Updating the contact source value for webinars and gated docs to match
the new sfdc values
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected CRM contact-source classification so webinar access requests
and whitepaper downloads are categorized separately from general contact
form submissions.
* **Chores**
* Expanded accepted contact-source values in the CRM integration to
include distinct labels for webinars and gated documents.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43875
`POST /api/mdm/microsoft/management` is the hot endpoint for any
Windows-MDM-enrolled
fleet. Every enrolled host hits it twice per check-in interval. At 40k
hosts that's a
four-figure sustained queries-per-second rate on the database reader
pool, dominated
by one expensive query plus a handful of redundant
`MDMWindowsGetEnrolledDeviceWithDeviceID`
lookups on the same row.
This PR cuts that load by:
1. Short-circuiting the pending-commands query when the device's queue
is empty (the
overwhelming common case). Replaces a 3-table join plus anti-join with a
cheap
primary-key probe.
2. Loading the enrolled device exactly once in `isTrustedRequest` and
threading it
through to every downstream consumer instead of re-fetching it three
times.
No behavior change to the protocol, no schema change. Also filed a
related issue: https://github.com/fleetdm/fleet/issues/43897
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Windows MDM server performance at scale by reducing database
queries during device check-ins.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Moved Steven Palmesano from the Customer Solutions Architect (CSA) row
to the Customer Support Engineer (CSE) row in the customer success
handbook team table.
## Changes
- `handbook/customer-success/README.md`: Removed Steven Palmesano from
the CSA listing and added him to the CSE listing.
---
Built for [Isabell
Reedy](https://fleetdm.slack.com/archives/D0AEGJCGJR0/p1776804449377809)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42494
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Prevented a server panic (HTTP 502) when Android pubsub status reports
arrive for hosts deleted from Fleet by validating re-enrollment before
processing.
* Improved Android host creation to avoid creating duplicate hosts when
an Orbit-only enrollment already exists.
* **Tests**
* Added unit tests for the re-enrollment flow for deleted hosts and
deduplication between Orbit and Android enrollments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Granola macOS app configuration to version 7.147.1
* Updated Microsoft Outlook macOS installation configuration to the
latest installer build
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#39900
## Testing
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
- [x] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved timestamp handling for OS vulnerability data synchronization
to use UTC timezone when synchronization is enabled, ensuring consistent
timing behavior across different system configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Android Studio macOS installer metadata to patch version
2025.3.4.6 with corresponding checksum verification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Closes: https://github.com/fleetdm/fleet/issues/43578
Changes:
- Renamed the /query-library page to be /report-library, and added a
redirect
- Renamed the query-detail template page to report-details, and added
redirects for the query pages.
- Updated the docs nav to link to the "reports" page instead of queries
- Updated mentions of query/queries to be "report/reports"
- Renamed the query generator to be the report generator, and added a
redirect
- Updated the sitemap to use the new URLs for report-related pages
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added dedicated "Reports" library and details pages and client
bundles.
* **Refactor**
* Renamed "Queries" to "Reports" across UI, routes, page headings, and
labels (legacy redirects added).
* Updated generator branding from "Query robot" to "Report robot" and
updated tooltips/messages.
* **Chores**
* Updated sitemap and navigation to reference /reports and report detail
URLs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Added new section for whitepapers including downloadable PDFs for lead
generation and executive education. Updated existing sections with new
assets and descriptions.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Minor configuration formatting adjustment to improve consistency and
standardization.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Fixes#43826.
Adds code to silently ignore `dep_profile_error` and
`dep_assign_profile_response` query parameters similar to other premium
only parameters on the list hosts endpoint. This PR does _NOT_ include
filtering out the `dep_profile_error` field from the host details object
since it doesn't seem like a common pattern to filter out individual
fields from a response object, but that can be changed if needed.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
### Before fix
On premium:
- UI: can see "AB issue" card
- UI: can see MDM status with Profile assignment error: failed
- API: can curl `/fleet/hosts?dep_profile_error=true` and get the host
- API: can curl `/fleet/hosts` and see `"dep_profile_error":true` for
the failed host
- API: can curl `/fleet/hosts/7` and see `"dep_profile_error": true`
- API: can curl `/fleet/hosts?dep_assign_profile_response=FAILED`
On free:
- UI: can't see "AB issue" card
- UI: can see MDM status pending but no details, api response has
`"dep_profile_error": true`
- API: can curl `/fleet/hosts?dep_profile_error=true` and get the host
- API: can curl `/fleet/hosts` and see `"dep_profile_error":true` for
the failed host
- API: can curl `/fleet/hosts?dep_assign_profile_response=FAILED`
### After fix
On free:
- API: curl `/fleet/hosts?dep_profile_error=true` and the filter gets
ignored
- API: curl `/fleet/hosts?dep_assign_profile_response=FAILED` or other
statuses and the filter gets ignored
- API: can curl `/fleet/hosts` to show all hosts and it shows
`"dep_profile_error":true` since it is not filtered at the host details
level
- API: can curl `/fleet/hosts/7` and see dep_profile_error since it is
not filtered at the host details level
```
jonathan@jonathans-macbook-pro:~/fleet$ curl -k -X GET 'https://localhost:8080/api/v1/fleet/hosts?dep_assign_profile_response=FAILED' -H "Authorization: Bearer $TOKEN" | wc -l
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 8878 0 8878 0 0 144k 0 --:--:-- --:--:-- --:--:-- 146k
5
jonathan@jonathans-macbook-pro:~/fleet$ curl -k -X GET 'https://localhost:8080/api/v1/fleet/hosts?dep_profile_error=true' -H "Authorization: Bearer $TOKEN" | wc -l
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 8879 0 8879 0 0 298k 0 --:--:-- --:--:-- --:--:-- 298k
5
jonathan@jonathans-macbook-pro:~/fleet$ curl -k -X GET 'https://localhost:8080/api/v1/fleet/hosts' -H "Authorization: Bearer $TOKEN" | wc -l
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 8879 0 8879 0 0 283k 0 --:--:-- --:--:-- --:--:-- 289k
5
jonathan@jonathans-macbook-pro:~/fleet$ curl -k -X GET 'https://localhost:8080/api/v1/fleet/hosts?dep_profile_error=true&dep_assign_profile_response=FAILED' -H "Authorization: Bearer $TOKEN" | wc -l
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 8879 0 8879 0 0 311k 0 --:--:-- --:--:-- --:--:-- 321k
5
```
On premium:
- Everything works as expected, filters work
```
jonathan@jonathans-macbook-pro:~/fleet$ curl -k -X GET 'https://localhost:8080/api/v1/fleet/hosts?dep_assign_profile_response=FAILED' -H "Authorization: Bearer $TOKEN" | wc -l
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1696 0 1696 0 0 58681 0 --:--:-- --:--:-- --:--:-- 60571
1
jonathan@jonathans-macbook-pro:~/fleet$ curl -k -X GET 'https://localhost:8080/api/v1/fleet/hosts?dep_profile_error=true' -H "Authorization: Bearer $TOKEN" | wc -l
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1696 0 1696 0 0 59613 0 --:--:-- --:--:-- --:--:-- 60571
1
jonathan@jonathans-macbook-pro:~/fleet$ curl -k -X GET 'https://localhost:8080/api/v1/fleet/hosts' -H "Authorization: Bearer $TOKEN" | wc -l
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 9055 0 9055 0 0 355k 0 --:--:-- --:--:-- --:--:-- 368k
5
jonathan@jonathans-macbook-pro:~/fleet$ curl -k -X GET 'https://localhost:8080/api/v1/fleet/hosts?dep_profile_error=true&dep_assign_profile_response=FAILED' -H "Authorization: Bearer $TOKEN" | wc -l
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1696 0 1696 0 0 60845 0 --:--:-- --:--:-- --:--:-- 62814
1
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Host listing and counts now ignore premium-only filters on non-premium
licenses, ensuring consistent results for free-tier users.
* **Tests**
* Added tests validating that host listing and counting behave
differently between free and premium license tiers when premium filters
are used.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43050
## Testing
- [x] QA'd all new/changed functionality manually
Confirmed the traffic sequence with ngrok and DDM stats are as expected
in the osquery-perf logs:
### Adding a new DDM
* `DeclarativeManagement` command and Ack
* `tokens` request
* `declaration-items` request
* `activation` for the DDM
* `configuration` for the DDM
* `tokens` request confirms changes settled
* `status` request
### Remove/re-add DDM (no global change)
* `DeclarativeManagement` command and Ack
* `tokens` request
### Adding a second DDM
* `DeclarativeManagement` command and Ack
* `tokens` request
* `declaration-items` request
* `activation` for the new DDM only
* `configuration` for the new DDM only
* `tokens` request confirms changes settled
* `status` request
### Removing a DDM
* `DeclarativeManagement` command and Ack
* `tokens` request
* `declaration-items` request
* `tokens` request
* `status` request
### Remove all DDMs
* `DeclarativeManagement` command and Ack
* `tokens` request
* `declaration-items` request
* `tokens` request
* `status` request
---
State correctly updates on the host's profiles:
<img width="1246" height="512" alt="image"
src="https://github.com/user-attachments/assets/0d289d4e-1e9b-4283-aef0-fd1ab3ecb355"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved macOS Declarative Management sync: faster convergence,
fetches only changed declarations, detects removals, and sends
consolidated status updates.
* **Monitoring**
* Added metrics to track declaration token fetch success and error
rates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed navigation link for Android profile error documentation to
direct users to the correct section within the guides.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Firefox ESR Windows updated to version 140.10.0
* Tor Browser macOS updated to version 15.0.10
* VirtualBox macOS updated to version 7.2.8
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated metadata and configurations for supported macOS applications:
1Password (8.12.12), DeepL (26.4.24484530), Firefox (150.0), Firefox ESR
(140.10.0), and Grammarly Desktop (1.162.2). These maintenance updates
include refreshed package integrity checksums, revised installation
resource paths, adjusted version verification thresholds, and
comprehensive deployment configuration updates to better support the
latest application releases across managed systems.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43484
# Details
Apple Silicon Macs were being forced down the Wine+local-wix-dir path
because the fleetdm/wix:latest image was deemed unreliable on arm64 in
Jan 2024. Docker Desktop's amd64 emulation has matured since -- the
image builds both amd64 and arm64 MSIs on arm64 macOS successfully. This
PR:
- Drops the arm64-forces-Wine guard in BuildMSI so the Docker path is
the default on every macOS arch when --local-wix-dir isn't provided.
- Drops the macOS "Install wine and wix" + "Build MSI on macOS (using
local Wix)" CI steps. The ubuntu-latest matrix entry already exercises
the Docker path, and the install-wine.sh flow is brittle against Gcenx
release churn and homebrew-cask deprecation.
- Updates the install-wine.sh script to fail and output a message
indicating that Docker should be used, or else Wine installed manually.
```
============================================================
This script no longer installs Wine.
============================================================
Wine is no longer required to build Windows (.msi) packages on macOS.
fleetctl package now uses Docker by default on all macOS architectures.
RECOMMENDED: install Docker Desktop
https://docs.docker.com/get-docker
If you cannot use Docker and still need to build MSIs with Wine on macOS
see the upstream WineHQ wiki for installation instructions:
https://gitlab.winehq.org/wine/wine/-/wikis/MacOS
Automatic Wine installation via Homebrew is no longer attempted here
because the wine-stable cask is deprecated and upstream Wine releases
have caused repeated breakage.
```
- Retains the wix auto-download helper (downloadAndExtractZip,
extractZipFile, wixDownload) for backwards-compatibility when Docker
isn't detected, with a deprecation warning.
The Wine + --local-wix-dir path remains available for macOS users who
opt into it, but is no longer documented. See #43484.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- Dropped MacOS packaging tests. The Ubuntu test already exercises the
Docker path that MacOS now uses.
- [X] QA'd all new/changed functionality manually
- Built and installed both amd64 and arm64 .msi packages successfully
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* MSI packages on macOS now build using Docker by default, removing the
Wine dependency.
* **Documentation**
* Updated macOS setup guidance: Docker Desktop is now required for MSI
packaging instead of Wine.
* **Chores**
* Simplified Wine-related helper scripts and removed outdated
installation logic.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Expose a display_name for the `enable-touch-id-sudo.sh` entry in the
workstations fleet manifest so it shows properly in Self Service. Also
add a commented icon placeholder (`../lib/all/icons/touch-id.png`) for
potential future use.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43824
Unreleased bug so no changes file
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved DEP assignment error detection in the MDM status modal so
missing data is recognized correctly, reducing spurious error messages.
* Updated profile assignment visibility: the profile assignment section
now appears only when relevant enrollment data is loading, has an error,
or is present, preventing it from showing in inappropriate contexts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Register a new macOS fleet script that enables Touch ID authentication
for sudo on macOS 15+. Adds
it-and-security/lib/macos/scripts/enable-touch-id-sudo.sh which checks
for the sudo_local.template, creates /etc/pam.d/sudo_local if missing,
and idempotently uncomments or appends the pam_tid line. Also adds a
touch-id.png icon and exposes the script in
it-and-security/fleets/workstations.yml as a self_service Security item.
Provides logging and exits safely when already configured or when run
without root.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40322
The issue was due to case insensitivity in go maps, so when we checked
if we should keep the DDM profile or not, it failed. So we now default
to lowercasing all profile names to make it case insensitive.
_While that fixes the cause, for the issue, I will follow up with
another PR for the all profiles stuck in pending, since it's a scaling
issue due to batching and always taking installs before removes, so with
11k hosts it would never have both install and remove in the same run,
failing to clear out the stuck pending. It can be manually remediated,
but we want to have a better fix for this that actually cleans it up, if
this is met as it can be perfectly valid._
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed Apple MDM profile batch operations to handle declaration names
case-insensitively. Updating a declaration with different name casing
(e.g., mixed-case to lowercase) no longer creates duplicate profiles or
triggers unnecessary operations.
* **Tests**
* Added test coverage for case-insensitive Apple MDM declaration name
handling across team and non-team configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated version metadata for maintained macOS applications: Mattermost
(6.1.2), OneDrive (26.055.0323.0004), and Windsurf (2.0.63). Each update
includes refreshed installer URLs and corresponding checksums to ensure
proper installation and security verification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Box Drive macOS to version 2.51.233
* Updated Charles macOS to version 5.1
* Updated Docker Desktop Windows to version 4.70.0
* Updated iTerm2 macOS to version 3.6.10
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Fixes#42885
Added new middleware (APIOnlyEndpointCheck) that enforces 403 for
API-only users whose request either isn't in the API endpoint catalog or
falls outside their configured per-user endpoint restrictions.
## Summary
- Reorders the Press Coverage table columns from `Date | Publication |
Headline | Journalist` to `Publication | Headline | Journalist | Date`,
moving Date to the last column.
- Updates dates from short `m/d` format (e.g., `4/16`) to the
`YYYY‑MM‑DD` format with `<nobr>` wrapping (e.g.,
`<nobr>2026‑04‑16</nobr>`), consistent with other tables on the
marketing-assets handbook page.
Built for [Ashish
Kuthiala](https://fleetdm.slack.com/archives/D0AG9JQ53GA/p1776747058493619?thread_ts=1776745763.838459&cid=D0AG9JQ53GA)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds a new "Press Coverage" section with a 6-entry table (Date,
Publication, Headline, Journalist) to the marketing assets handbook
page, placed immediately before the "Release notes" section.
- Covers recent press from CRN, Cyber Defense Wire, Channele2e,
Channelvision, and Apple Must regarding Fleet's partner program launch
and board appointment.
Built for [Ashish
Kuthiala](https://fleetdm.slack.com/archives/D0AG9JQ53GA/p1776745828661249?thread_ts=1776745763.838459&cid=D0AG9JQ53GA)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds a LinkedIn profile link for Alyssa Pallotti in the marketing team
responsibilities table
(`handbook/marketing/marketing-responsibilities.md`).
- Follows the existing `[Name](LinkedIn URL)` pattern used for all other
team members in the table.
## Changes
- `handbook/marketing/marketing-responsibilities.md`: Updated `Alyssa
Pallotti` to `[Alyssa
Pallotti](https://www.linkedin.com/in/alyssapallotti/)` in the Public
Relations (Consultant) row.
---
Built for [Ashish
Kuthiala](https://fleetdm.slack.com/archives/D0AG9JQ53GA/p1776743550333609)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds a new testimonial from Thomas Lübker to the Fleet
customers/testimonials page
- Quote: "I think it is key that people understand the leverage they
have with AI if everything is 'code'. In the AI age, clickops will not
prevail!"
- Anonymous-style testimonial (no company logo) with LinkedIn profile
link
### Changes
- `handbook/company/testimonials.yml` — added new testimonial entry
- `website/assets/images/testimonial-author-thomas-luebker-48x48@2x.png`
— added profile image placeholder
---
Built for [Ashish
Kuthiala](https://fleetdm.slack.com/archives/D0AG9JQ53GA/p1776743212657769)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated application metadata to support newer versions of ChatGPT,
Claude, Cursor, Discord, Docker Desktop, Loom, OrbStack, and Zed across
macOS and Windows platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com>
Correct misspellings in ee/maintained-apps/outputs/apps.json for two
entries: update "Elgate" to "Elgato" in the Elgato Control Center
description and "Elgateo" to "Elgato" in the Elgato Stream Deck
description.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected spelling errors in application descriptions for Elgato
Control Center and Elgato Stream Deck to ensure accurate product
information display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add support for Druva inSync: new winget input
(ee/maintained-apps/inputs/winget/druva-insync.json), app metadata
(added entry in ee/maintained-apps/outputs/apps.json) and
platform-specific output with version, installer URL,
installer/uninstaller script refs, sha256 and upgrade_code
(ee/maintained-apps/outputs/druva-insync/windows.json). Also add
frontend icon component and mapping
(frontend/pages/SoftwarePage/components/icons/DruvaInSync.tsx and
index.ts) plus the PNG asset
(website/assets/images/app-icon-druva-insync-60x60@2x.png) so the app is
manageable and visually represented in the UI.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43702
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43142
Since script-only packages have to be specified as a path, add some
logic to allow icon to be set as a path in that situation.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- `TestSoftwarePackagesPathWithInline` checks custom package yml path so
there is no regression, added `TestScriptOnlyPackagesPathWithInline` to
test script-only package path.
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- Tested .sh and .ps1 script-only packages with icon path specified in
the team level yaml.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed custom icon handling for script-only packages (e.g., .sh and
.ps1), allowing icons to be set and resolved correctly for packages
referenced by path.
* **Tests**
* Added test coverage validating custom icon functionality and path
resolution for script-only packages; included a sample script used by
the test.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Created spacing.less, a file that contains the common
padding/margin/gap values used on the website
- Updated containers.less to contain mixins for page containers
- Added feature-blocks.less, a file that contains three mixins:
`.feature-with-image()`, `.three-column-features()`, and
`.responsive-feature-row()`
- Added mixins for common text styles to typography.less
- Updated pages to use the new mixins
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Centralized spacing and typography system for consistent, responsive
layouts
* Reusable feature-block patterns for image/text rows and multi-column
feature grids
* **Style**
* Standardized page containers and content areas with responsive padding
and max-widths
* Unified heading/body styles via new typography utilities
* Simplified markup and improved feature image/text alignment and
responsiveness
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Extra colon in the "Products:" section auto-generated file:
<img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM"
src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected formatting in product list display by removing redundant
punctuation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43047
Follow-up to https://github.com/fleetdm/fleet/pull/43222
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
See
https://github.com/fleetdm/fleet/issues/42960#issuecomment-4246769629
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Apple MDM declaration handling: declarations with unresolved
per-device variables are now attempted per host, marked failed when
resolution fails, and omitted from device configuration/activation
manifests.
* Declarations that fail resolution still factor into declaration token
computation to keep token behavior consistent.
* **Tests**
* Updated tests to reflect per-device resolution failures and adjusted
validation flow.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
johnjeremiah
