<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45286
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Create local admin account = true
Primary account type = none
End user auth required = true
= No primary account setup screen shown - jumps straight to
username/password login which I can login to with the password shown in
the UI.
Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’`
only returns `_fleetadmin`
**Note: EACAS is not available on this mac (or this user?)** - however
it’s still possible to Wipe via MDM commands.
Create local admin account = true
Primary account type = standard
End user auth required = true
= Primary account setup screen shown (also works with IDP info being
locked and populated).
Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’`
returns `_fleetadmin` and my end user (IDP info locked in this case)
Opening Settings -> Users & Groups -> Shows my primary account as
“Standard”
**Note: Benefit of the user can’t do EACAS** (Prompted: “Admin user
required”)
__fleetadmin also can’t do EACAS_
Create local admin account = false
Primary Account type = N/A (but admin)
End user auth required = true
= Shown primary account setup screen with IDP info populated and locked
Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’`
only returns my primary user
Opening Settings -> Users & groups -> shows my primary account as
“Admin"
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* macOS setup now supports end-user account types: `admin`, `standard`,
or `none`.
* Setup flows and device commands respect the selected primary account
type (e.g., create regular user or skip creation).
* **Validation**
* Configuration now enforces that a local admin account exists/enabled
when required by the chosen end-user account type.
* **Tests**
* Added coverage for `standard` and `none` validation and command
behavior.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46179?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Update display names for consistency/branding: change "pgAdmin4" to
"pgAdmin 4" in ee/maintained-apps/inputs/homebrew/pgadmin4.json and
ee/maintained-apps/outputs/apps.json, and change "SourceTree" to
"Sourcetree" in ee/maintained-apps/outputs/apps.json. These edits align
app names with official branding and ensure consistent naming across
input and output manifests.
This pull request adds support for several new applications to the
maintained apps catalog, including their metadata, installation, and
uninstallation scripts for Windows and macOS. The changes ensure these
apps can be managed and deployed via the system, with appropriate
detection queries and categorization.
**New application support:**
* Added support for **Azul Zulu JDK 25** and **Azul Zulu JRE 25** on
Windows, including metadata, detection queries, and
installer/uninstaller scripts.
[[1]](diffhunk://#diff-e73703dde6f54dcc3362e12c0134707b6eb766427950dc1b6201b456646c2441R1-R11)
[[2]](diffhunk://#diff-f067c62ed110f736685711c61f01ff5d326530e602236b2ff4464cb12b320efbR1-R11)
[[3]](diffhunk://#diff-03d5e12f29ca434396eb8d95529351cdc1e37e937a0234d5d0f799ce32d99270R1-R22)
[[4]](diffhunk://#diff-69d0bc65a28bab22f22868659439314badb0f1d8576512b7a04184db0d5f04d2R1-R22)
[[5]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R256-R269)
* Added support for **Tableau Desktop** on Windows, including metadata,
install/uninstall PowerShell scripts for handling the WiX Burn bundle,
and catalog entries.
[[1]](diffhunk://#diff-da26f57894495ab515b6f07452f5bdf475e038e32dcd9235e2c461a2c50fe4c6R1-R13)
[[2]](diffhunk://#diff-ae3d9cdef4ee9b23a394bdd72ac9c1669d09f5e8cd63716c746ee862f3f1ab2eR1-R22)
[[3]](diffhunk://#diff-23116d8521375f8c07d973cb4a8424664511622be2f8054ff883762325a9fccaR1-R35)
[[4]](diffhunk://#diff-52b261b49349ced82dcec614b525537af74fb76b2b80d5b86bf47997dcc602a5R1-R94)
[[5]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R2090-R2096)
* Added support for **TeamViewer Host** on both Windows and macOS,
including metadata, install/uninstall scripts for Windows, and catalog
entries.
[[1]](diffhunk://#diff-cc1d69139e4cfc23694e1a7c911484b847730d6c989e3ef6e0a868ebb446f088R1-R13)
[[2]](diffhunk://#diff-957c90f066b977cb7909a37633955b9cd003bf6cb54d5571513509470a8da023R1-R8)
[[3]](diffhunk://#diff-6f0503390a74ce160c8cf97e8a21f6be441d96e8d7a7725b7fcd977020275208R1-R26)
[[4]](diffhunk://#diff-26c9cfc3f13dbdb9ad1e12ac786d8a8937bd88521a05c4024ee027edcf4338cbR1-R91)
[[5]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R2125-R2138)
* Added support for **VNC Server** on macOS, including metadata and
catalog entry.
[[1]](diffhunk://#diff-a5aa18a7d0dd174295ce8a65738eb9d499a3b22a810a9a566cdedfefea3eecb6R1-R8)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R2328-R2334)
**Supporting scripts and catalog updates:**
* Implemented robust PowerShell scripts for silent installation and
uninstallation of **Tableau Desktop** and **TeamViewer Host** on
Windows, handling edge cases such as process termination and registry
parsing.
[[1]](diffhunk://#diff-23116d8521375f8c07d973cb4a8424664511622be2f8054ff883762325a9fccaR1-R35)
[[2]](diffhunk://#diff-52b261b49349ced82dcec614b525537af74fb76b2b80d5b86bf47997dcc602a5R1-R94)
[[3]](diffhunk://#diff-6f0503390a74ce160c8cf97e8a21f6be441d96e8d7a7725b7fcd977020275208R1-R26)
[[4]](diffhunk://#diff-26c9cfc3f13dbdb9ad1e12ac786d8a8937bd88521a05c4024ee027edcf4338cbR1-R91)
* Updated `apps.json` outputs to include the new applications with
descriptions and platform information.
[[1]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R256-R269)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R2090-R2096)
[[3]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R2125-R2138)
[[4]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R2328-R2334)
This pull request introduces support for several new Windows
applications in the maintained apps catalog by adding their Winget
manifest JSON files and corresponding install/uninstall PowerShell
scripts. The main focus is on developer tools (DBeaver variants, Fork,
DB Browser for SQLite) and productivity software (Notion Calendar), with
scripts tailored to each application's installer type and uninstallation
method.
**New Application Manifests and Scripts:**
*Developer Tools:*
- Added manifests and install/uninstall scripts for `DBeaverEE`,
`DBeaverLite`, and `DBeaverUltimate`, handling silent installs and
registry-based uninstalls for NSIS installers.
[[1]](diffhunk://#diff-eaf4a46578aab1439f63fd34568a31a8af80686564126b42d35b58aa7f2c62e3R1-R13)
[[2]](diffhunk://#diff-e7f92237e92e146682aa31bba2adcb94960064cccbcba0aa4824d30fdb1db809R1-R13)
[[3]](diffhunk://#diff-c4cbef61403a529f50d498830989eb0eb45a0469d4c6a74731ba3404ec9a20b4R1-R13)
[[4]](diffhunk://#diff-7935ee0b5330d4aeaf7b86d764ec34df77d70906e4d15539b344a4ad26e2ce3dR1-R27)
[[5]](diffhunk://#diff-2f030daf30f518d6e45834242eff2f74ba59bcb11e7a266c37d227ccadaf2a5eR1-R75)
[[6]](diffhunk://#diff-76b88cbae2c5985490eb0fe76f3203db20fb0bf1b0de618923b23038112c1468R1-R27)
[[7]](diffhunk://#diff-1405c92b884320fb2c48b8c45d435a974db35b7eeceb1e9886a4adcb56416502R1-R75)
[[8]](diffhunk://#diff-e2284ea6c00f43ae37ac61c30a4787e77b7051df0fb91ae876662fbc6642e8f7R1-R27)
[[9]](diffhunk://#diff-ff8ec9020bc37f1350b45454e2e813aae39db842f30518d6ca0c31e67c4300e6R1-R75)
- Added manifest and install/uninstall scripts for `Fork`, supporting
silent Squirrel-based user installs and registry-based uninstalls.
[[1]](diffhunk://#diff-6e3b6ab0a68025636437cae06486a8037b30c8d67c6d64da78f5c2b5fcbad036R1-R12)
[[2]](diffhunk://#diff-58cf478f6b085152e55505765e959f3e2f251087edacb241ec8317a775934d95R1-R27)
[[3]](diffhunk://#diff-8affe7197066170c48e2badc36cedd32f0fa0229afbc2fd49fa844eadb84e25cR1-R69)
- Added manifest for `DB Browser for SQLite` with basic package
metadata.
*Productivity:*
- Added manifest and install/uninstall scripts for `Notion Calendar`,
supporting silent NSIS installs and registry-based user uninstalls.
[[1]](diffhunk://#diff-ec8fec2849c5d87cf4c21b1ba8f4aefd025cd9528590595c9d635699f85a5aecR1-R12)
[[2]](diffhunk://#diff-1d1b021f465f1417abc47475dabae2098f2b460cb9b46a649ef820517427440cR1-R27)
[[3]](diffhunk://#diff-54998d5d631d60bcb24503ba509beb0a3b760939476ecc12019b8960a877a9a4R1-R75)
*Other Installers:*
- Added install script for `Wacom Tablet Driver`, handling silent
InstallShield installs and special exit codes for reboot requirements.
Add a new Claude skill at .claude/skills/new-fma/SKILL.md that documents
the end-to-end workflow for adding Fleet-maintained apps (FMA) for macOS
(Homebrew) and Windows (winget). The skill emphasizes verifying
installer metadata with real tools (msiinfo, PlistBuddy), provides
inspection/toolkit commands, installer mapping, common pitfalls, and a
pre-ship checklist. Also update ee/maintained-apps/README.md to
reference the new skill for users to follow the automated guidance and
gotchas.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves # Unreleased bugfix in
https://github.com/fleetdm/fleet/issues/31138
We are setting the email on users Fleet creates via the API. We decided
to remove the existing logic we were using to try and link VPP Users
back to Fleet users if they get removed from the DB but by setting the
email we can follow up(later) with a tool that can query the Apple APIs
and list all users by their emails and we can insert them into the VPP
users table
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* VPP app installation failures now report immediately without automatic
retry or recovery attempts
* Improved error transparency for Apple app provisioning failures
* **Refactor**
* Simplified VPP user management and error handling logic
* Removed redundant user lookup and retry mechanisms from app
distribution workflows
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46382?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Power BI Desktop (Windows) added to the app catalog with automated
install/uninstall support, including graceful shutdown and robust
cleanup of leftover installations and registry entries.
* New package input definition for Windows package management to enable
automated deployments.
* Added a Power BI icon in the software management interface for easier
identification.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46284?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This pull request adds initial configuration files for a variety of
popular Windows applications to the `ee/maintained-apps/inputs/winget`
directory. Each file defines metadata and installation details for a
specific application, supporting automated installation and
categorization. The changes expand the catalog of supported apps,
especially in the categories of developer tools and productivity.
**New application configurations added:**
* Developer tools:
- Added configurations for JetBrains IDEs (`clion.json`,
`datagrip.json`, `goland.json`), DBeaver, MySQL Workbench, MongoDB
Compass, JetBrains Toolbox, GitKraken, Bruno, Insomnia, Lens, and
balenaEtcher, including install/uninstall scripts where applicable.
[[1]](diffhunk://#diff-3e4e7adc4b239327cc5d40ac702d757e156e016aec1c7c5f94c071a75fe3c4a3R1-R13)
[[2]](diffhunk://#diff-7c80111fa8fde96fcce98662a233200fd288ce0d43d590382e294746cfdccb80R1-R13)
[[3]](diffhunk://#diff-1b9a892edfa9f0d5a6a9bedfcfb05f5f81c28b8b8eb24b7af1f69fcf365faa95R1-R13)
[[4]](diffhunk://#diff-c4bd792a8985240e9c56c8a8b0ad42e494cb2f66243c9c003367b97b6281b8ebR1-R13)
[[5]](diffhunk://#diff-9aca1279003b064f238c0d041a20cdd5ae1d739c4d82e76cde9c53fa19f6b385R1-R11)
[[6]](diffhunk://#diff-b04e68ea6589d16110da5a46758373bdb4de968ec40d4c87e818a9deb1cf038eR1-R10)
[[7]](diffhunk://#diff-7118d8f25ce533ac6ff68996ef77f1414c40e1303e594a914c5ba8f38ec64276R1-R12)
[[8]](diffhunk://#diff-0ead97641d521188d580d83b60dea688638944ef1a757a779e433cff169059b4R1-R12)
[[9]](diffhunk://#diff-bf104e3d22035060f71605438fceffe9f706146eed7d8d30c3d2abf6a5ee5cefR1-R10)
[[10]](diffhunk://#diff-b3eda4fb883851adf2c082f4b59cd8b1a7202ba4259e62bc34b048896567e766R1-R12)
[[11]](diffhunk://#diff-223a89b91fd09d840a1d66037849717db5b28a6a811462e564e1006bd0ad171aR1-R13)
[[12]](diffhunk://#diff-0081626467bacfa7b6e2399e7aeb2daec0b4592e4de1d0b48d5f1a9f484ec1eeR1-R12)
* Productivity:
- Added configurations for Audacity, Bitwarden, Dropbox, draw.io, Loom,
Miro, and calibre, with relevant metadata and scripts for installation
management.
[[1]](diffhunk://#diff-17343e25b14845b33ccdd21e083514798da3d2060828a99f6a437bb7390982ecR1-R13)
[[2]](diffhunk://#diff-e5698c640f9ea28bea0dcae73b24da580297f52098f5f626551729463489e944R1-R12)
[[3]](diffhunk://#diff-cc13e4338596d6f03fe506a885309dd2073394d3213c289aea5b269ce9f872feR1-R10)
[[4]](diffhunk://#diff-8d8db7aa83e73313721dcdf3a9dad437a9b448cdd235d8e04e1287b16c0484aeR1-R12)
[[5]](diffhunk://#diff-277c3efb81a8d39babfc3c72cac751c85ba399f2ae0f2005cd5c5fc24e952e6eR1-R12)
[[6]](diffhunk://#diff-1e495b3b54ed010a6f44538f7269880065e9736f56b36603d43c6676528b2988R1-R12)
[[7]](diffhunk://#diff-b6459d15c09716fbe644e8cb949cf012953b556044eacbd1a8447f1d39dedadfR1-R11)
* Communication:
- Added configuration for Dialpad, including install and uninstall
scripts.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added Windows application support for 35+ popular tools and apps
including productivity (Dropbox, Loom, Obsidian), development (JetBrains
IDEs, GitKraken, Insomnia, Rancher Desktop), security (Bitwarden,
NordPass, NordVPN), and utility applications (Audacity, draw.io,
Signal).
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46313?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add WinSCP to maintained apps: introduce winget input metadata
(winscp.json) and add installer/uninstaller PowerShell scripts
(winscp_install.ps1 uses Inno Setup silent flags; winscp_uninstall.ps1
locates UninstallString/QuietUninstallString from registry and runs it
with silent args). Update outputs: add app entry in apps.json and add
winscp/windows.json with version, installer URL, checksums and embedded
script refs. Add frontend icon component and image, and register the
icon in the icons index.
Introduce GoToMeeting to maintained apps: add homebrew and winget input
manifests, darwin and windows output metadata (with installers,
checksums, and install/uninstall script refs), and frontend icon asset.
Include Windows install/uninstall PowerShell scripts (MSI machine-wide
install and uninstall via hard-coded UpgradeCode) and macOS DMG
install/uninstall refs and scripts. Update
ee/maintained-apps/outputs/apps.json to register GoToMeeting for darwin
and windows.
Also adjust Windows validation logic to special-case GoToMeeting version
checks: winget reports a package version (10.19.0.19950) that contains
an extra ".0" segment compared to the installed MSI/registry version
(10.19.19950), so the validator falls back to existence-only validation
and logs the difference.
Add P4V (Perforce) Windows package: new winget input (Perforce.P4V) and
a dedicated outputs/p4v/windows.json describing version 242.61.2 with
installer URL, sha256, upgrade code, and embedded PowerShell
install/uninstall scripts. Also update outputs/apps.json to register the
P4V/windows app entry.
Add Windows winget inputs and PowerShell scripts for IntelliJ IDEA
Community Edition and Ultimate. New files include input manifests
(ee/maintained-apps/inputs/winget/*.json), installer scripts that run
the NSIS installers silently (using /S), and uninstall scripts that
locate the uninstall string in the registry, stop running IDEA
processes, ensure the /S silent flag, and execute the uninstaller.
Update outputs by adding app entries in
ee/maintained-apps/outputs/apps.json and new per-app outputs with
version metadata, installer URLs, sha256 hashes and embedded script
refs: CE version 2025.2.6.2 and Ultimate version 2025.2.5.
Add Genesys Cloud to maintained apps: create input manifests for
Homebrew (darwin dmg) and Winget (windows msi), add output metadata
files for darwin (v2.49.25) and windows (v2.49.903.0) including
installer URLs, checksums, install/uninstall script refs and a Windows
upgrade code. Register the app in ee/maintained-apps/outputs/apps.json
and add a frontend SVG icon component, mapping entry, and PNG asset for
the software page.
Introduce Beyond Compare Windows package metadata and scripts for
winget. Adds input manifest
(ee/maintained-apps/inputs/winget/beyond-compare.json) plus install and
uninstall PowerShell scripts that handle Inno Setup silent install flags
and registry-based uninstaller discovery. Updates outputs: registers the
app in ee/maintained-apps/outputs/apps.json and adds a versioned output
file with installer URL, sha256, and script refs
(ee/maintained-apps/outputs/beyond-compare/windows.json).
Add support for Amazon Corretto 25 across the repo: new winget input
definition, Windows output metadata (version 25.0.3.9) including
installer/uninstaller PowerShell scripts, SHA256 and upgrade_code, and
register the app in ee/maintained-apps/outputs/apps.json. Also add a
frontend SVG icon component, map it in the icons index, and include the
2x PNG asset so the app is displayed in the UI. This enables Fleet to
install and uninstall Amazon Corretto 25 on Windows.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added complete Amazon Corretto 25 support for Windows including
detection, installation, and lifecycle management capabilities
* Enhanced Windows application detection to support matching by multiple
registry identifiers, improving detection accuracy for installed
programs
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46220?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add BlueJ as a maintained Windows app: new winget input manifest
(ee/maintained-apps/inputs/winget/bluej.json), PowerShell install and
uninstall scripts
(ee/maintained-apps/inputs/winget/scripts/bluej_install.ps1 and
bluej_uninstall.ps1), and output metadata
(ee/maintained-apps/outputs/bluej/windows.json). Also update apps index
(ee/maintained-apps/outputs/apps.json) to include BlueJ. The install
script passes ALLUSERS=2 so the per-user WiX MSI installs per-machine
when run elevated; the uninstall script finds related product codes for
the app's upgrade code and uninstalls each with a timeout. The outputs
include version 5.5.0, installer URL, checksum, and embedded script
refs.
This pull request adds Windows support for managing PhpStorm as a
maintained app, including installation and uninstallation automation,
and improves the ingestion logic to handle publisher information for
better normalization. The most important changes are:
**Windows support for PhpStorm:**
* Added a new maintained app definition for PhpStorm on Windows,
including metadata and references to install/uninstall scripts
(`phpstorm.json`).
* Implemented a PowerShell install script for PhpStorm that runs the
NSIS installer silently (`phpstorm_install.ps1`).
* Implemented a PowerShell uninstall script that finds the correct
PhpStorm uninstaller via registry, ensures it's the JetBrains version,
and runs it silently (`phpstorm_uninstall.ps1`).
* Added PhpStorm for Windows to the `apps.json` output and created a
versioned output file with install/uninstall logic and metadata
(`apps.json`, `phpstorm/windows.json`).
[[1]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1404-R1410)
[[2]](diffhunk://#diff-0286e1ea4f71a5a6d429728675f1b3d8eb8bb14241c86c1ce7697e454b9cbe4dR1-R22)
**Improvements to ingestion logic:**
* Updated the app existence check in `windows.go` to select and
propagate the `publisher` field, and set the `Vendor` on ingested
software, ensuring publisher-based normalization (important for
JetBrains build-number handling).
[[1]](diffhunk://#diff-a0970c0b97aa9bac9f771a8ecb164afea2bc7245206844f6e32aa5b69d964f4aL55-R55)
[[2]](diffhunk://#diff-a0970c0b97aa9bac9f771a8ecb164afea2bc7245206844f6e32aa5b69d964f4aR74)
[[3]](diffhunk://#diff-a0970c0b97aa9bac9f771a8ecb164afea2bc7245206844f6e32aa5b69d964f4aR84-R91)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for PhpStorm on Windows, including automated
installation and removal capabilities.
* Enhanced Windows application detection to retrieve publisher
information for improved vendor identification.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46217?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Register Omnissa Horizon Client for Windows: add a winget input
manifest, install and uninstall PowerShell scripts, and output metadata.
The install script runs the WiX Burn bundle via ${env:INSTALLER_PATH}
with /quiet /norestart; the uninstall script locates the WiX
bootstrapper in the registry and runs it silently. Also add app entry to
outputs/apps.json and a new outputs/omnissa-horizon-client/windows.json
containing version 8.18.0.51429, installer URL, sha256, and embedded
script refs.
Add Logi Options+ Windows package manifest and scripts. Creates a winget
input manifest (logi-options+.json), silent install and uninstall
PowerShell scripts, and a new outputs file for the app version with
installer URL, SHA256 and script refs. Also updates
ee/maintained-apps/outputs/apps.json to include the Windows entry.
Installer script handles the analytics opt-out and treats exit code 0 or
-1978335226 as success; uninstall script locates the app via registry
(QuietUninstallString/UninstallString) and ensures a /quiet uninstall.
Register TortoiseGit as a maintained app: add winget input
(ee/maintained-apps/inputs/winget/tortoisegit.json), add app metadata to
outputs/apps.json, and create a platform-specific output with version,
installer URL, sha256, install/uninstall PowerShell scripts, and MSI
upgrade code (ee/maintained-apps/outputs/tortoisegit/windows.json). Also
add a frontend icon component and asset
(frontend/pages/SoftwarePage/components/icons/Tortoisegit.tsx and
website/assets/images/app-icon-tortoisegit-60x60@2x.png) and wire it
into the icons index mapping.
This pull request adds full support for managing Adobe Creative Cloud on
Windows via Winget, including installation, uninstallation, and
detection. It introduces new manifest and script files, as well as
updates to the application metadata and output definitions.
**Adobe Creative Cloud for Windows integration:**
* Added a new Winget manifest file `adobe-creative-cloud.json` that
defines how to install and uninstall Adobe Creative Cloud, specifying
installer details and script paths.
* Implemented a PowerShell install script
(`adobe_creative_cloud_install.ps1`) that performs a silent installation
using the official stub executable and handles errors gracefully.
* Implemented a PowerShell uninstall script
(`adobe_creative_cloud_uninstall.ps1`) that finds and invokes the
official Adobe uninstaller, including logic to stop related processes
and search both registry and known paths.
**Application metadata and output updates:**
* Added a new entry for Adobe Creative Cloud (Windows) to the
`apps.json` output file, ensuring it appears in application listings
with the correct metadata.
* Created a new output definition file (`windows.json`) for Adobe
Creative Cloud, specifying detection queries, installer URL, script
references, SHA256 hash, and category.
Remove stale "frozen" flags from multiple input manifests and bump
versions/refs for several maintained apps. Changes include:
- Inputs: removed "frozen": true from homebrew and winget inputs for
adobe-acrobat-pro, backblaze, filemaker-pro, keeper-password-manager,
logi-options+, quip, telegram, and cloudflare-warp.
- Adobe Acrobat (darwin): bumped version to 26.001.21563, updated
install/uninstall script refs and install script content, added a
"patched" query.
- Backblaze (darwin): bumped version to 10.0.2.1048, updated installer
URL and sha256, reorganized/refactored installer refs and scripts, added
a "patched" query.
- Cloudflare WARP (windows): bumped version to 26.4.1350.0, updated
installer URL and sha256, updated patched query.
- Evernote (darwin): bumped version to 11.17.3 and added a "patched"
query.
- FileMaker Pro (darwin): bumped version to 22.0.6, updated installer
URL, sha256 and install script ref, adjusted patched query.
These updates refresh installers, checksums and scripts and enable
patched-version detection for the updated entries.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41683
Support for Android lock, wipe, and clear passcode commands. Behavior is
slightly different between BYOD and CODO. The fleetdm.com proxy isn't
wired up, so they only work with direct Google connection.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Clear-passcode CLI plus Android Lock and Wipe commands (Wipe
restricted to company-owned devices).
* BYO unenroll now removes only the work profile, preserving personal
data.
* Commands issued with a 10-year duration; UI/CLI show Android-specific
messaging and command IDs.
* **Improvements**
* Host MDM pages reflect command lifecycle transitions (pending →
acknowledged or error with code/message) via Pub/Sub updates.
* **Documentation**
* Updated docs for Android MDM commands, ownership rules, and command
duration.
* **Tests**
* New unit and integration tests for Android MDM flows.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46031?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Remove the frozen flag from the Homebrew input and update the darwin
output for com.google.GeminiMacOS: bump version to 1.60.2.323, update
the patched query to use the new version, and refresh the
install_script_ref (5a341444 -> e3521e04) along with its script content.
Installer URL and sha256 remain unchanged; uninstall ref unchanged.
Magnus Jensen
