flamingo-stack · flamingo · Sep 21, 2026 · Sep 21, 2026 · Sep 21, 2026 · Sep 21, 2026
diff --git a/ee/maintained-apps/ingesters/homebrew/external_refs/cisco_jabber_version_transformer.go b/ee/maintained-apps/ingesters/homebrew/external_refs/cisco_jabber_version_transformer.go
@@ -4,9 +4,10 @@ import (
 	maintained_apps "github.com/fleetdm/fleet/v4/ee/maintained-apps"
 )
 
-// CiscoJabberVersionTransformer sets the version to "15.2.0" which matches what osquery reports.
-// Homebrew reports a build number (e.g., "20251027035315") instead of the app version (e.g., "15.2.0").
+// CiscoJabberVersionTransformer sets the version to "15.2.1" which matches what osquery reports.
+// Homebrew reports a build number (e.g., "20251027035315") instead of the app version (e.g., "15.2.1").
 func CiscoJabberVersionTransformer(app *maintained_apps.FMAManifestApp) (*maintained_apps.FMAManifestApp, error) {
 	app.Version = "15.2.1"
 	return app, nil
 }
+
diff --git a/ee/tools/puppet/fleetdm/lib/puppet/util/fleet_client.rb b/ee/tools/puppet/fleetdm/lib/puppet/util/fleet_client.rb
@@ -175,7 +175,7 @@ def req(method: :get, path: '', body: nil, headers: {}, cached: false, environme
           end
         end
       rescue => e
-        out['error'] = e
+        out['error'] = e.message
       end
 
       out
@@ -196,7 +196,7 @@ def parse_response(response)
         message = 'server returned a non-ok status code without an error'
 
         if response.body
-          body = JSON.parse(response.body)
+          body = out['body']
           message = body['message']
 
           unless body['errors'].nil?

diff --git a/frontend/components/LiveQuery/SelectTargets.tsx b/frontend/components/LiveQuery/SelectTargets.tsx
@@ -290,6 +290,8 @@ const SelectTargets = ({
     // this effect every render, which dispatches a context update and causes an
     // infinite render loop ("Maximum update depth exceeded"), freezing the
     // Select targets UI (e.g. the X to remove a host stops responding).
+    // TODO: memoize `setSelectedTargets` at its source in QueryContext so this
+    // effect can safely include it in its dependency array.
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [targetedHosts, targetedLabels, targetedTeams]);
 
@@ -318,7 +320,9 @@ const SelectTargets = ({
     // if the target was previously selected, we want to remove it now
     let newTargets = prevTargets.filter((t) => t.id !== selectedEntity.id);
     // if the length remains the same, the target was not previously selected so we want to add it now
-    prevTargets.length === newTargets.length && newTargets.push(selectedEntity);
+    if (prevTargets.length === newTargets.length) {
+      newTargets.push(selectedEntity);
+    }
 
     // Logic when to deselect/select "all hosts" when using more granulated filters
     // If "all hosts" is selected

diff --git a/frontend/pages/DashboardPage/cards/Software/Software.tsx b/frontend/pages/DashboardPage/cards/Software/Software.tsx
@@ -97,7 +97,7 @@ const Software = ({
                   data={(isSoftwareEnabled && software?.software) || []}
                   isLoading={isSoftwareFetching}
                   pageIndex={softwarePageIndex}
-                  defaultSortHeader={SOFTWARE_DEFAULT_SORT_DIRECTION}
+                  defaultSortHeader={SOFTWARE_DEFAULT_SORT_HEADER}
                   defaultSortDirection={SOFTWARE_DEFAULT_SORT_DIRECTION}
                   resultsTitle="software"
                   emptyComponent={() => <EmptySoftwareTable />}

diff --git a/...ontrolsPage/OSSettings/cards/ConfigurationProfiles/components/ProfileUploader/helpers.tsx b/...ontrolsPage/OSSettings/cards/ConfigurationProfiles/components/ProfileUploader/helpers.tsx
@@ -94,7 +94,7 @@ const generateGenericLearnMoreErrMsg = (errMsg: string) => {
  */
 // eslint-disable-next-line import/prefer-default-export
 export const getErrorMessage = (err: AxiosResponse<IApiError>) => {
-  const apiReason = err?.data?.errors?.[0]?.reason;
+  const apiReason = err?.data?.errors?.[0]?.reason ?? "";
 
   if (apiReason.includes("should include valid JSON")) {
     return "Couldn't add. The profile should include valid JSON.";

diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilities.tsx b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilities.tsx
@@ -178,7 +178,7 @@ const SoftwareVulnerabilities = ({
         };
 
         // Handle 400 response which is an invalid CVE format
-        if (error.status === 400) {
+        if (error.response?.status === 400) {
           if (
             error?.data?.errors &&
             error.data.errors[0].reason.includes(
@@ -198,7 +198,7 @@ const SoftwareVulnerabilities = ({
           }
 
           // Handle 404 response which is BE validated CVE string but not a known CVE
-        } else if (error.status === 404) {
+        } else if (error.response?.status === 404) {
           if (
             error?.data?.errors &&
             (error.data.errors[0].reason.includes("This is not a known CVE.") ||
@@ -234,7 +234,7 @@ const SoftwareVulnerabilities = ({
     if (isExactMatchQuery) {
       refetchExactMatch();
     }
-  }, [queryParams.exploit, isExactMatchQuery]);
+  }, [queryParams.exploit, isExactMatchQuery, refetchExactMatch]);
 
   // !tableData is used to show the Spinner only on the first render.
   // This prevents the Spinner from flashing on every data refresh, noticable

diff --git a/frontend/pages/hosts/details/cards/User/helpers.tsx b/frontend/pages/hosts/details/cards/User/helpers.tsx
@@ -38,7 +38,7 @@ export const generateGroupsValues = (endUsers: IHostEndUser[]) => {
     return [];
   }
 
-  return endUser.idp_groups.sort((a, b) => {
+  return [...endUser.idp_groups].sort((a, b) => {
     return a.localeCompare(b);
   });
 };
@@ -106,3 +106,4 @@ export const generateGroupsTipContent = (endUsers: IHostEndUser[]) => {
 
   return null;
 };
+
diff --git a/infrastructure/loadtesting/terraform/infra/secrets.tf b/infrastructure/loadtesting/terraform/infra/secrets.tf
@@ -4,4 +4,4 @@ data "aws_secretsmanager_secret" "license" {
 
 data "aws_secretsmanager_secret_version" "enroll_secret" {
   secret_id = data.terraform_remote_state.shared.outputs.enroll_secret.id
-}
+}
diff --git a/orbit/pkg/table/app_sso_platform/app_sso_platform_darwin.go b/orbit/pkg/table/app_sso_platform/app_sso_platform_darwin.go
@@ -232,7 +232,7 @@ func parseAppSSOPlatformCommandOutput(output []byte, expectedExtensionIdentifier
 	}
 	realm, ok := realm_.(string)
 	if !ok {
-		return nil, fmt.Errorf("unexpected type for \"realm\" key in \"kerberosStatus\": %T", err)
+		return nil, fmt.Errorf("unexpected type for \"realm\" key in \"kerberosStatus\": %T", realm_)
 	}
 	upn_, ok := userConfig.KerberosStatus[0]["upn"]
 	if !ok {

diff --git a/server/datastore/filesystem/software_installer.go b/server/datastore/filesystem/software_installer.go
@@ -119,7 +119,8 @@ func (i *SoftwareInstallerStore) Cleanup(ctx context.Context, usedInstallerIDs [
 
 		info, err := de.Info()
 		if err != nil {
-			return 0, ctxerr.Wrap(ctx, err, "get software installer modtime in filesystem store")
+			errs = append(errs, err)
+			continue
 		}
 		if info.ModTime().After(removeCreatedBefore) {
 			continue

diff --git a/server/datastore/mysql/conditional_access_microsoft.go b/server/datastore/mysql/conditional_access_microsoft.go
@@ -93,6 +93,7 @@ func (ds *Datastore) LoadHostConditionalAccessStatus(ctx context.Context, hostID
 		if errors.Is(err, sql.ErrNoRows) {
 			return nil, ctxerr.Wrap(ctx, notFound("HostConditionalAccessStatus").WithID(hostID))
 		}
+		return nil, ctxerr.Wrap(ctx, err, "getting host conditional access status")
 	}
 	hostConditionalAccessStatus.OSVersion = strings.TrimPrefix(hostConditionalAccessStatus.OSVersion, "macOS ")
 	if strings.HasPrefix(hostConditionalAccessStatus.OSVersion, "Windows") {

diff --git a/server/datastore/mysql/host_identity_scep.go b/server/datastore/mysql/host_identity_scep.go
@@ -19,12 +19,12 @@ import (
 
 func (ds *Datastore) GetHostIdentityCertBySerialNumber(ctx context.Context, serialNumber uint64) (*types.HostIdentityCertificate, error) {
 	var hostIdentityCert types.HostIdentityCertificate
-	err := sqlx.GetContext(ctx, ds.reader(ctx), &hostIdentityCert, fmt.Sprintf(`
+	err := sqlx.GetContext(ctx, ds.reader(ctx), &hostIdentityCert, `
 		SELECT serial, host_id, name, not_valid_after, public_key_raw
 		FROM host_identity_scep_certificates
-		WHERE serial = %d
+		WHERE serial = ?
 			AND not_valid_after > NOW()
-			AND revoked = 0`, serialNumber))
+			AND revoked = 0`, serialNumber)
 	switch {
 	case errors.Is(err, sql.ErrNoRows):
 		return nil, notFound("host identity certificate")

diff --git a/server/datastore/mysql/migrations/tables/20240222073518_AddCertInfoToNanoCertAssociations.go b/server/datastore/mysql/migrations/tables/20240222073518_AddCertInfoToNanoCertAssociations.go
@@ -94,9 +94,13 @@ func updateCertAssociationTimestamps(txx *sqlx.Tx, limit, offset int) error {
 	expiries := make(map[string]time.Time, len(scepCerts))
 	for i, rawCert := range scepCerts {
 		block, _ := pem.Decode(rawCert.CertificatePEM)
+		if block == nil {
+			log.Printf("failed to decode PEM for certificate with serial %s", rawCert.Serial)
+			continue
+		}
 		cert, err := x509.ParseCertificate(block.Bytes)
 		if err != nil {
-			log.Printf("failed to parse certificate with serial %s", rawCert.Serial)
+			log.Printf("failed to parse certificate with serial %s: %v", rawCert.Serial, err)
 			continue
 		}
 
@@ -123,6 +127,10 @@ func updateCertAssociationTimestamps(txx *sqlx.Tx, limit, offset int) error {
 		return fmt.Errorf("failed to retrieve cert associations: %w", err)
 	}
 
+	if len(assocs) == 0 {
+		return nil
+	}
+
 	var sb strings.Builder
 	updateAssocArgs := make([]any, len(assocs)*3)
 	for i, assoc := range assocs {

diff --git a/server/datastore/mysql/migrations/tables/20240314085226_AddCalendarEventTables.go b/server/datastore/mysql/migrations/tables/20240314085226_AddCalendarEventTables.go
@@ -22,14 +22,19 @@ func Up_20240314085226(tx *sql.Tx) error {
 		event JSON NOT NULL,
 
 		created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-		updated_at TIMESTAMP NOT NULL NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+		updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
 
 		UNIQUE KEY idx_one_calendar_event_per_email (email)
 	) DEFAULT CHARSET = utf8mb4 COLLATE = utf8mb4_unicode_ci;
 `); err != nil {
 		return fmt.Errorf("create calendar_events table: %w", err)
 	}
 
+	// Note: host_id intentionally does not have a foreign key constraint to the
+	// hosts table. Hosts can be deleted and re-enrolled (churn/replacement), and
+	// host_calendar_events rows referencing a deleted host_id are cleaned up by
+	// application logic rather than a DB-level cascade, to avoid tying calendar
+	// event bookkeeping lifecycle directly to host deletion.
 	if _, err := tx.Exec(`
 	CREATE TABLE IF NOT EXISTS host_calendar_events (
 		id INT(10) UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
@@ -38,7 +43,7 @@ func Up_20240314085226(tx *sql.Tx) error {
 		webhook_status TINYINT NOT NULL,
 
 		created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-		updated_at TIMESTAMP NOT NULL NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+		updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
 
 		UNIQUE KEY idx_one_calendar_event_per_host (host_id),
 		FOREIGN KEY (calendar_event_id) REFERENCES calendar_events(id) ON DELETE CASCADE

diff --git a/server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls.go b/server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls.go
@@ -56,7 +56,7 @@ func Up_20240826160025(tx *sql.Tx) error {
 		return fmt.Errorf("failed to find host_software_installs to remove: %w", err)
 	}
 	if len(ids) > 0 {
-		stmt, args, err := sqlx.In("UPDATE host_software_installs SET removed = 1	WHERE id IN (?)", ids)
+		stmt, args, err := sqlx.In("UPDATE host_software_installs SET removed = 1 WHERE id IN (?)", ids)
 		if err != nil {
 			return fmt.Errorf("failed to expand slice value for host_software_installs: %w", err)
 		}
@@ -87,7 +87,7 @@ func Up_20240826160025(tx *sql.Tx) error {
 		return fmt.Errorf("failed to find host_vpp_software_installs to remove: %w", err)
 	}
 	if len(vppIDs) > 0 {
-		stmt, args, err := sqlx.In("UPDATE host_vpp_software_installs SET removed = 1	WHERE id IN (?)", vppIDs)
+		stmt, args, err := sqlx.In("UPDATE host_vpp_software_installs SET removed = 1 WHERE id IN (?)", vppIDs)
 		if err != nil {
 			return fmt.Errorf("failed to expand slice value for host_vpp_software_installs: %w", err)
 		}

diff --git a/...astore/mysql/migrations/tables/20241125150614_AddAppConfigWindowsMigrationEnabledField.go b/...astore/mysql/migrations/tables/20241125150614_AddAppConfigWindowsMigrationEnabledField.go
@@ -31,7 +31,8 @@ func Up_20241125150614(tx *sql.Tx) error {
 
 	mdm, ok := config["mdm"]
 	if !ok {
-		return errors.New("missing mdm section")
+		mdm = map[string]interface{}{}
+		config["mdm"] = mdm
 	}
 	mdmMap, ok := mdm.(map[string]interface{})
 	if !ok {

diff --git a/server/datastore/mysql/migrations/tables/20241210140021_AddErrorsToCronStatsTable.go b/server/datastore/mysql/migrations/tables/20241210140021_AddErrorsToCronStatsTable.go
@@ -6,10 +6,10 @@ import (
 )
 
 func init() {
-	MigrationClient.AddMigration(Up_20241126140021, Down_20241126140021)
+	MigrationClient.AddMigration(Up_20241210140021, Down_20241210140021)
 }
 
-func Up_20241126140021(tx *sql.Tx) error {
+func Up_20241210140021(tx *sql.Tx) error {
 	// Idempotent migration.
 	// Add columns
 	if !columnExists(tx, "cron_stats", "errors") {
@@ -21,6 +21,7 @@ func Up_20241126140021(tx *sql.Tx) error {
 	return nil
 }
 
-func Down_20241126140021(tx *sql.Tx) error {
+func Down_20241210140021(tx *sql.Tx) error {
 	return nil
 }
+
diff --git a/...atastore/mysql/migrations/tables/20251015103700_AddAndroidApplicationIDToSoftware_test.go b/...atastore/mysql/migrations/tables/20251015103700_AddAndroidApplicationIDToSoftware_test.go
@@ -54,21 +54,18 @@ func TestUp_20251015103700(t *testing.T) {
 			var title fleet.SoftwareTitle
 			err := db.Get(&title, "SELECT id, name, source, extension_for, application_id, bundle_identifier FROM software_titles WHERE id = ?", tt.titleID)
 			require.NoError(t, err)
-			switch {
-			case tt.expectedBundleID == nil:
+			if tt.expectedBundleID == nil {
 				require.Nil(t, title.BundleIdentifier)
-
-			case tt.expectedBundleID != nil:
+			} else {
 				require.NotNil(t, tt.expectedBundleID)
 				assert.Equal(t, *tt.expectedBundleID, *title.BundleIdentifier)
+			}
 
-			case tt.expectedApplicationID == nil:
+			if tt.expectedApplicationID == nil {
 				require.Nil(t, title.ApplicationID)
-
-			case tt.expectedApplicationID != nil:
+			} else {
 				require.NotNil(t, title.ApplicationID)
 				assert.Equal(t, tt.expectedApplicationID, title.ApplicationID)
-
 			}
 
 			var gotUniqueID string

diff --git a/server/datastore/mysql/migrations/tables/20260518194422_AddEncodingTypeToHostSCDData.go b/server/datastore/mysql/migrations/tables/20260518194422_AddEncodingTypeToHostSCDData.go
@@ -9,7 +9,7 @@ func init() {
 	MigrationClient.AddMigration(Up_20260518194422, Down_20260518194422)
 }
 
-// Up_20260514220719 adds the encoding_type column that discriminates between
+// Up_20260518194422 adds the encoding_type column that discriminates between
 // the legacy dense bitmap format (encoding_type = 0) and the new roaring
 // bitmap format (encoding_type = 1). ALGORITHM=INSTANT is a metadata-only
 // change on MySQL 8.0+; existing rows are not rewritten and read back with

diff --git a/server/datastore/mysql/migrations/tables/migration.go b/server/datastore/mysql/migrations/tables/migration.go
@@ -60,7 +60,7 @@ func incrementalMigrationStep(count getTotalCountFn, execute executeWithProgress
 
 		// Every five seconds, echo the % progress of the executor
 		// Since we output once the migration step is complete, we need an extra channel to indicate when both the step
-		// and the "step complete" output are com0plete
+		// and the "step complete" output are complete
 		stepComplete := make(chan struct{})
 		outputComplete := make(chan struct{})
 		go func() {
@@ -83,10 +83,12 @@ func incrementalMigrationStep(count getTotalCountFn, execute executeWithProgress
 			}
 		}()
 
-		err = execute(tx, func() {
-			atomicCurrent.Add(1)
-		})
-		close(stepComplete)
+		func() {
+			defer close(stepComplete)
+			err = execute(tx, func() {
+				atomicCurrent.Add(1)
+			})
+		}()
 		<-outputComplete // Wait for the goroutine to complete
 		return err
 	}
@@ -258,3 +260,4 @@ func updateAppConfigJSON(tx *sql.Tx, fn func(config *fleet.AppConfig) error) err
 
 	return nil
 }
+
diff --git a/server/datastore/mysql/software_title_icons.go b/server/datastore/mysql/software_title_icons.go
@@ -183,8 +183,9 @@ func (ds *Datastore) ActivityDetailsForSoftwareTitleIcon(ctx context.Context, te
 		Exclude    bool   `db:"exclude"`
 		RequireAll bool   `db:"require_all"`
 	}
-	var labels []ActivitySoftwareLabel
+	var allLabels []ActivitySoftwareLabel
 	if details.SoftwareInstallerID != nil {
+		var labels []ActivitySoftwareLabel
 		labelQuery := `
 			SELECT
 				labels.id AS id,
@@ -198,8 +199,10 @@ func (ds *Datastore) ActivityDetailsForSoftwareTitleIcon(ctx context.Context, te
 		if err := sqlx.SelectContext(ctx, ds.reader(ctx), &labels, labelQuery, details.SoftwareInstallerID); err != nil {
 			return fleet.DetailsForSoftwareIconActivity{}, ctxerr.Wrap(ctx, err, "getting labels for software title icon")
 		}
+		allLabels = append(allLabels, labels...)
 	}
-	if details.AdamID != nil {
+	if details.AdamID != nil && details.VPPAppTeamID != nil {
+		var labels []ActivitySoftwareLabel
 		labelQuery := `
 			SELECT
 				labels.id AS id,
@@ -213,8 +216,10 @@ func (ds *Datastore) ActivityDetailsForSoftwareTitleIcon(ctx context.Context, te
 		if err := sqlx.SelectContext(ctx, ds.reader(ctx), &labels, labelQuery, details.VPPAppTeamID); err != nil {
 			return fleet.DetailsForSoftwareIconActivity{}, ctxerr.Wrap(ctx, err, "getting labels for software title icon")
 		}
+		allLabels = append(allLabels, labels...)
 	}
 	if details.InHouseAppID != nil {
+		var labels []ActivitySoftwareLabel
 		labelQuery := `
 			SELECT
 				labels.id AS id,
@@ -228,9 +233,10 @@ func (ds *Datastore) ActivityDetailsForSoftwareTitleIcon(ctx context.Context, te
 		if err := sqlx.SelectContext(ctx, ds.reader(ctx), &labels, labelQuery, details.InHouseAppID); err != nil {
 			return fleet.DetailsForSoftwareIconActivity{}, ctxerr.Wrap(ctx, err, "getting labels for software title icon")
 		}
+		allLabels = append(allLabels, labels...)
 	}
 
-	for _, l := range labels {
+	for _, l := range allLabels {
 		switch {
 		case l.Exclude && !l.RequireAll:
 			details.LabelsExcludeAny = append(details.LabelsExcludeAny, fleet.ActivitySoftwareLabel{

diff --git a/server/datastore/mysqlredis/host_cache_writes_test.go b/server/datastore/mysqlredis/host_cache_writes_test.go
@@ -95,7 +95,8 @@ func TestWritePathInvalidation(t *testing.T) {
 					ds.UpdateHostRefetchCriticalQueriesUntilFunc = func(_ context.Context, _ uint, _ *time.Time) error { return nil }
 				},
 				invoke: func(ctx context.Context, d *Datastore, id uint, _ string) error {
-					return d.UpdateHostRefetchCriticalQueriesUntil(ctx, id, new(time.Unix(1, 0)))
+					until := time.Unix(1, 0)
+					return d.UpdateHostRefetchCriticalQueriesUntil(ctx, id, &until)
 				},
 				invoked: func(ds *mock.Store) bool { return ds.UpdateHostRefetchCriticalQueriesUntilFuncInvoked },
 			},
-Original file line number
+Diff line change
@@ Expand Up / @@ -4,4 +4,4 @@ data "aws_secretsmanager_secret" "license" { @@
     data "aws_secretsmanager_secret_version" "enroll_secret" {
       secret_id = data.terraform_remote_state.shared.outputs.enroll_secret.id
-    }
+    }