Changes:
- Updated the `<scrollable-tweets>` component to set a toggleable max
height on cards with longer quotes. Users can click the "see full quote"
button beneath the truncated quote to expand the card and view the full
quote.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a "Show full quote" link to expand tweet quotes that exceed the
display area.
* **Style**
* Gradient fade for overflowing quote content with an expanded state to
reveal full text.
* Refined video link appearance for improved visual consistency.
* **Bug Fixes**
* Improved overflow detection on initial load and window resize for more
reliable quote truncation/expansion behavior.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46343?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds initial configuration files for a variety of
popular Windows applications to the `ee/maintained-apps/inputs/winget`
directory. Each file defines metadata and installation details for a
specific application, supporting automated installation and
categorization. The changes expand the catalog of supported apps,
especially in the categories of developer tools and productivity.
**New application configurations added:**
* Developer tools:
- Added configurations for JetBrains IDEs (`clion.json`,
`datagrip.json`, `goland.json`), DBeaver, MySQL Workbench, MongoDB
Compass, JetBrains Toolbox, GitKraken, Bruno, Insomnia, Lens, and
balenaEtcher, including install/uninstall scripts where applicable.
[[1]](diffhunk://#diff-3e4e7adc4b239327cc5d40ac702d757e156e016aec1c7c5f94c071a75fe3c4a3R1-R13)
[[2]](diffhunk://#diff-7c80111fa8fde96fcce98662a233200fd288ce0d43d590382e294746cfdccb80R1-R13)
[[3]](diffhunk://#diff-1b9a892edfa9f0d5a6a9bedfcfb05f5f81c28b8b8eb24b7af1f69fcf365faa95R1-R13)
[[4]](diffhunk://#diff-c4bd792a8985240e9c56c8a8b0ad42e494cb2f66243c9c003367b97b6281b8ebR1-R13)
[[5]](diffhunk://#diff-9aca1279003b064f238c0d041a20cdd5ae1d739c4d82e76cde9c53fa19f6b385R1-R11)
[[6]](diffhunk://#diff-b04e68ea6589d16110da5a46758373bdb4de968ec40d4c87e818a9deb1cf038eR1-R10)
[[7]](diffhunk://#diff-7118d8f25ce533ac6ff68996ef77f1414c40e1303e594a914c5ba8f38ec64276R1-R12)
[[8]](diffhunk://#diff-0ead97641d521188d580d83b60dea688638944ef1a757a779e433cff169059b4R1-R12)
[[9]](diffhunk://#diff-bf104e3d22035060f71605438fceffe9f706146eed7d8d30c3d2abf6a5ee5cefR1-R10)
[[10]](diffhunk://#diff-b3eda4fb883851adf2c082f4b59cd8b1a7202ba4259e62bc34b048896567e766R1-R12)
[[11]](diffhunk://#diff-223a89b91fd09d840a1d66037849717db5b28a6a811462e564e1006bd0ad171aR1-R13)
[[12]](diffhunk://#diff-0081626467bacfa7b6e2399e7aeb2daec0b4592e4de1d0b48d5f1a9f484ec1eeR1-R12)
* Productivity:
- Added configurations for Audacity, Bitwarden, Dropbox, draw.io, Loom,
Miro, and calibre, with relevant metadata and scripts for installation
management.
[[1]](diffhunk://#diff-17343e25b14845b33ccdd21e083514798da3d2060828a99f6a437bb7390982ecR1-R13)
[[2]](diffhunk://#diff-e5698c640f9ea28bea0dcae73b24da580297f52098f5f626551729463489e944R1-R12)
[[3]](diffhunk://#diff-cc13e4338596d6f03fe506a885309dd2073394d3213c289aea5b269ce9f872feR1-R10)
[[4]](diffhunk://#diff-8d8db7aa83e73313721dcdf3a9dad437a9b448cdd235d8e04e1287b16c0484aeR1-R12)
[[5]](diffhunk://#diff-277c3efb81a8d39babfc3c72cac751c85ba399f2ae0f2005cd5c5fc24e952e6eR1-R12)
[[6]](diffhunk://#diff-1e495b3b54ed010a6f44538f7269880065e9736f56b36603d43c6676528b2988R1-R12)
[[7]](diffhunk://#diff-b6459d15c09716fbe644e8cb949cf012953b556044eacbd1a8447f1d39dedadfR1-R11)
* Communication:
- Added configuration for Dialpad, including install and uninstall
scripts.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added Windows application support for 35+ popular tools and apps
including productivity (Dropbox, Loom, Obsidian), development (JetBrains
IDEs, GitKraken, Insomnia, Rancher Desktop), security (Bitwarden,
NordPass, NordVPN), and utility applications (Audacity, draw.io,
Signal).
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46313?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
## Summary
- Comments out the Product Designer role in
`handbook/company/open-positions.yml`, removing it from the active open
positions listing.
- Follows the same commenting pattern (`# ` prefix) used for other
previously closed positions in the file.
---
Built for [Isabell
Reedy](https://fleetdm.slack.com/archives/D0AEGJCGJR0/p1779970760392299?thread_ts=1779970746.073209&cid=D0AEGJCGJR0)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Add WinSCP to maintained apps: introduce winget input metadata
(winscp.json) and add installer/uninstaller PowerShell scripts
(winscp_install.ps1 uses Inno Setup silent flags; winscp_uninstall.ps1
locates UninstallString/QuietUninstallString from registry and runs it
with silent args). Update outputs: add app entry in apps.json and add
winscp/windows.json with version, installer URL, checksums and embedded
script refs. Add frontend icon component and image, and register the
icon in the icons index.
## Summary
- Adds a new monthly ritual to the CEO's rituals file: "Check Eventbrite
for upcoming GitOps workshops"
- On the first Monday of every month, early in roundup, verify that
https://www.eventbrite.com/organizations/collections has all upcoming
GitOps workshops listed.
- DRI: SFriendLee
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Savannah Friend <157323611+SFriendLee@users.noreply.github.com>
Changes:
- Simplified the feature comparison table on the homepage (Removed the
switch and "For CISOs" table, and reduced the list to 8 features)
- Cleaned up unused methods and variables in the homepage page script
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Streamlined the homepage comparison tables by removing several vendor
and feature rows
* Simplified vendor selection dropdowns on desktop and mobile for easier
browsing
* Removed the mobile/desktop mode switch for the IT comparison view
* Adjusted homepage ticker behavior so the bottom ticker always animates
(hero ticker removed)
* Condensed IT comparison content, preserving the simplified "Open
source" indicator
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46293?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Introduce GoToMeeting to maintained apps: add homebrew and winget input
manifests, darwin and windows output metadata (with installers,
checksums, and install/uninstall script refs), and frontend icon asset.
Include Windows install/uninstall PowerShell scripts (MSI machine-wide
install and uninstall via hard-coded UpgradeCode) and macOS DMG
install/uninstall refs and scripts. Update
ee/maintained-apps/outputs/apps.json to register GoToMeeting for darwin
and windows.
Also adjust Windows validation logic to special-case GoToMeeting version
checks: winget reports a package version (10.19.0.19950) that contains
an extra ".0" segment compared to the installed MSI/registry version
(10.19.19950), so the validator falls back to existence-only validation
and logs the difference.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42744
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- Tested setup experience on a macOS virtual machine, see below.
This is what happens after the change:
- Editing pkg while setup experience is running, whether the package is
pending or currently running, doesn't cancel anything. Installs were
successful.
- Editing pkg while queueing a normal install caused it to cancel with
no record.
- Deleting while an installer is running causes the row to disappear
immediately in the setup experience UI, HSI row removed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Editing a software installer no longer cancels in-progress
setup-experience installs; running setup-experience flows are preserved
when installer scripts are updated.
* Deleting an installer still removes its associated pending
setup-experience entries and related pending host-install records.
* GitOps batch updates: editing installers in a batch preserves running
setup experiences; omitting an installer from a batch deletes only that
installer’s pending entries.
* **Tests**
* Added/updated integration tests validating edit/delete behavior during
setup experience.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46236?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Fixes a security issue where `POST /api/latest/fleet/targets` returned
sensitive fleet configuration to users with insufficient privileges.
Other team-facing endpoints apply proper access controls; the target
search path did not.
- Replaces the `teamSearchResult` struct with a slim version containing
only the non-sensitive fields documented in the API response (`id`,
`created_at`, `name`, `description`, `user_count`, `host_count`,
`display_text`, `count`).
- Removes the `MarshalJSON`/`UnmarshalJSON` methods (~70 lines) that
serialized fields the target picker never uses.
- Verified that no frontend component, fleetctl client, or integration
test reads sensitive fields from the target search response.
- Validated the response shape matches the documented API contract in
`docs/REST API/rest-api.md`.
Closesfleetdm/confidential#16054
Related advisory: GHSA-88p2-jj8w-j8qg
## How we reproduced
1. Started local dev server (`fleet serve --dev --dev_license`)
2. Created a global observer user and a saved query with
`observer_can_run = true`
3. Logged in as the observer
**Before fix** -- same observer session, same team:
```
GET /api/latest/fleet/fleets/2/secrets
-> secret: "********" (correctly masked)
POST /api/latest/fleet/targets {"query":"","query_id":7,"selected":{"hosts":[],"labels":[],"teams":[]}}
-> sensitive configuration leaked for all teams
```
**After fix** -- rebuilt binary, restarted server, same observer:
```
GET /api/latest/fleet/fleets/2/secrets
-> secret: "********" (unchanged)
POST /api/latest/fleet/targets (same request)
-> only non-sensitive fields returned (id, name, display_text, count, etc.)
```
Also verified admin target search still returns team metadata correctly.
## Test plan
- [x] Manual reproduction on local dev server
- [x] Manual verification after fix
- [x] Admin target search still returns team metadata (id, name,
host_count, display_text)
- [x] Verified no consumers (frontend, fleetctl, tests) read sensitive
fields from target search
- [x] Validated response matches documented API contract in `docs/REST
API/rest-api.md`
- [x] Unit test verifies response contains only documented non-sensitive
fields
- [x] `go test ./server/service/ -run TestSearchTargets` passes
- [ ] CI passes
Add P4V (Perforce) Windows package: new winget input (Perforce.P4V) and
a dedicated outputs/p4v/windows.json describing version 242.61.2 with
installer URL, sha256, upgrade code, and embedded PowerShell
install/uninstall scripts. Also update outputs/apps.json to register the
P4V/windows app entry.
Add Windows winget inputs and PowerShell scripts for IntelliJ IDEA
Community Edition and Ultimate. New files include input manifests
(ee/maintained-apps/inputs/winget/*.json), installer scripts that run
the NSIS installers silently (using /S), and uninstall scripts that
locate the uninstall string in the registry, stop running IDEA
processes, ensure the /S silent flag, and execute the uninstaller.
Update outputs by adding app entries in
ee/maintained-apps/outputs/apps.json and new per-app outputs with
version metadata, installer URLs, sha256 hashes and embedded script
refs: CE version 2025.2.6.2 and Ultimate version 2025.2.5.
Add Genesys Cloud to maintained apps: create input manifests for
Homebrew (darwin dmg) and Winget (windows msi), add output metadata
files for darwin (v2.49.25) and windows (v2.49.903.0) including
installer URLs, checksums, install/uninstall script refs and a Windows
upgrade code. Register the app in ee/maintained-apps/outputs/apps.json
and add a frontend SVG icon component, mapping entry, and PNG asset for
the software page.
Introduce Beyond Compare Windows package metadata and scripts for
winget. Adds input manifest
(ee/maintained-apps/inputs/winget/beyond-compare.json) plus install and
uninstall PowerShell scripts that handle Inno Setup silent install flags
and registry-based uninstaller discovery. Updates outputs: registers the
app in ee/maintained-apps/outputs/apps.json and adds a versioned output
file with installer URL, sha256, and script refs
(ee/maintained-apps/outputs/beyond-compare/windows.json).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] QA'd all new/changed functionality manually
## Database migrations
- [X] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a migration cleanup tool to recover from failed starts after
migration renumbering.
* Supports dry-run mode to preview the SQL changes and apply mode to
execute fixes.
* Includes secure database connection options and safe, transactional
execution with reporting for detected issues.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46177?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
Add support for Amazon Corretto 25 across the repo: new winget input
definition, Windows output metadata (version 25.0.3.9) including
installer/uninstaller PowerShell scripts, SHA256 and upgrade_code, and
register the app in ee/maintained-apps/outputs/apps.json. Also add a
frontend SVG icon component, map it in the icons index, and include the
2x PNG asset so the app is displayed in the UI. This enables Fleet to
install and uninstall Amazon Corretto 25 on Windows.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added complete Amazon Corretto 25 support for Windows including
detection, installation, and lifecycle management capabilities
* Enhanced Windows application detection to support matching by multiple
registry identifiers, improving detection accuracy for installed
programs
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46220?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Eric
