From 18dd7ccf58ca876f5b70841e1ed2758306816af8 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:25 +0000 Subject: [PATCH 01/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- .../EditAutoUpdateConfigModal/helpers.tsx | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditAutoUpdateConfigModal/helpers.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditAutoUpdateConfigModal/helpers.tsx index bbe8d688914..3f736b4e934 100644 --- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditAutoUpdateConfigModal/helpers.tsx +++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditAutoUpdateConfigModal/helpers.tsx @@ -67,10 +67,7 @@ const validateWindowLength = ( .map(Number); const startTotalMinutes = startHours * 60 + startMinutes; const endTotalMinutes = endHours * 60 + endMinutes; - return ( - endTotalMinutes < startTotalMinutes || - endTotalMinutes - startTotalMinutes >= 60 - ); + return endTotalMinutes - startTotalMinutes >= 60; }; const FORM_VALIDATIONS: IFormValidations = { @@ -188,3 +185,4 @@ export const validateFormData = ( return formValidation; }; + From fdf04c63f135071420242f3dade99a78a3bc9386 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:26 +0000 Subject: [PATCH 02/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- orbit/pkg/table/pmset/pmset_darwin.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/orbit/pkg/table/pmset/pmset_darwin.go b/orbit/pkg/table/pmset/pmset_darwin.go index 65e27363c63..85149196d2d 100644 --- a/orbit/pkg/table/pmset/pmset_darwin.go +++ b/orbit/pkg/table/pmset/pmset_darwin.go @@ -67,6 +67,9 @@ func parsePMSetOutput(output []byte) map[string]interface{} { curKey := "" for scanner.Scan() { line := scanner.Text() + if len(line) == 0 { + continue + } if line[0] != ' ' { curKey = strings.TrimSpace(line) result[curKey] = make(map[string]string) From 3abd25eb0184ab7aa92d476b55da56b3d5b8424a Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:27 +0000 Subject: [PATCH 03/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- .../openframe/20260301000002_AddQueryHostsJoinTable.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/server/datastore/mysql/migrations/openframe/20260301000002_AddQueryHostsJoinTable.go b/server/datastore/mysql/migrations/openframe/20260301000002_AddQueryHostsJoinTable.go index 2a746016f61..28c8c0e6792 100644 --- a/server/datastore/mysql/migrations/openframe/20260301000002_AddQueryHostsJoinTable.go +++ b/server/datastore/mysql/migrations/openframe/20260301000002_AddQueryHostsJoinTable.go @@ -30,5 +30,7 @@ CREATE TABLE IF NOT EXISTS query_hosts ( } func Down_20260301000002(tx *sql.Tx) error { - return nil + _, err := tx.Exec("DROP TABLE IF EXISTS query_hosts;") + return err } + From 56e88282d751fdd593f89084b274222863022838 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:29 +0000 Subject: [PATCH 04/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- server/mdm/nanomdm/test/e2e/certauth.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/mdm/nanomdm/test/e2e/certauth.go b/server/mdm/nanomdm/test/e2e/certauth.go index 142b5303e88..fb15433aa13 100644 --- a/server/mdm/nanomdm/test/e2e/certauth.go +++ b/server/mdm/nanomdm/test/e2e/certauth.go @@ -79,8 +79,8 @@ func certAuthRetro(t *testing.T, ctx context.Context, store storage.CertAuthStor } func expectErr(t *testing.T, have, want error) { + t.Helper() if !errors.Is(have, want) { - t.Helper() t.Errorf("have: %v; want: %v", have, want) } } From fd1b0edd051cb9041e3baf6ac8784a406ef04563 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:30 +0000 Subject: [PATCH 05/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- tools/fleet-mcp/mcp_tools_policies.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tools/fleet-mcp/mcp_tools_policies.go b/tools/fleet-mcp/mcp_tools_policies.go index d0f85ed1490..a6f4549a583 100644 --- a/tools/fleet-mcp/mcp_tools_policies.go +++ b/tools/fleet-mcp/mcp_tools_policies.go @@ -66,6 +66,9 @@ func registerGetPolicyCompliance(s *server.MCPServer, fleetClient *FleetClient) if terr != nil { return mcp.NewToolResultError(fmt.Sprintf("Failed to resolve fleet %q: %v", fleet, terr)), nil } + if len(teamIDs) == 0 { + return mcp.NewToolResultError(fmt.Sprintf("Failed to resolve fleet %q: no matching team found", fleet)), nil + } compliance, err = fleetClient.GetTeamPolicyCompliance(ctx, fmt.Sprintf("%d", teamIDs[0]), policyID) } else { compliance, err = fleetClient.GetPolicyCompliance(ctx, policyID) From e2854c8a2a8a82f8e94c0fd601bac9222c842c25 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:31 +0000 Subject: [PATCH 06/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- ee/cis/macos-14/test/scripts/CIS_2.6.2.sh | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/ee/cis/macos-14/test/scripts/CIS_2.6.2.sh b/ee/cis/macos-14/test/scripts/CIS_2.6.2.sh index 00fc667cbe8..9a4fa6056fa 100644 --- a/ee/cis/macos-14/test/scripts/CIS_2.6.2.sh +++ b/ee/cis/macos-14/test/scripts/CIS_2.6.2.sh @@ -1,16 +1,12 @@ #!/bin/bash -sudo /usr/bin/defaults write /Library/Application\ -Support/CrashReporter/DiagnosticMessagesHistory.plist AutoSubmit -bool false +sudo /usr/bin/defaults write "/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist" AutoSubmit -bool false -sudo /usr/bin/defaults write /Library/Application\ -Support/CrashReporter/DiagnosticMessagesHistory.plist ThirdPartyDataSubmit -bool false +sudo /usr/bin/defaults write "/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist" ThirdPartyDataSubmit -bool false -sudo /bin/chmod 644 /Library/Application\ -Support/CrashReporter/DiagnosticMessagesHistory.plist +sudo /bin/chmod 644 "/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist" -sudo /usr/sbin/chgrp admin /Library/Application\ -Support/CrashReporter/DiagnosticMessagesHistory.plist +sudo /usr/sbin/chgrp admin "/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist" echo "This needs modification" @@ -18,4 +14,4 @@ sudo -u /usr/bin/defaults write /Users//Library/Preferences/com.apple.assistant.support "Siri DataSharing Opt-In Status" -int 2 # Example: -# sudo -u sharonkatz /usr/bin/defaults write /Users/sharonkatz/Library/Preferences/com.apple.assistant.support "Siri Data Sharing Opt-In Status" -int 2 \ No newline at end of file +# sudo -u sharonkatz /usr/bin/defaults write /Users/sharonkatz/Library/Preferences/com.apple.assistant.support "Siri Data Sharing Opt-In Status" -int 2 From 6cf2522a6ee4b8ad2203915210c38aae84b54816 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:32 +0000 Subject: [PATCH 07/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- .../homebrew/scripts/cleanmymac-uninstall.sh | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/ee/maintained-apps/inputs/homebrew/scripts/cleanmymac-uninstall.sh b/ee/maintained-apps/inputs/homebrew/scripts/cleanmymac-uninstall.sh index 5feeec0f936..18657fd9f14 100755 --- a/ee/maintained-apps/inputs/homebrew/scripts/cleanmymac-uninstall.sh +++ b/ee/maintained-apps/inputs/homebrew/scripts/cleanmymac-uninstall.sh @@ -100,14 +100,18 @@ trash() { fi local trash="/Users/$logged_in_user/.Trash" - local file_name="$(basename "${target_file}")" - - if [[ -e "$target_file" ]]; then - echo "removing $target_file." - mv -f "$target_file" "$trash/${file_name}_${timestamp}_${rand}" - else - echo "$target_file doesn't exist." - fi + local file_name + + # Glob-expand target_file (compgen preserves spaces in the path; [[ -e "$x" ]] does not expand *) + while IFS= read -r expanded_file; do + if [[ -e "$expanded_file" ]]; then + file_name="$(basename "${expanded_file}")" + echo "removing $expanded_file." + mv -f "$expanded_file" "$trash/${file_name}_${timestamp}_${rand}" + else + echo "$expanded_file doesn't exist." + fi + done < <(compgen -G "$target_file") } remove_launchctl_service 'com.macpaw.CleanMyMac5.HealthMonitor' @@ -130,3 +134,4 @@ trash $LOGGED_IN_USER '~/Library/LaunchAgents/com.macpaw.CleanMyMac5.Updater.pli trash $LOGGED_IN_USER '~/Library/Logs/com.macpaw.CleanMyMac5' trash $LOGGED_IN_USER '~/Library/Preferences/com.macpaw.CleanMyMac5.plist' trash $LOGGED_IN_USER '~/Library/Saved Application State/com.macpaw.CleanMyMac5.savedState' + From da9c980d280ff7cd204c0704d4524ec3273bf392 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:34 +0000 Subject: [PATCH 08/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- frontend/hooks/useSoftwareInstallerMeta.ts | 6 ------ 1 file changed, 6 deletions(-) diff --git a/frontend/hooks/useSoftwareInstallerMeta.ts b/frontend/hooks/useSoftwareInstallerMeta.ts index 750491ad203..2c66fc2ee71 100644 --- a/frontend/hooks/useSoftwareInstallerMeta.ts +++ b/frontend/hooks/useSoftwareInstallerMeta.ts @@ -93,11 +93,6 @@ export const useSoftwareInstaller = ( 0 ); - const fmaVersions = - isFleetMaintainedApp && "fleet_maintained_versions" in softwareInstaller - ? softwareInstaller.fleet_maintained_versions - : []; - const isCustomPackage = installerType === "package" && !isFleetMaintainedApp; @@ -141,7 +136,6 @@ export const useSoftwareInstaller = ( isAndroidPlayStoreWebApp, isFleetMaintainedApp, isLatestFmaVersion, - fmaVersions, isCustomPackage, isIosOrIpadosApp, sha256, From 9e877022866abab902c0403ee866bb4b15bc83ec Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:35 +0000 Subject: [PATCH 09/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tsx b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tsx index d7e849e5e5f..6b19a5a431d 100644 --- a/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tsx +++ b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tsx @@ -19,7 +19,7 @@ const EmptyOS = (platform: PlatformValueOptions): JSX.Element => ( Date: Mon, 14 Sep 2026 06:51:37 +0000 Subject: [PATCH 10/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- .../pages/labels/ManageLabelsPage/ManageLabelsPage.tsx | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/frontend/pages/labels/ManageLabelsPage/ManageLabelsPage.tsx b/frontend/pages/labels/ManageLabelsPage/ManageLabelsPage.tsx index 55c00e92d16..8739066a8ff 100644 --- a/frontend/pages/labels/ManageLabelsPage/ManageLabelsPage.tsx +++ b/frontend/pages/labels/ManageLabelsPage/ManageLabelsPage.tsx @@ -116,7 +116,15 @@ const ManageLabelsPage = ({ router }: IManageLabelsPageProps): JSX.Element => { repoURL={repoURL} /> ); - }, [currentUser, error, isLoading, labels, onClickAction]); + }, [ + currentUser, + error, + isLoading, + labels, + onClickAction, + labelsGitOpsManaged, + repoURL, + ]); return ( From 92bad795adcbf3b513e758555f67f27d1942978c Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:38 +0000 Subject: [PATCH 11/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- .../InstallSoftwareTable/InstallSoftwareTableConfig.tsx | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/InstallSoftware/components/InstallSoftwareTable/InstallSoftwareTableConfig.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/InstallSoftware/components/InstallSoftwareTable/InstallSoftwareTableConfig.tsx index f5a7247dd49..548fb5dc374 100644 --- a/frontend/pages/ManageControlsPage/SetupExperience/cards/InstallSoftware/components/InstallSoftwareTable/InstallSoftwareTableConfig.tsx +++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/InstallSoftware/components/InstallSoftwareTable/InstallSoftwareTableConfig.tsx @@ -104,14 +104,12 @@ const generateTableConfig = ( let displayedVersion = title.software_package?.version || title.app_store_app?.version; - if (platform === "linux") { + if (platform === "linux" && displayedVersion) { const packageTypeCopy = getSetupExperienceLinuxPackageCopy( title.source ); if (packageTypeCopy) { - displayedVersion = ( - displayedVersion ?? DEFAULT_EMPTY_CELL_VALUE - ).concat(` (.${packageTypeCopy})`); + displayedVersion = displayedVersion.concat(` (.${packageTypeCopy})`); } } return ; From f50f0f564f319cf0d9acf35528f120cb09b1ffa8 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:39 +0000 Subject: [PATCH 12/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- .../components/PolicyErrorsTable/PolicyErrorsTableConfig.tsx | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/frontend/pages/policies/edit/components/PolicyErrorsTable/PolicyErrorsTableConfig.tsx b/frontend/pages/policies/edit/components/PolicyErrorsTable/PolicyErrorsTableConfig.tsx index 0123caf4a7d..1dac6605c3e 100644 --- a/frontend/pages/policies/edit/components/PolicyErrorsTable/PolicyErrorsTableConfig.tsx +++ b/frontend/pages/policies/edit/components/PolicyErrorsTable/PolicyErrorsTableConfig.tsx @@ -72,10 +72,9 @@ const generateTableHeaders = (): IDataColumn[] => { const generateDataSet = memoize( (policyHostsErrorsList: ICampaignError[] = []): ICampaignError[] => { - policyHostsErrorsList = policyHostsErrorsList.sort((a, b) => + return [...policyHostsErrorsList].sort((a, b) => sortUtils.caseInsensitiveAsc(a.host_display_name, b.host_display_name) ); - return policyHostsErrorsList; } ); From a0f7b9f843c3d5c9cebc4d6746e4ac41b8efaf68 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:40 +0000 Subject: [PATCH 13/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- orbit/pkg/keystore/keystore_darwin.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/orbit/pkg/keystore/keystore_darwin.go b/orbit/pkg/keystore/keystore_darwin.go index e97a64f8aef..d02d3224637 100644 --- a/orbit/pkg/keystore/keystore_darwin.go +++ b/orbit/pkg/keystore/keystore_darwin.go @@ -120,7 +120,7 @@ func GetSecret() (string, error) { C.CFDictionaryAddValue(query, unsafe.Pointer(C.kSecClass), unsafe.Pointer(C.kSecClassGenericPassword)) C.CFDictionaryAddValue(query, unsafe.Pointer(C.kSecReturnData), unsafe.Pointer(C.kCFBooleanTrue)) C.CFDictionaryAddValue(query, unsafe.Pointer(C.kSecMatchLimit), unsafe.Pointer(C.kSecMatchLimitOne)) - C.CFDictionaryAddValue(query, unsafe.Pointer(C.kSecAttrLabel), unsafe.Pointer(serviceStringRef)) + C.CFDictionaryAddValue(query, unsafe.Pointer(C.kSecAttrService), unsafe.Pointer(serviceStringRef)) var data C.CFTypeRef status := C.SecItemCopyMatching(C.CFDictionaryRef(query), &data) //nolint:gocritic // dubSubExpr false positive @@ -171,3 +171,4 @@ func stringToCFString(s string) C.CFStringRef { func releaseCFString(s C.CFStringRef) { C.CFRelease(C.CFTypeRef(s)) } + From e2679395b3017414a36362ac60e278b122e224da Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:41 +0000 Subject: [PATCH 14/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- orbit/pkg/table/diskutil/apfs/apfs_darwin.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/orbit/pkg/table/diskutil/apfs/apfs_darwin.go b/orbit/pkg/table/diskutil/apfs/apfs_darwin.go index 541722a68c5..15673ecf106 100644 --- a/orbit/pkg/table/diskutil/apfs/apfs_darwin.go +++ b/orbit/pkg/table/diskutil/apfs/apfs_darwin.go @@ -158,7 +158,7 @@ func PhysicalStoresGenerate(ctx context.Context, queryContext table.QueryContext func parseDiskutilPhysicalStores(out []byte) ([]map[string]string, error) { var m CmdResult if _, err := plist.Unmarshal(out, &m); err != nil { - return nil, err + return nil, fmt.Errorf("parse diskutil apfs list -plist output: %w", err) } rows := make([]map[string]string, 0) From a9b0f1457365332dc7b2be9230f1c5738d220d9f Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:42 +0000 Subject: [PATCH 15/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- pkg/download/download.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/download/download.go b/pkg/download/download.go index b15a2cd75b7..86139e1a05e 100644 --- a/pkg/download/download.go +++ b/pkg/download/download.go @@ -142,7 +142,7 @@ func download(client *http.Client, u *url.URL, path string, extract bool) error } if err := os.Rename(tmpFile.Name(), path); err != nil { - return err + return fmt.Errorf("rename temporary file: %w", err) } moved = true From 8774c3359c40155654f07f6b5974ff84dba4474e Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:43 +0000 Subject: [PATCH 16/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- server/activity/internal/mysql/new_activity.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/server/activity/internal/mysql/new_activity.go b/server/activity/internal/mysql/new_activity.go index 3b1a25d2296..76c99b4e4bc 100644 --- a/server/activity/internal/mysql/new_activity.go +++ b/server/activity/internal/mysql/new_activity.go @@ -113,7 +113,10 @@ func (ds *Datastore) NewActivity( var sb strings.Builder if hostIDs := ah.HostIDs(); len(hostIDs) > 0 { sb.WriteString(insertActHostStmt) - actID, _ := res.LastInsertId() + actID, lastIDErr := res.LastInsertId() + if lastIDErr != nil { + return ctxerr.Wrap(ctx, lastIDErr, "get last insert id for activity") + } for _, hid := range hostIDs { // >>> OPENFRAME(mysql-multitenancy) if stampTeam { From 1f30b5c0d93aa4bb2fa3c2d41a0304bbaefc1a3f Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:45 +0000 Subject: [PATCH 17/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- server/aws_common/iam_auth.go | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/server/aws_common/iam_auth.go b/server/aws_common/iam_auth.go index f07c900467a..0abcdba4e70 100644 --- a/server/aws_common/iam_auth.go +++ b/server/aws_common/iam_auth.go @@ -19,8 +19,9 @@ const ( // IAMTokenCache holds a cached token and its generation time type IAMTokenCache struct { - token string - generated time.Time + token string + generated time.Time + expiryTime time.Duration } // TokenGenerator is a function that generates a new IAM authentication token @@ -45,13 +46,9 @@ func NewIAMAuthTokenManager(tokenGen TokenGenerator) *IAMAuthTokenManager { // GetToken retrieves a valid IAM authentication token, using cache when possible func (m *IAMAuthTokenManager) GetToken(ctx context.Context) (string, error) { - // Calculate expiry time with jitter - jitter := time.Duration(rand.Int63n(int64(maxJitter))) //nolint:gosec // jitter doesn't need cryptographic randomness - expiryTime := tokenRefreshTime + jitter - // Check if we have a valid cached token m.cacheMu.RLock() - if m.cache != nil && time.Since(m.cache.generated) < expiryTime { + if m.cache != nil && time.Since(m.cache.generated) < m.cache.expiryTime { token := m.cache.token m.cacheMu.RUnlock() return token, nil @@ -63,7 +60,7 @@ func (m *IAMAuthTokenManager) GetToken(ctx context.Context) (string, error) { defer m.cacheMu.Unlock() // Double-check in case another goroutine generated a token while we were waiting - if m.cache != nil && time.Since(m.cache.generated) < expiryTime { + if m.cache != nil && time.Since(m.cache.generated) < m.cache.expiryTime { return m.cache.token, nil } @@ -72,9 +69,14 @@ func (m *IAMAuthTokenManager) GetToken(ctx context.Context) (string, error) { return "", err } + // Calculate expiry time with jitter, fixed at generation time + jitter := time.Duration(rand.Int63n(int64(maxJitter))) //nolint:gosec // jitter doesn't need cryptographic randomness + expiryTime := tokenRefreshTime + jitter + m.cache = &IAMTokenCache{ - token: token, - generated: time.Now(), + token: token, + generated: time.Now(), + expiryTime: expiryTime, } return token, nil From a71c6ef93ff17feb839e5d9f7312b57c31152020 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:46 +0000 Subject: [PATCH 18/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- server/datastore/mysql/cron_stats.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/datastore/mysql/cron_stats.go b/server/datastore/mysql/cron_stats.go index a761a197275..613bbdc75bf 100644 --- a/server/datastore/mysql/cron_stats.go +++ b/server/datastore/mysql/cron_stats.go @@ -69,7 +69,7 @@ func (ds *Datastore) UpdateCronStats(ctx context.Context, id int, status fleet.C stmt := `UPDATE cron_stats SET status = ?, errors = ? WHERE id = ?` errorsJSON := sql.NullString{} - if len(*cronErrors) > 0 { + if cronErrors != nil && len(*cronErrors) > 0 { b, err := json.Marshal(cronErrors) if err == nil { errorsJSON.String = string(b) From da6b25fdf474740398304dc86cadfdb83c9dbcb3 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:47 +0000 Subject: [PATCH 19/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- .../migrations/tables/20210601000008_TeamsEnrollSecrets.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/server/datastore/mysql/migrations/tables/20210601000008_TeamsEnrollSecrets.go b/server/datastore/mysql/migrations/tables/20210601000008_TeamsEnrollSecrets.go index 81c45857cb1..8b2f70e7741 100644 --- a/server/datastore/mysql/migrations/tables/20210601000008_TeamsEnrollSecrets.go +++ b/server/datastore/mysql/migrations/tables/20210601000008_TeamsEnrollSecrets.go @@ -57,6 +57,7 @@ func Up_20210601000008(tx *sql.Tx) error { if err != nil { return errors.Wrap(err, "remove duplicate secrets") } + defer rows.Close() type sec struct { secret string count int @@ -71,6 +72,9 @@ func Up_20210601000008(tx *sql.Tx) error { } secretsToReduce = append(secretsToReduce, sec{secret: secret, count: c}) } + if err := rows.Err(); err != nil { + return errors.Wrap(err, "iterating duplicated secrets") + } for _, s := range secretsToReduce { // Remove duplicate secrets if _, err := tx.Exec( From 386ef02e9c75faa5ab6953670036b08da75721b5 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:48 +0000 Subject: [PATCH 20/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- .../tables/20210818151827_RemoveForeignKeysSchedQStats.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/server/datastore/mysql/migrations/tables/20210818151827_RemoveForeignKeysSchedQStats.go b/server/datastore/mysql/migrations/tables/20210818151827_RemoveForeignKeysSchedQStats.go index c856dc620e0..83a30a367bd 100644 --- a/server/datastore/mysql/migrations/tables/20210818151827_RemoveForeignKeysSchedQStats.go +++ b/server/datastore/mysql/migrations/tables/20210818151827_RemoveForeignKeysSchedQStats.go @@ -41,6 +41,7 @@ func constraintsForTable(tx *sql.Tx, table string, referencedTables map[string]s if err != nil { return nil, errors.Wrapf(err, "getting fk for %s", table) } + defer rows.Close() for rows.Next() { var constraintName string var referencedTable sql.NullString @@ -57,6 +58,9 @@ func constraintsForTable(tx *sql.Tx, table string, referencedTables map[string]s constraints = append(constraints, constraintName) } } + if err := rows.Err(); err != nil { + return nil, errors.Wrapf(err, "iterating fk rows for %s", table) + } return constraints, nil } From f68b0a5a9e998c3f383ff8d44e31c9f62574a226 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:49 +0000 Subject: [PATCH 21/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- .../tables/20250701155654_AddEULAHashColumn_test.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/datastore/mysql/migrations/tables/20250701155654_AddEULAHashColumn_test.go b/server/datastore/mysql/migrations/tables/20250701155654_AddEULAHashColumn_test.go index e0cfbcb26cf..6469c5f5475 100644 --- a/server/datastore/mysql/migrations/tables/20250701155654_AddEULAHashColumn_test.go +++ b/server/datastore/mysql/migrations/tables/20250701155654_AddEULAHashColumn_test.go @@ -15,7 +15,7 @@ func TestUp_20250701155654(t *testing.T) { hash := sha256.New() _, _ = hash.Write(eulaBytes) - sha256 := hash.Sum(nil) + expectedHash := hash.Sum(nil) execNoErr(t, db, `INSERT INTO eulas (id, bytes, token, name) VALUES (?, ?, ?, ?)`, @@ -29,5 +29,5 @@ func TestUp_20250701155654(t *testing.T) { err := db.Get(&got, `SELECT sha256 FROM eulas WHERE id = ?`, 1) require.NoError(t, err) - require.True(t, bytes.Equal(got, sha256)) + require.True(t, bytes.Equal(got, expectedHash)) } From d1437ccfd4048dd8bef2dd9355e406b7d982d363 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:50 +0000 Subject: [PATCH 22/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- server/mdm/acme/internal/service/challenge.go | 37 +++++++++++++++---- 1 file changed, 29 insertions(+), 8 deletions(-) diff --git a/server/mdm/acme/internal/service/challenge.go b/server/mdm/acme/internal/service/challenge.go index 39933dc6a50..a321b15fbc6 100644 --- a/server/mdm/acme/internal/service/challenge.go +++ b/server/mdm/acme/internal/service/challenge.go @@ -9,6 +9,7 @@ import ( "encoding/base64" "encoding/pem" "fmt" + "sync" "time" "github.com/fleetdm/fleet/v4/server/contexts/ctxerr" @@ -36,6 +37,31 @@ var ( OIDAppleNonce = asn1.ObjectIdentifier{1, 2, 840, 113635, 100, 8, 11, 1} ) +var ( + appleEnterpriseAttestationRootCAPoolOnce sync.Once + appleEnterpriseAttestationRootCAPool *x509.CertPool + appleEnterpriseAttestationRootCAPoolErr error +) + +func getAppleEnterpriseAttestationRootCAPool() (*x509.CertPool, error) { + appleEnterpriseAttestationRootCAPoolOnce.Do(func() { + rootCABlock, _ := pem.Decode([]byte(appleEnterpriseAttestationRootCA)) + if rootCABlock == nil { + appleEnterpriseAttestationRootCAPoolErr = fmt.Errorf("Failed to parse Apple Enterprise Attestation Root CA certificate") + return + } + rootCA, err := x509.ParseCertificate(rootCABlock.Bytes) + if err != nil { + appleEnterpriseAttestationRootCAPoolErr = fmt.Errorf("Failed to parse Apple Enterprise Attestation Root CA certificate: %s", err.Error()) + return + } + pool := x509.NewCertPool() + pool.AddCert(rootCA) + appleEnterpriseAttestationRootCAPool = pool + }) + return appleEnterpriseAttestationRootCAPool, appleEnterpriseAttestationRootCAPoolErr +} + func (s *Service) ValidateChallenge(ctx context.Context, enrollment *types.Enrollment, account *types.Account, challengeID uint, payload string) (*types.ChallengeResponse, error) { ctx, span := tracer.Start(ctx, "acme.service.ValidateChallenge") defer span.End() @@ -128,16 +154,11 @@ func (s *Service) validateDeviceAttestationChallenge(ctx context.Context, enroll func (s *Service) validateAppleDeviceAttestationStatement(ctx context.Context, enrollment *types.Enrollment, challenge *types.Challenge, attStmt types.AppleDeviceAttestationStatement) error { roots := s.TestAppleRootCAs if roots == nil { - roots = x509.NewCertPool() - rootCABlock, _ := pem.Decode([]byte(appleEnterpriseAttestationRootCA)) - if rootCABlock == nil { - return types.BadAttestationStatementError("Failed to parse Apple Enterprise Attestation Root CA certificate") - } - rootCA, err := x509.ParseCertificate(rootCABlock.Bytes) + pool, err := getAppleEnterpriseAttestationRootCAPool() if err != nil { - return types.BadAttestationStatementError(fmt.Sprintf("Failed to parse Apple Enterprise Attestation Root CA certificate: %s", err.Error())) + return types.BadAttestationStatementError(err.Error()) } - roots.AddCert(rootCA) + roots = pool } if len(attStmt.X5C) < 1 { From 382e42994545535b11fc800cbe756dcfde553835 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:51 +0000 Subject: [PATCH 23/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- server/service/client_appconfig_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/service/client_appconfig_test.go b/server/service/client_appconfig_test.go index 38be22c9ef6..e87525d0f5b 100644 --- a/server/service/client_appconfig_test.go +++ b/server/service/client_appconfig_test.go @@ -64,7 +64,7 @@ func TestValidateOrgLogoFile(t *testing.T) { // fleet.ValidateOrgLogoBytes fires its size check before // image.DecodeConfig, so the body content doesn't need to // decode as a real image. - body := make([]byte, orgLogoMaxFileSize+1) + body := make([]byte, fleet.OrgLogoMaxFileSize+1) err := validateOrgLogoFile(writeTempFile(t, "big.png", body)) require.Error(t, err) assert.ErrorContains(t, err, "100KB or less") From 55a4a6d7cbd11f101960035b51c414ab9a32d387 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:52 +0000 Subject: [PATCH 24/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- tools/mdm/assets/main.go | 9 --------- 1 file changed, 9 deletions(-) diff --git a/tools/mdm/assets/main.go b/tools/mdm/assets/main.go index 2fd34c2870a..728aae166a9 100644 --- a/tools/mdm/assets/main.go +++ b/tools/mdm/assets/main.go @@ -72,15 +72,6 @@ func setupSharedFlags() { } func setupDS(privateKey, userName, password, address, name string) *mysql.Datastore { - db, err := sql.Open( - "mysql", - fmt.Sprintf("%s:%s@tcp(%s)/?multiStatements=true&tls=skip-verify", testUsername, testPassword, testAddress), - ) - if err != nil { - log.Fatal("opening MySQL connection:", err) - } - defer db.Close() - mysqlCfg := config.MysqlConfig{ Username: userName, Password: password, From 76a22bcd3556e65783b4f243128bfcced8cd1f78 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:53 +0000 Subject: [PATCH 25/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- website/assets/js/pages/docs/command-details.page.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/website/assets/js/pages/docs/command-details.page.js b/website/assets/js/pages/docs/command-details.page.js index 4d138fd5f33..439c24591bb 100644 --- a/website/assets/js/pages/docs/command-details.page.js +++ b/website/assets/js/pages/docs/command-details.page.js @@ -22,11 +22,11 @@ parasails.registerPage('command-details', { $('[purpose="copy-button"]').on('click', async function() { let code = $(this).closest('[purpose="codeblock"]').find('pre:visible code').text(); if(code) { + navigator.clipboard.writeText(code); $(this).addClass('copied'); - await setTimeout(()=>{ + setTimeout(()=>{ $(this).removeClass('copied'); }, 2000); - navigator.clipboard.writeText(code); } }); }, From 609d4bdafad820b9640ed4559ac8572d5837ac36 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:54 +0000 Subject: [PATCH 26/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- cmd/osquery-perf/osquery_perf/stats.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/cmd/osquery-perf/osquery_perf/stats.go b/cmd/osquery-perf/osquery_perf/stats.go index 05c3157c87a..26beb35c6a4 100644 --- a/cmd/osquery-perf/osquery_perf/stats.go +++ b/cmd/osquery-perf/osquery_perf/stats.go @@ -273,10 +273,15 @@ func (s *Stats) Log() { s.l.Lock() defer s.l.Unlock() + var errorRate float64 + if s.osqueryEnrollments > 0 { + errorRate = float64(s.errors) / float64(s.osqueryEnrollments) + } + log.Printf( "uptime: %s, error rate: %.2f, osquery enrolls: %d, orbit enrolls: %d, mdm enrolls: %d, distributed/reads: %d, distributed/writes: %d, config requests: %d, result log requests: %d, mdm sessions initiated: %d, mdm on-demand syncs: %d, mdm commands received: %d, config errors: %d, distributed/read errors: %d, distributed/write errors: %d, log result errors: %d, orbit errors: %d, desktop errors: %d, mdm errors: %d, mdm scep requests: %d, mdm scep success: %d, mdm scep errors: %d, ddm tokens success: %d, ddm tokens errors: %d, ddm declaration items success: %d, ddm declaration items errors: %d, ddm activation success: %d, ddm activation errors: %d, ddm configuration success: %d, ddm configuration errors: %d, ddm status success: %d, ddm status errors: %d, buffered logs: %d, script execs (errs): %d (%d), software installs (errs): %d (%d)", time.Since(s.StartTime).Round(time.Second), - float64(s.errors)/float64(s.osqueryEnrollments), + errorRate, s.osqueryEnrollments, s.orbitEnrollments, s.mdmEnrollments, From 55b33dd93f15ee6f4757616877be6a61adf7a395 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:51:55 +0000 Subject: [PATCH 27/40] fix(adhoc-sweep-fixes): 40 review findings across 40 files --- frontend/pages/DashboardPage/cards/WelcomeHost/WelcomeHost.tsx | 1 + 1 file changed, 1 insertion(+) diff --git a/frontend/pages/DashboardPage/cards/WelcomeHost/WelcomeHost.tsx b/frontend/pages/DashboardPage/cards/WelcomeHost/WelcomeHost.tsx index 69a82e4550c..2ff06b65db2 100644 --- a/frontend/pages/DashboardPage/cards/WelcomeHost/WelcomeHost.tsx +++ b/frontend/pages/DashboardPage/cards/WelcomeHost/WelcomeHost.tsx @@ -229,6 +229,7 @@ const WelcomeHost = ({ if (p.response) { return (