Mostly to prevent AIs from picking them instead of using new (because
then the linters in CI complain).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Deprecated internal pointer helper functions in favor of Go's standard
pointer allocation syntax. Updated test files throughout the codebase to
use the standard approach for consistency and maintainability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Implements the optimization described in
[#44191](https://github.com/fleetdm/fleet/issues/44191): inside
`RecordPolicyQueryExecutions`, fetch the existing `policy_membership`
rows for the incoming policies and narrow the UPSERT batch to only the
rows whose stored value differs from incoming. Steady-state rows are
skipped entirely.
The added SELECT is a small indexed lookup on `(host_id, policy_id)`;
the savings are on the writer side, which is the loadtest bottleneck.
Fixes#40362
Use INSERT IGNORE in the sync path so that a policy deleted between
distributed query dispatch and result ingestion is silently skipped,
matching AsyncBatchInsertPolicyMembership which already handles this
race with the same approach.
**Related issue:** Resolves#43116
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fedora/Linux wipe now removes Btrfs snapshots (including read-only)
before wiping so snapshots won’t persist.
* **UI**
* Linux-specific guidance and external links added to wipe dialogs and
wiped/failed-wipe activity items; wipe status tags suppressed for Linux
hosts.
* Activity entries include host platform to enable platform-specific
messaging.
* **Tests**
* Updated tests to cover Linux-specific wipe messaging, links, and
activity payloads.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated ChatGPT Desktop to version 1.2026.119
* Updated Genesys Cloud to version 2.50.28
* Updated GitHub Desktop to version 3.5.12
* Updated Notion to version 7.20.0
* Updated Tailscale to version 1.98.5
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for website swag request contacts in webhook processing,
enabling the system to accept and validate requests from this new
contact source type.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46119
New activities visible on host details page:
<img width="482" height="424" alt="image"
src="https://github.com/user-attachments/assets/8b8b33b2-c135-4061-b258-473fcc109d89"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* MDM unenrollment events now appear on the host activity timeline in
host details.
* **New Features**
* Host activity entries for MDM unenroll show platform- and actor-aware
messaging and appropriate action/icon visibility.
* **Tests**
* Added tests to verify rendering and messaging for various platforms
and actor presence.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46388
Video demo: https://www.youtube.com/watch?v=t3yuGh0kwP8
Docs PR: https://github.com/fleetdm/fleet/pull/46483
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
## New Fleet configuration settings
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* UI to add/remove Entra application (client) IDs for Windows automatic
enrollment; add/delete modals and list management.
* **Enhancements**
* Activity feed entries for added/removed Entra client IDs.
* Entra client ID allowlist surfaced in GitOps and persisted config;
client IDs normalized (trim/lowercase) and de-duplicated.
* **Documentation**
* Note: from July 1, 2026 new on‑prem Windows MDM apps receive Entra v2
tokens with aud = client ID; v1 tokens remain supported.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Every story issue inherited ~14 generic test-plan checkboxes (UI, API,
GitOps, Permissions) plus TODO placeholders, regardless of whether they
applied. The result was that most issues carried large blocks of
uncurated boilerplate, making it hard to see which checks were actually
relevant and adding visible noise to every story.
This restructures the Test plan section into a hybrid format:
- Keep "Core flow" and "Edge cases" visible, with Edge cases retaining a
required QA TODO slot so every story has a curated entry point.
- Move the UI, API, GitOps, and Permissions checklists into a single
commented block headed by a visible nudge. Authors un-comment only the
sections that apply, so the rendered issue shows only relevant checks
instead of orphan headers.
It also expands suggested coverage with three new sections (commented by
default):
- Premium gating: confirm premium-only features are blocked on both the
frontend and backend, not just hidden in the UI.
- Upgrade / data migration: confirm behavior on upgraded servers (not
just fresh installs) and that data migrates/rolls back safely.
- Feature in isolation (MDM / platform independence): confirm
cross-platform or Apple-MDM-independent features work without Apple MDM
configured. This addresses a recurring bug class where features break
when Apple MDM is off — e.g. #44801 (end user auth on
Windows/Linux-only), #44194 (team BitLocker enable when Apple MDM off),
and #46283 (host OS settings API with only Android MDM).
## Summary
- Refactored the conditional access policy query to use `CONCAT('%', ?,
'%')` with a bound parameter instead of string concatenation for the
platform `LIKE` clause, consistent with how other queries in this file
handle string filters.
## Test plan
- [ ] Verify conditional access policy lookup still returns correct
results for macOS/Windows hosts.
- [ ] Confirm no regression in policy filtering behavior.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved platform filtering in conditional access policy queries to
enhance query reliability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds the Google Slides link for the "Fleet for CIOs" deck to the Slide
Decks section in the Go-To-Market operations handbook page, replacing
the previous "work in progress" placeholder.
## Changes
- `handbook/company/go-to-market-operations.md`: Updated the "Fleet for
CIOs" bullet from a WIP placeholder to an active link pointing to the
slide deck.
---
Built for [Chaz
Maclaughlin](https://fleetdm.slack.com/archives/D0AHH0ZEMLY/p1780344948342509?thread_ts=1779381980.385179&cid=D0AHH0ZEMLY)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
**Related issue:** Resolves#46283
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an error in the "Get host's OS settings" API so it no longer
fails when only Android MDM is enabled.
* Configuration profiles endpoint now correctly responds when Android or
Windows MDM is the active platform, in addition to Apple MDM.
* **Tests**
* Added tests covering configuration profiles behavior across Apple,
Windows, and Android MDM configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Check if the `ORBIT_ENABLE_SCRIPTS` plist variable exists and set or add
it accordingly in the plist.
Prior to this change, if the variable was not already present on the
host, the script would fail to set the variable.
This change also sets the `plist_path` variable, which was missing in
the original script.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved macOS setup script to more reliably configure the launchd
environment variable: it now detects whether the variable exists before
updating or adding it, handles errors silently during probes, uses a
single plist path variable instead of a hardcoded path, and ensures the
service is restarted with the updated configuration.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46100?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Removes docs/solutions/windows/scripts/install-yellowkey-extension.ps1
(thin wrapper that fetched Allen's upstream installer) and updates the
policy's run_script.path to install-windows-yellowkey-extension.ps1, the
canonical filename in allenhouchins/fleet-extensions. Users drop Allen's
installer (with its canonical name) into their GitOps scripts directory;
the policy references it directly.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #46360
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Windows YellowKey osquery Fleet policy documentation with
revised script references and remediation instructions for hosts that
fail to load the extension.
* **Chores**
* Removed obsolete installation script; installation procedures have
been consolidated for improved clarity and maintainability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude <noreply@anthropic.com>
While testing for #46482, I noticed that the model name on the Hosts
page is truncated, but a tooltip doesn't show on hover. This felt
inconsistent, since the Host details page truncates the model and does
show a tooltip.
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved display of hardware model information in the hosts management
table with better text truncation and tooltip support for enhanced
readability.
* Adjusted column styling to ensure consistent width and reliable
tooltip behavior for long hardware model names.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Grammarly Desktop macOS package from version 1.167.1 to
1.167.2 with new installer URL and verification checksum.
* Updated NordVPN macOS package from version 10.3.0 to 10.3.1 with new
installer URL and verification checksum.
* Updated Sourcetree macOS package from version 4.2.17 to 4.2.18 with
new installer URL and verification checksum.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#46066
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected MDM status label in the hosts table so enrollment states
display accurately.
* Fixed platform handling so "Not supported" appears appropriately for
Chrome and Linux hosts.
* **New Features**
* Added a hover tooltip on the MDM status in the hosts table to show
additional context.
* **Style**
* Improved tooltip text wrapping to keep status names on a single line.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Reverts fleetdm/fleet#45893
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved application installation for 1Password, Slack, and Zoom by
implementing graceful application shutdown before installation and
automatic restart after completion.
* Enhanced installation reliability by simplifying application lifecycle
management during package updates, reducing potential conflicts from
running applications during installation processes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#45963
isKDE() previously matched loginctl's Desktop metadata field, which can
falsely report KDE on hosts that have kde-plasma-desktop installed
alongside another, detect the live plasmashell process owned by the
logged-in GUI user instead.
## Summary
- `make serve` writes to `~/.fleet/last-serve-invocation` in both
branches of its main recipe (save-invocation when `FORWARDED_ARGS` is
set, default-seed when it's empty), but neither branch creates the
`~/.fleet` directory first.
- On a fresh machine the redirect fails with `No such file or directory`
and the target aborts before `./build/fleet` is ever invoked.
- Adds a single `mkdir -p ~/.fleet` to the recipe so both branches have
a directory to write into.
## Test plan
- [x] On a machine without `~/.fleet`, `make serve` previously failed
with `No such file or directory`; with this patch it creates the
directory, seeds the default invocation, and starts fleet.
- [x] On a machine with an existing `~/.fleet/last-serve-invocation`,
behavior is unchanged (`mkdir -p` is a no-op).
## Follow-ups (not in this PR)
- The `RESET` branch (`make serve RESET=1`, line 180) uses `touch
~/.fleet/last-serve-invocation && rm ...` which has the same gap on a
fresh machine. Worth fixing in a follow-up if anyone hits it.
- The `SHOW` branch (line 170) handles missing files via `$?` and
gracefully no-ops, so it's fine.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved build process reliability by ensuring required directories
are properly initialized.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46521?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add Winget support for Adobe Acrobat Pro: new input JSON,
install/uninstall PowerShell scripts, and Windows output manifest (with
script refs and installer metadata). Rename Homebrew input and apps
listing to "Adobe Acrobat Pro" and add a Windows entry to apps.json.
Improve winget ingester to try version directories in descending order,
skip grouping dirs that don't contain expected manifests, fetch and
unmarshal installer and locale manifests with better logging and error
handling, and return a clear error when no valid version manifest is
found.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for Adobe Acrobat Pro on Windows with automated install
and uninstall capabilities.
* **Bug Fixes**
* Improved version handling during app installation to try multiple
candidate versions if needed.
* Enhanced error messaging for app uninstall validation.
* **Updates**
* Standardized Adobe Acrobat Pro product naming across platforms for
consistency.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/43829?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Support installer_format="pkg" even when the Homebrew cask describes no
pkg artifact by installing the downloaded package at $INSTALLER_PATH.
Adds caskHasPkgArtifact and InstallPkgFromInstallerPath, and updates
installScriptForApp to use quit/track and relaunch helpers around a
direct installer call when appropriate. Includes unit tests for both
code paths. Removes per-app install script files and clears
install_script_path from input JSONs; updates output refs for 1Password,
Slack and Zoom to the new consolidated scripts.
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced Homebrew application installation with improved error
detection and app lifecycle handling during package updates.
* **Chores**
* Consolidated custom installer logic into centralized system; removed
redundant installation configurations.
* **Tests**
* Added test coverage for package installation scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Resolves#44970 (1/2).
---
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* `fleetctl get fleets` / `get teams` now display software and setup
experience from authoritative software endpoints.
* Preserve literal setup_experience fields (avoid erroneous macos_setup
renames) when applying and when transmitting JSON for software entries.
* **Tests**
* Added regression tests and test helpers to ensure
software/setup_experience are sourced correctly and to prevent nil
panics in related tests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Improved Amazon WorkSpaces macOS uninstall behavior for better file
cleanup operations
* Updated Google Gemini macOS version support to 1.63.12.361
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Resolves#43045
Fixed a bug where the carve cleanup cron job called the MySQL
implementation instead of the S3-aware implementation on S3-configured
deployments, meaning expired carves were never marked as expired in S3.
Also fixed a panic in S3 carve cleanup that occurred when there were no
non-expired carves.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Amazon WorkSpaces support on macOS (version 5.32.0.6080) with
installation and uninstallation workflows.
* App now appears in the apps list for macOS.
* **Documentation**
* Updated Amazon WorkSpaces description for the existing Windows entry.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Lucas Manuel Rodriguez
