Software > OS: Show Android versions and vulnerabilities

[jmwatts]

Goal

User story
As an IT admin on the Software > OS page,
I want to see Android versions and vulnerabilities
so that I can understand which version of the Android operating system is installed across my fleet of personally-owned Android hosts.

Changes

Product

• UI changes: Figma
• CLI (fleetctl) usage changes: No changes
• YAML changes: No changes
• REST API changes: PR
  • Update host Android versions to include the security update version (formatted as (YYYY-MM-DD))
• Fleet's agent (fleetd) changes: No changes
• Fleet server configuration changes: No changes
• Exposed, public API endpoint changes: No changes
• fleetdm.com changes: No changes
• GitOps mode UI changes: No changes
• GitOps generation changes: No changes
• Activity changes: No changes
• Permissions changes: No changes
• Changes to paid features or tiers: No changes
• My device and fleetdm.com/better changes: No changes
• Usage statistics: No changes
• Other reference documentation changes: No changes
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: No changes
• Feature guide changes: TODO
• This is a premium only feature: Yes

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

Risk assessment

• Requires testing in a hosted environment: No
• Requires load testing: No
• Risk level: Low

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

Core flow

• See Android versions in OS list
  • As hosts check in, their version should change from just a major version (e.g. "16") to a major version w/ the security update version (e.g. "16 (2026-05-01)"), which are considered separate versions in our inventory.

• See updated Android version (w/ security update version) in Android host details page
• Details page for Android versions
• See vulnerabilities associated w/ Android versions

UI

• Verify that all UI changes specified in the Figma wireframes are correctly implemented

API

• Test all API endpoints added or modified in the API changes section of this issue
• Verify any new API endpoints appear in the list when adding an API-only user. The API endpoints display name, method, and path is the same as listed in the API reference docs
• Verify error handling for invalid inputs where applicable

Edge cases

• Upgrading Android major version (i.e. ugrading from Android 15 > 16 > 17)
  • Verify that the Vulnerabilities list gets updated accordingly
• Upgrading Android security update version (i.e. updating within Android 16)
  • Verify that the Vulnerabilities list gets updated accordingly
• Deleting a host and running crons removes it from the OS list

Supplemental testing

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan (include any special setup, test data, or configuration used during development/testing if applicable).
2. QA: Added comment to user story confirming successful completion of test plan.
3. QA: Determined whether this story needs Playwright automation.
   • Needs automation: Yes / No
   • If yes, filed a follow-up issue in the :help-qa project with status "Needs automation": TODO

[noahtalerman]

Hey @marko-lisica is this expected? If yes, do we have plans to add Android to this page?

[marko-lisica]

@noahtalerman I believe we were trying to move quickly and overlooked this. This could be a feature request, but it looks weird that Android is not available while all other platforms are.

[noahtalerman]

I believe we were trying to move quickly and overlooked this. This could be a feature request, but it looks weird that Android is not available while all other platforms are.

@marko-lisica no worries and agreed.

I updated this bug into a story and added it to the roadmap.

FYI @jmwatts