleet desktop alternative browser host in org settings (#38409) 2026-01-19 16:25:22 -04:00
38096-alternative-browser-host-gitops Alternative browser host gitops (#38516) 2026-01-21 10:12:48 -04:00
38205-remove-incorrect-eua-warning-for-macos gate orbit enrollment to windows/linux only (#38207) 2026-01-14 08:41:50 -06:00
38343-use-custom-icon-display-name-in-setup-experience Bugfix: use custom software title icon and display name in setup experience UI (#39223) 2026-02-03 14:56:16 -05:00
38369-ui-mdm-commands-off Hide host MDM commands activity UI when MDM is turned off (#38394) 2026-01-16 11:03:22 -06:00
38452-display-name move deletion into block that only executes when the package itself changes (#38595) 2026-01-21 16:59:40 -05:00
38473-add-ipad-screenshot-in-lock-modal Display iPad screenshot in lock modal (#38475) 2026-01-20 13:26:01 +01:00
38479-otel-shutdown Improved OpenTelemetry tracing (#38483) 2026-01-20 12:22:20 -06:00
38484-fleet-dev-env-vars Only allow FLEET_DEV_* env vars when --dev is passed, allow overriding configs one at a time in dev (#38652) 2026-01-27 14:32:56 -06:00
38534-fleet-activities-2 Activity bounded context: Complete read operations (#38555) 2026-02-09 15:29:12 -06:00
38543-disk-encryption-miscounts 38543 disk encryption miscount (#39497) 2026-02-06 14:45:58 -05:00
38549-okta-cond-access-cert-format Added conditional_access.cert_serial_format server option to allow specifying the Okta conditional access certificate serial format. (#38697) 2026-01-26 12:21:10 -06:00
38554-populate-idp-host-vitals-android Fix: IdP host vitals not automatically populated for Android hosts (#39254) 2026-02-06 09:15:30 -03:00
38557-read-users Global observers and maintainers can now officially read user details (#38558) 2026-01-21 13:55:10 -06:00
38579-micromdm-scep-fix Porting fix from micromdm/scep (#38638) 2026-01-22 13:34:53 -06:00
38582-settings-integration-unfinish-setup-breaks-ui Unfinished Entra integration setup breaks UI (#38847) 2026-02-02 15:29:04 -04:00
38607-otel-logs Added OTEL log export support (#39279) 2026-02-06 18:57:28 -06:00
38622-vpp-metadata-api-server-config Expose VPP metadata bearer token as public config, interact directly with Apple when set (#38817) 2026-01-27 16:50:40 -06:00
38666-hosts-ui-bug #38666: Fix host list UI "jumping" bug (#39022) 2026-01-29 17:02:31 -06:00
38704-fail-ipa-installs Fail in-house app installs when host unenrolls (#38803) 2026-01-26 15:45:52 -05:00
38756-otel-client-errors Improved OpenTelemetry error handling (#38757) 2026-01-26 17:07:32 -06:00
38834-update-apple-os-update-time Change OS update deadline to 7PM local time (#38810) 2026-02-03 09:42:12 -05:00
38878-fully-managed-android Add support for fully-managed android devices (#39388) 2026-02-06 10:46:25 -05:00
38880-capture-mdm-enroll-ref-for-ios-ipados Capture MDM enroll reference for iOS and IPadOS devices (#39020) 2026-01-30 13:38:01 -06:00
38889-slog-1 Created kitlog adapter wrapping slog (#38890) 2026-02-03 20:37:17 -06:00
38911-nextcloud-cve Fixed false positive CVE for Nextcloud Desktop (#39360) 2026-02-05 13:13:38 -06:00
38975-all-teams account for all teams as a value for vpp teams (#39013) 2026-01-29 17:04:02 -05:00
39044-gitops-cal Bugfix: gitops-generate panics when google calendar config is set (#39237) 2026-02-04 14:04:08 -07:00
39048-only-default-if-update-new-hosts-not-explictly-set Only default update_new_hosts key if not explicitly set (#39202) 2026-02-03 12:41:52 -05:00
39158-cert-auth Fixed certificate auth serialization (#39287) 2026-02-04 11:54:53 -06:00
39215-refetch only refetch location data if iDevice is locked (#39241) 2026-02-04 09:23:44 -05:00
39264-entra-tenants Add entra tenant IDs migration (#39420) 2026-02-09 12:48:19 -05:00
39273-filter-button-hover-fix Fix label button hover state (#39425) 2026-02-06 11:06:22 -06:00
39293-smallstep-basic-auth Added changes and test to contributor's fix. (#39390) 2026-02-05 13:13:08 -06:00
39419-disable-gitops-edit-fma Fleet UI (GitOps Mode): Disable edit software modal fields for FMAs, add GitOps tooltips on Save buttons (#39335) 2026-02-06 11:19:35 -05:00
39522-build-workflow 🤖 Improve build version population based on git branch (#39523) 2026-02-09 08:43:02 -06:00
39608-server-worker Reworked how we handle server/worker delays to fix flaky tests (#39609) 2026-02-10 20:26:43 -06:00
39634-bootstrap-migration Add EV to allow bootstrap package install during migration (#39648) 2026-02-11 08:38:11 -05:00
260110-known-mdm-iru Add Iru to list of well known MDMs (#38144) 2026-02-02 19:42:28 -06:00
add-trusted-proxies-config Implement trusted proxies config (#38471) 2026-01-19 22:13:37 -06:00
clear-sessions-and-tokens-on-password-change Clear reset tokens and user sessions after password change (#38999) 2026-02-03 11:14:10 -06:00
go-1.25.7 Update to Go 1.25.7 (#39584) 2026-02-09 17:47:51 -06:00
issue-36935-better-message-error-token improve err message when getting android enrollment token during ota enrollment (#38428) 2026-01-16 16:43:19 +00:00
issue-37371-not-now-status handle NotNow status from device so that it does not block the DEP setup experience flow (#38319) 2026-01-21 15:14:57 +00:00