<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45984
Fix is applied on the GitOps side since that's what I figured the
customer was using on the [Slack
thread](https://fleetdm.slack.com/archives/C061ZA91Y1J/p1779372669701129).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
#### Before
Reproduced on `main`:
- Set `update_new_hosts: true` beforehand.
- Ran `gitops` with `update_new_hosts` commented out. It was still kept
as `true`.
https://github.com/user-attachments/assets/f6b41f0d-38e6-468f-a605-b3e66b7b2dbc
#### After
Running `gitops` with `update_new_hosts` commented out switched its
value to `false`.
https://github.com/user-attachments/assets/24756063-b3a9-400b-a2cc-208dd816a556
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected GitOps behavior for the macOS “Update new hosts to latest”
setting so it no longer stays enabled after clearing `minimum_version`
and `deadline`; it now defaults to disabled unless both are set.
* **Tests**
* Added GitOps test coverage to verify the defaulting outcomes across
YAML variations for the macOS update settings, including explicit and
empty field combinations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45598
1. Apple disregards query params in the 403 WWW-Authenticate URL, so
setting it as the ?initiator= does not work, had to make a new route on
the frontend to match the same URL but with a dynamic token.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary
* **New Features**
* Added support for a configured default fleet/team for BYO Apple
enrollment.
* Enabled account-driven Apple MDM enrollment using per-enrollment
tokens.
* Added tokenized Apple MDM service discovery and enrollment endpoints.
* **Bug Fixes & Improvements**
* Added automated daily cleanup of expired enrollment challenges.
* Improved BYOD/account-driven enrollment challenge handling, including
default team assignment and Managed Apple ID updates.
* Reduced unnecessary BYOD MDM profile refetches during reenrollment.
* **Tests**
* Expanded coverage for token lookup, enrollment challenges, and updated
BYOD/account-driven flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47573
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated observability and telemetry configuration for improved
deployment monitoring.
* Enhanced infrastructure environment variables including logging,
database connection management, and Fleet service settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Added a new page: /security-and-control
- Added a link to the new page in the "Solutions" header dropdown menu
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## New Features
* Added a new "Security & control" page featuring security solutions
overview, product features including software inventory and autonomous
remediation capabilities, customer testimonials, and call-to-action
sections. The page is accessible via the updated website navigation
menu.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Add a new Smartsvn SVG component
(frontend/pages/SoftwarePage/components/icons/Smartsvn.tsx) and include
the PNG asset (website/assets/images/app-icon-smartsvn-60x60@2x.png).
Update the icons index to import AwsCli and Smartsvn, add mappings for
"aws command line interface", "druva insync", "smartsvn", and "vnc
server", and normalize Azul Zulu keys from "azul zulu 25 jdk/jre" to
"azul zulu jdk/jre".
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated metadata for 25+ maintained applications across Windows and
macOS platforms, including Docker, Discord, Slack, Spotify, and others,
to reflect current available versions.
* Added frozen state configuration for Fire Alpaca and NVIDIA GeForce
NOW Homebrew packages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
**Related issue:** Resolves#41910
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Configurable Android app operation batch size
(FLEET_MDM_ANDROID_BATCH_SIZE, default 1000) to reduce Android
Management API load.
* Android software install and app-availability operations now run in
batched, staggered jobs across workers to improve reliability and avoid
API throttling on large fleets.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Removed, compressed, or resized large images in the website's assets
folder
- compressed whitepaper pdfs
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Adds Mollie case study.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Mollie as a featured customer case study on the customers page,
including company branding, overview information, and a link to the full
case study.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
For #32765
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Fleet software package management (add/update) and download for
software titles.
* Added Apple App Store app management, including listing, adding, and
linking apps to titles.
* Added Fleet-maintained app support for titles.
* Enabled host software uninstalls and retrieval of install/uninstall
results via `install_uuid`.
* Added ability to remove a title’s “available for install” status.
* **Bug Fixes**
* Updated software title icon labeling to indicate download.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Updated the get-territory-user-id helper to not require a country
input, but to throw an error if one is not provided. This is done to
replace the default usageError that is thrown by helpers with an error
that provides more information about the provided inputs
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved input validation error handling for territory lookups to
provide clearer error messages during runtime.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/47387
Changes:
- Added a section to the /software-management page
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added new page section titled "Customize their experience" showcasing
user experience management and customization options. Highlights include
app patching notifications, native notification delivery, calendar
integration support, and seamless compatibility with existing management
tools, emphasizing flexible notification strategies across multiple
communication channels.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/47406
Changes:
- Added a CTA to the article template page.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Call-To-Action sections to certain article pages with a "Read
case studies" link and a "Try it yourself" sign-up button for select
categories.
* **Style**
* Updated CTA styling and layout, including a new CTA container and
button row.
* Improved mobile behavior: buttons stack, center, and become full-width
on small screens.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The FMA unique identifier (software title match) for Cloudflare WARP
changed recently to Cloudflare One Client. This test was using the input
file from `/ee/maintained-apps/inputs/winget/cloudflare-warp.json` so
the change actually affected it.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Updated Cloudflare product identification test expectations to reflect
current software naming and version tracking behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for several new Windows applications to
the maintained apps catalog by introducing new JSON manifest files under
`ee/maintained-apps/inputs/winget/`. Each manifest specifies
installation details, categorization, and, where needed, custom
install/uninstall scripts. The additions cover a mix of productivity,
developer tools, and communication apps.
**New application manifests added:**
_Productivity apps:_
* Added manifests for `ActivityWatch`, `AirParrot`, `Bdash`, `Binance`,
`Biscuit`, `BreakTimer`, `darktable`, `Descript`, `DevToys`, `dupeGuru`,
`Dynalist`, `Electrum`, `GDevelop`, and `Gephi`, each with relevant
install/uninstall scripts and metadata.
[[1]](diffhunk://#diff-55387cfd17c8952a5a5fe56f9072156a285797be5316796f7a1bec6a190170b1R1-R12)
[[2]](diffhunk://#diff-b6391ec86660a9cbcbe90756daea60701eb69b6e0ebbde2b0d8c75dd1a31a126R1-R11)
[[3]](diffhunk://#diff-04b0ac58d3fd3d42504786f39d612dc89bde16512d954bbf1646547d15837c6fR1-R13)
[[4]](diffhunk://#diff-12047bbb053e94f70e18af209bc7b901c37df285ca753549c619cc409b3da361R1-R13)
[[5]](diffhunk://#diff-984aab5373578ee3278d33367fc48b7d67c3ddb59b35d257ef170bb8ee62aaf4R1-R13)
[[6]](diffhunk://#diff-4e06e7c7940663923b6210a19495dd13eeb605d368312718402136666edb2d23R1-R13)
[[7]](diffhunk://#diff-e4ec2c2ab61f6a9de45914b1ca8ee08ce4cde504e4e595341a776a5e69dd5862R1-R12)
[[8]](diffhunk://#diff-b7a6f3074314e4d52a9c5b8d104247ecdbf80e526791d7a02e1819e7a7148441R1-R15)
[[9]](diffhunk://#diff-096ca15b420e419a365d998af529e92e2adfb45a1d28738cfb3009afff48b3daR1-R12)
[[10]](diffhunk://#diff-0db89ec11e8da68b0eb4e894805ae3f71258bf4844aadfd1423fe0b671e58da8R1-R12)
[[11]](diffhunk://#diff-ad484bc36aa30653876aaf4665ad1e5366088a68121163ed94399fecaa17cb7cR1-R14)
[[12]](diffhunk://#diff-1516c2e3c532aecf16b7f81e7cf4488ad1aefca791cf58f5bab1f08c1d3d0becR1-R14)
[[13]](diffhunk://#diff-133f3702736e7cc29113b3faf59cd15fd631b853f21108f19a3428c8a1dac0f7R1-R12)
[[14]](diffhunk://#diff-7b356cca2e47651ce2cdbf7b99ddd89b410185ddddf7546daaefee1d14161d5dR1-R12)
_Developer tools:_
* Added manifests for `Cherry Studio`, `Dataflare`, `DbVisualizer`, and
`Geany`, categorized as developer tools and including install/uninstall
scripts.
[[1]](diffhunk://#diff-8c85cc5f00362d25db8bc87ecd1135e4038b5dbe29408cf6146ff144de02d477R1-R12)
[[2]](diffhunk://#diff-b4a1720d2b1d727613a311c4a2cfd0f1c2e0a6198c0c31605286b9ef20e30896R1-R12)
[[3]](diffhunk://#diff-7a4d41ce430b5a37d4d311c5c3ebaf3bbaef41da062db201fb496f6a2d6abb5fR1-R12)
[[4]](diffhunk://#diff-cb4abb01239b831cc4e82020821d457a018ba1ea109fbc4fe1660bc0b7839af9R1-R12)
_Communication apps:_
* Added manifests for `Fellow` and `Franz`, categorized as communication
tools with user-scope installers and scripts.
[[1]](diffhunk://#diff-284b2bdcf738397525f4e60f50da15c764c6306e8707e4f3196a9a4968a96c56R1-R12)
[[2]](diffhunk://#diff-c60796271608d278c88037acec46900c6da13731b73697b2ef08e4c3ddacd9c8R1-R12)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added support for 30+ new Windows applications including productivity
tools (Bdash, Morgen, Fellow), utilities (dupeGuru, DevToys, Geany),
developer tools (Lapce, KNIME, GDevelop), and others (Binance, Electrum,
GOG Galaxy, Mullvad Browser, ImHex, and more).
* **Improvements**
* Updated description formatting for existing app entries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44617
Screenshot:
<img width="1318" height="528" alt="image"
src="https://github.com/user-attachments/assets/4ec4bd85-8efb-4729-86ad-ea3059439b60"
/>
Note that the uninstall details modal is viewable without any errors on
Fleet Free, so maybe we should address that at some point.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* When accessing software install details without a Fleet Premium
license, the activity modal now displays a Fleet Premium upsell message
with a "Learn more" link instead of a generic error, providing clearer
guidance to upgrade.
* **Tests**
* Added test coverage for the Fleet Premium license requirement scenario
in the install details modal.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Small tool update to support fetching the service discovery URL
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a `-command` flag to enable a new operation mode; when set to
`adue` the CLI performs the account-driven enrollment discovery flow,
otherwise it falls back to the existing account detail behavior.
* **Chores**
* Simplified the server private key flag to `-key`.
* Strengthened input validation to require both `-key` and `-org-name`.
* Enforced mutual exclusivity among operation flags (`-profile-uuid`,
`-serial-number`, `-command`).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
## Summary
- Removes the "*Windows coming soon" text from the
`/software-management` page on fleetdm.com.
## Why
Fleet already supports Windows software and OS management. The "coming
soon" caveat adds unnecessary FUD and confusion — it makes it seem like
Fleet doesn't support Windows, which it absolutely does. Removing this
text provides a clearer and more accurate representation of Fleet's
capabilities.
## Changes
- `website/views/pages/software-management.ejs`: Removed the `<span
purpose="feature-note">*Windows coming soon</span>` element from the
"App store management" feature section.
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1781314316685189?thread_ts=1780459268.285059&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated version metadata and installer information for 26 applications
including Affinity, BoltAI, CodexBar, Cursor, DataFlare, DeepL, Deezer,
Docker Desktop, Dockside, Dropshare, FireAlpaca, HexFiend, Hive, Kitty,
Melodics, Mullvad VPN, NVIDIA GeForce Now, OpenCode, Pd, Postman, Stats,
Syncovery, TablePlus, Typora, WhatsApp, and Zettlr across macOS and
Windows platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46937
Moves fleet desktop standalone app from
https://github.com/allenhouchins/fleet-desktop into the monorepo
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
No changes file. Do we want to create a new changes directory and
changelog for this? Unclear
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
Downloaded build from CI, tested locally and installed via Fleet on a
mac mini. Launched and tested there - all looks good
<img width="1485" height="544" alt="Screenshot 2026-06-09 at 4 27 59 PM"
src="https://github.com/user-attachments/assets/48611808-2265-43b7-a514-afc4f578a9f8"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Launched Fleet Desktop macOS app with web-based self-service UI.
* Added fleet:// URL handling to trigger in-app actions (refetch, update
all).
* Dock badge shows failing policies count in real time.
* Built-in token refresh, retries, and navigation error handling for
reliability.
* MDM configuration support for enterprise deployment.
* Automated macOS packaging with code signing, notarization, and
artifact upload.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46584
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
(Already added in main.)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
`generate-gitops`:
https://github.com/user-attachments/assets/d32e89c3-2ce7-4c57-9492-66deb0a3dfe8
`gitops`:
https://github.com/user-attachments/assets/ac0e3935-bc8d-4541-b3e5-f992109630d9
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added `labels_exclude_all` field support for refining policy label
scopes (available with Fleet Premium license).
* **Bug Fixes**
* Enhanced validation of policy label scope configurations to prevent
invalid field combinations and enforce license requirements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added test coverage to verify team administrator access controls and
boundary enforcement. The test ensures that team admins cannot create
users in other teams, validating this restriction across both standard
and API-only user creation endpoints. The test also confirms that users
can be successfully created within their authorized team scope.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47492 and Resolves#46982
- Fixed panic when uploading bad profile
- Added validation for SCEP challenge to exclude underscore (and other
non-printable characters).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Prevented a server panic during Windows configuration profile
validation when SCEP and non-SCEP elements are mixed; such profiles are
now rejected with a clear validation error.
* **New Features**
* Enforced Windows-compatible printable characters for Custom SCEP proxy
challenge values; rejects disallowed characters while preserving legacy
values unless changed.
* **UI / Validation**
* Improved form validation feedback for the Custom SCEP challenge field,
showing errors and disabling submit for invalid input while allowing
masked/unchanged values.
* **Tests**
* Added regression and unit tests covering profile validation and
challenge character validation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A — repo cleanup
## Summary
Removes orphaned files under `ee/maintained-apps/` that have no entry in
`outputs/apps.json` and are not referenced by any input, so they are
dead
weight (never surfaced in the product UI or on fleetdm.com):
- **22 macOS `darwin.json` outputs** with no `apps.json` entry and no
corresponding `inputs/homebrew/*.json` (so nothing regenerates them):
salesforce-cli, screaming-frog-seo-spider, servo, shureplus-motiv,
silentknight, silhouette-studio, simpledemviewer, sketchup, skim,
sonos-s1-controller, sonos, studio-3t, subethaedit, sunsama, superlist,
swift-quit, swift-shift, switch, synologyassistant, systhist,
tableau-public, tresorit.
- **6 winget scripts** not referenced by any winget input's
`install_script_path`/`uninstall_script_path`:
`google_chrome_{install,uninstall}.ps1`,
`msteams_{install,uninstall}.ps1`,
`okta_verify_{install,uninstall}.ps1`.
No `apps.json` entries, inputs, or referenced files are touched. 28
files
removed, deletions only.
# Checklist for submitter
- [x] Changes file not required (no user-visible behavior change;
removes unused files only).
## Testing
- [x] Verified each removed `darwin.json` has no `apps.json` entry and
no `inputs/homebrew/*.json`.
- [x] Verified each removed script is referenced by 0 winget inputs.
- [x] Diff is deletions only (943 lines across 28 files); no
entries/inputs affected.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Removals**
* Removed installation and uninstallation scripts for Windows
applications: Chrome, MSTeams, and Okta Verify.
* Removed macOS application configurations for approximately 20
applications including Salesforce CLI, Sonos, Studio 3T, SketchUp,
Tableau Public, Tresorit, and others.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated application version metadata for 23 maintained apps across
Windows and macOS platforms, including Android Studio, Audacity, AWS
CLI, Bezel, Cursor, Dropbox, Mailspring, Microsoft Edge, Nextcloud Talk,
Telegram, and others. Version numbers, installer checksums, and download
URLs have been refreshed to reflect the latest available releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Adds Windows Fleet-maintained apps for apps that already exist as macOS
FMAs and ship in winget as a machine-scope MSI/WiX installer:
Bitwig Studio, Clockify, CMake, eM Client, Epic Games Launcher, Mixxx,
NAPS2, PDFsam Basic, Topaz Gigapixel AI, Topaz Photo AI, Transmission,
Zulip.
Identity fields verified against the real MSI (msiinfo) per new-fma
rules:
- fuzzy_match_name for version-bearing DisplayNames (Bitwig,
Transmission)
- program_publisher overrides where registry Publisher != winget locale
(Clockify -> CAKE.com Inc., eM Client -> eM Client s.r.o.)
- eM Client is x86-only (no x64 in winget)
Adds 25 Fleet-maintained app(s) whose cask token starts with 'N':
inputs, outputs, app icons (TSX + website PNG), and the matching
index.ts and apps.json entries.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for 24 new apps (Nagstamon, Name Mangler, NAPS2, NDI
Tools, NeoFinder, Netiquette, NetNewsWire, Netron, NetSpot, Nextcloud
Talk Desktop, Nightfall, Nitro PDF Pro, Nocturnal, NordLayer, NoSQL
Workbench, NotchNook, Notepad.exe, Notesnook, NotesOllama, Noun Project,
Novabench, Nucleo, Numi, NVIDIA GeForce NOW) with
install/uninstall/version metadata.
* **UI Changes**
* Added icons and name→icon mappings for the new applications and
expanded the software icon registry.
* **Updates**
* Expanded and reordered the maintained apps listing to include the new
entries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
# Release Notes
* **Chores**
* Updated installer metadata for 52+ applications to newer versions,
including Android Studio, Brave Browser, Google Chrome, Microsoft Edge,
Visual Studio Code, Postman, and many others across macOS and Windows
platforms.
* Updated version numbers, download URLs, and integrity checksums to
reflect latest application releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Changes:
- Moved the quote from Wes Whetstone on the homepage back to the page
hero.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Refreshed homepage hero with updated headline and messaging
* Revised hero CTAs to "Get a demo" and "Join a workshop"
* Improved responsive layout and typography across mobile and desktop
breakpoints
* **New Features**
* Embedded customer quote with author identity and larger profile image
* Reordered content so statistics follow the updated hero section
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45635
- Refactored setup experience flow to use host-specific reconciler
methods
- Removed now unneeded reconciler methods
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Windows configuration profiles are now queued immediately when a host
enrolls in Windows MDM, so profile delivery happens during the same
check-in instead of waiting for the next reconciliation cycle.
* Windows MDM enrollment finalization now runs per-host reconciliation
and will block release until that reconciliation completes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds 43 Fleet-maintained app(s) whose cask token starts with 'A':
inputs, outputs, app icons (TSX + website PNG), and the matching
index.ts and apps.json entries.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for 50+ macOS applications including Acorn, Affinity
Suite, AirDroid, Anytype, Audio Hijack, and more
* Applications now include automated installation and management
capabilities with version tracking
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Updated the testimonials shown on the visibility and reporting page.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Updates**
* Modified the selection and order of testimonials displayed on the
Visibility and reporting page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#41910
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a configurable env var to limit Android MDM profile
reconciliation batch size (FLEET_MDM_ANDROID_PROFILES_BATCH_SIZE;
default 1000).
* Reconciliation now processes hosts in cursor-based, batched windows
and persists a reconciliation cursor to resume/advance work, reducing
peak API load and enabling pagination.
* **Tests**
* Added validation tests for the batch-size config and tests verifying
cursor-based pagination and processing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Nico
