Software > OS: Show Android versions and vulnerabilities - #49399
Merged
juan-fdz-hawa merged 11 commits intoJul 16, 2026
Merged
Conversation
Relates to #47334 Capture SoftwareInfo.securityPatchLevel from the Android Management API device report and fold it into the host's OS version, so Android versions read as "Android 16 (2026-05-01)" instead of just "Android 16". This makes the operating_systems row distinct per patch level, which is the vulnerability-relevant granularity for Android (AMAPI exposes no minor version). Both the enroll path (addNewHost) and the detail-report path (updateHost), plus the operating_systems upsert, now go through a shared androidOSVersion helper. Devices that don't report a patch level fall back to the bare major version, so they still enroll without error.
**Related issue:** Resolves #47335 # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added Android OSV processing support. - Generates compressed vulnerability artifacts for each Android major version. - Includes Android CVE identifiers, severity ratings, fixed security patch levels, and deterministic vulnerability listings. - Supports filtering output by Android version. - Consolidates duplicate advisories and retains the latest available security patch level. - **Bug Fixes** - Normalizes Android “next” version labels and excludes unsupported kernel- or SoC-specific entries. - Prevents unsupported delta-processing options in Android mode. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves #47336 - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually
Relates to #47337 Mark android as a vulnerability-supported platform so the Software > OS experience surfaces Android CVEs instead of a "Not supported" state.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #49399 +/- ##
==========================================
+ Coverage 67.97% 68.16% +0.19%
==========================================
Files 3801 3850 +49
Lines 239965 243898 +3933
Branches 12693 13121 +428
==========================================
+ Hits 163123 166260 +3137
- Misses 62058 62610 +552
- Partials 14784 15028 +244
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughAndroid host and operating-system versions now include security patch levels. The OSV processor generates compressed Android artifacts by major version, synchronization refreshes and removes outdated artifacts, and a new analyzer matches vulnerabilities by security patch level. Fleet cron runs Android OSV analysis when enabled. Android is marked as supported in the frontend, with Software OS table and details coverage for Android vulnerabilities. Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/osv-processor/main.go`:
- Around line 1036-1039: Update the no-results branch in the Android
vulnerability processing flow around collected so that len(collected) == 0
returns a descriptive error instead of nil, while preserving the warning log and
successful return for non-empty collections.
In `@server/mdm/android/service/pubsub.go`:
- Line 739: Update the Android host OS synchronization around
androidHostOSVersion and updateHostOperatingSystem() so an empty
SoftwareInfo.AndroidVersion keeps host.Host.OSVersion and the existing
operating_systems record consistent. Ensure the corresponding operating-system
row is updated or cleared when no patch-level version is provided, while
preserving normal version updates and keeping /os_versions and vulnerability
filtering aligned.
In `@server/mdm/android/tests/integration_os_version_test.go`:
- Around line 124-131: Update the SQL query inside the mysqltest.ExecAdhocSQL
assertion to filter Android rows to the three versions expected by this
scenario, while preserving the existing ORDER BY version and assertion. Scope
the change to the query in this test so unrelated or future Android fixtures
cannot affect the result.
In `@server/vulnerabilities/android/analyzer.go`:
- Around line 91-97: Update the cache.get handling in the Android analyzer flow
to suppress only the dedicated not-found error; propagate gzip, JSON decoding,
and other I/O failures to the cron error handler. Use the existing not-found
error symbol or introduce a dedicated sentinel at the cache boundary, and update
the corrupt-artifact test to assert the error is returned rather than treated as
a missing artifact.
- Around line 103-137: When hostSPL is empty, return before loading existing
vulnerabilities or calculating the delta, preserving existing Android findings.
Update the analyzer flow around the hostSPL matching block and add coverage for
an unknown SPL with existing records to verify no deletions occur.
In `@server/vulnerabilities/osv/sync.go`:
- Around line 337-366: Update RefreshAndroid to derive the artifact date from
release using releaseDateFromAssets(release) after getLatestRelease succeeds,
then pass that date to both syncAndroidOSV and removeOldAndroidOSVArtifacts
instead of the cron execution time now. Add a regression test covering a release
date different from now.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 8a8de870-0ba3-402a-98e6-19550318a373
📒 Files selected for processing (16)
cmd/fleet/cron.gocmd/osv-processor/main.gocmd/osv-processor/main_test.gofrontend/interfaces/platform.tsfrontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tests.tsxfrontend/pages/SoftwarePage/SoftwareOSDetailsPage/SoftwareOSDetailsPage.tests.tsxserver/datastore/mysql/operating_systems.goserver/datastore/mysql/operating_systems_test.goserver/fleet/vulnerabilities.goserver/mdm/android/service/pubsub.goserver/mdm/android/service/pubsub_test.goserver/mdm/android/tests/integration_os_version_test.goserver/vulnerabilities/android/analyzer.goserver/vulnerabilities/android/analyzer_test.goserver/vulnerabilities/osv/sync.goserver/vulnerabilities/osv/sync_test.go
ksykulev
approved these changes
Jul 16, 2026
juan-fdz-hawa
deleted the
35075-software-os-show-android-versions-and-vulnerabilities
branch
July 16, 2026 14:38
3 tasks
3 tasks
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #35075
Checklist for submitter
If some of the following don't apply, delete the relevant line.
changes/,orbit/changes/oree/fleetd-chrome/changes.See Changes files for more information.
Testing
Summary by CodeRabbit