Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the available Claude Windows app version to 1.21459.3.
* Updated the available Cursor Windows app version to 3.11.19.
* Refreshed installer download links and verification checksums for both
applications.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Add comprehensive documentation of secure configuration baselines for
Fleet's AWS cloud infrastructure, including organization-level controls,
identity and access management, customer environment baseline
(encryption, networking, database, compute), and known deviations.
Covers infrastructure-as-code approach via Terraform with alignment to
AWS FSBP, CIS AWS Foundations Benchmark, and NIST 800-53 standards.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
Cherry-pick of #48451 ("Adding changes for Fleet v4.89.0") from
`rc-minor-fleet-v4.89.0` into `main`.
This brings the v4.89.0 CHANGELOG entry and the corresponding `changes/`
cleanup into main. The CHANGELOG conflict was resolved by placing the
4.89.0 section above the existing 4.88.1 section (keeping main's 4.88.1
date of Jul 10, 2026).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added vulnerability filtering by CVSS score and exploitability in
Fleet Desktop.
* Added default enrollment behavior for fleet-owned Apple devices.
* Added additional filtering options to the Vulnerability Exposure
chart.
* Improved certificate template variables, including IdP values and host
platform.
* **Bug Fixes**
* Fixed policy selection pagination, stale policy/report details, and
missing-host reporting.
* Corrected SSO and email links when Fleet is hosted under a URL
subpath.
* Improved Windows profile validation and MDM command labeling.
* Fixed several display and accessibility issues, including host counts,
checkbox wording, and dark-mode badges.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Changes
Adds a policy statement to the "Generate a quote" section of the GTM
operations handbook page:
> **Policy: Any quote with custom terms must be reviewed by the CFO in
addition to other approvers.**
This is placed immediately after the existing custom terms guidance
(added in #49315), making it clearly visible as a requirement before the
approval submission step.
---
Built for [Sam
Pfluger](https://fleetdm.slack.com/archives/C08BTMFTUCR/p1784221707835089?thread_ts=1784057153.990589&cid=C08BTMFTUCR)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
**Related issue:** Resolves#41470
Adds support for uploading Python (`.py`) script-only software packages
— accepted as script-only (the file contents become the install script;
advanced options and automatic install follow `.sh`/`.ps1`), assigned
the new `py_packages` source, and installable on macOS and Linux hosts
across the UI, REST API, and GitOps.
Feature branch combining the backend (#48942) and frontend (#48946)
sub-PRs.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for Python (`.py`) script-only software packages across
UI uploads, API/self-service installs, and GitOps parsing.
* Python installers now derive metadata correctly and render the proper
Python icon, with install eligibility for macOS & Linux.
* **Bug Fixes**
* Improved installer-script validation and “supported file types” error
messages to include `.py` (and consistent handling of related script
fields/options).
* **Tests**
* Expanded unit, integration, and GitOps tests to cover Python package
parsing, metadata derivation, platform/host eligibility, and UI
rendering.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48811
This adds a "Use custom host vitals in scripts and configuration
profiles" guide and cross-links it from the built-in variables and
custom variables (secrets) guides.
## Testing
- [ ] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49376
Fixes an issue where, on Fleet Free, Controls > OS settings and Controls
> Scripts rendered an infinite loading spinner.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
### Before
https://github.com/user-attachments/assets/96ad3406-101d-4310-83e2-430331e0f854
### After
https://github.com/user-attachments/assets/6a83adf3-1110-49b1-bb65-401cb8df3c61
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved how Controls sub-pages receive the selected team for
free-tier accounts by normalizing unresolved values to a dedicated “no
team” ID.
* Avoided triggering “no team” lookups during initial config loading
when the tier is still unknown.
* Kept premium-tier forwarding behavior unchanged so unresolved team IDs
continue to wait as before.
* **Tests**
* Added coverage to verify the forwarded team ID behavior across free,
premium, and unknown-tier scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38214
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Updated delayed host vitals notifications to indicate that loading is
taking longer than expected, rather than suggesting the request failed.
- Applied the clearer message across host details, My device, and the
dashboard welcome card.
- Preserved loading and timeout behavior while improving the accuracy of
the user-facing notification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated macOS Burp Suite to version 2026.6.
- Updated macOS Dot to version 2.3.2.
- Updated Windows Evernote to version 11.25.6.
- Updated macOS GDevelop to version 5.6.274.
- Updated macOS Kiro to version 1.0.138.
- Updated Windows Postman to version 12.19.5.
- Updated Power Automate for desktop to version 2.70.00187.26189.
- Updated macOS Spokenly to version 2.25.1.
- Updated macOS VPN Tracker 365 to version 26.6.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated maintained app metadata for the latest releases of 3DF Zephyr,
ChatGPT, Claude, Cursor, Discord, Evernote, Fastmail, Fing, JetBrains
Toolbox, Kiro CLI, Miro, Notepad.exe, Opera, Portfolio Performance,
Rocket.Chat, Signal, Slicer, Tailscale, Tower, Visual Studio Code,
Vivaldi, WebCatalog, and Zen Browser.
* Refreshed installer download links, version detection thresholds, and
integrity checks to match the new releases.
* Updated Fing’s installer format to use ZIP artifacts.
* Corrected Mimestream’s uninstall configuration to point to the right
script reference.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Relates to #38806
Extend host name templates beyond the three host-identity variables to
also accept the IdP end-user variables, and re-enqueue the rename when a
referenced variable's value changes.
Re-enqueue on value change:
- An IdP data change (SCIM user/group create/update/delete) re-queues
only the affected hosts whose template uses the changed IdP variable —
IdP values are per host, so the scope is the specific hosts mapped to
that user/group.
- A custom (secret) value change re-queues every eligible host in each
team / "No team" whose template references the changed secret — secret
values are global, so the scope is the whole team/No-team.
Built-in variables intentionally NOT supported:
- Certificate/CA variables — $FLEET_VAR_NDES_SCEP_CHALLENGE,
_NDES_SCEP_PROXY_URL, _CUSTOM_SCEP_CHALLENGE_*,
_CUSTOM_SCEP_PROXY_URL_*, _SMALLSTEP_SCEP_CHALLENGE_*,
_SMALLSTEP_SCEP_PROXY_URL_*, _DIGICERT_DATA_*, _DIGICERT_PASSWORD_*,
_SCEP_WINDOWS_CERTIFICATE_ID, _CERTIFICATE_RENEWAL_ID (and legacy
_SCEP_RENEWAL_ID), _PSSO_DEVICE_REGISTRATION_TOKEN. These resolve to
one-time SCEP challenges, proxy URLs, base64 PKCS12 cert data, or
Fleet-minted tokens — meaningless as a device name, and resolving them
has side effects (issuing certificates, consuming one-time challenges)
and would leak secrets into a name that's broadcast on-device, in
osquery, and in the UI.
- Legacy $FLEET_VAR_HOST_END_USER_EMAIL_IDP — deprecated ("avoid in new
replacements") and not a documented built-in variable, so it's excluded
in favor of the supported IDP_USERNAME variables.
**Related issue:** N/A
## Summary
Adds a reusable Claude Code skill (`/aikido-tickets`) that automates
creating GitHub issues from Aikido pen test PDF reports. The skill:
- Reads findings from an Aikido detailed auditor report PDF
- Creates properly formatted issues in the confidential repo with attack
path, fix recommendations, and full Aikido details in a collapsible
section
- Assigns to the correct team project board and sets status to Ready
- Supports all Fleet engineering teams (Orchestration, S&C, MDM,
Software, First Impressions)
- Handles batch creation using parallel agents for efficiency
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] QA'd all new/changed functionality manually
Resolves#34311.
It's not urgent because:
- Orbit uses a fallback mechanism to fetch the device UUID (using
SMBIOS):
https://github.com/fleetdm/fleet/blob/d3092bbc640ebd8e92c13476f0ca8772b98d425e/orbit/pkg/platform/platform_windows.go#L354-L359
- Only used by the `mdm_bridge` table implementation. Which is only used
by CIS policies (not for critical MDM functionality).
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] QA'd all new/changed functionality manually
Tested on both a Windows 11 VM with 25H2 and real Windows 11 device with
23H2. The extracted UUID matches the UUID reported by osquery.
## fleetd/orbit/Fleet Desktop
- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [X] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [X] Verified that fleetd runs on macOS, Linux and Windows
- [X] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Updated Windows device identification to obtain the system UUID using
COM-based WMI querying instead of relying on the deprecated WMIC
utility.
- Removed the WMIC dependency from the MDM bridge table implementation.
- Improved cross-platform UUID handling by removing unused non-Windows
UUID placeholder logic and related constants.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#35075
- Added vulnerability (CVE) reporting for Android OS versions.
- Folded the Android security patch level into the host's OS version.
---------
Co-authored-by: Konstantin Sykulev <konst@sykulev.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46077
Newly created or updated reports (formerly "queries") did not appear in
the host details page's "Live report" modal, or in the standalone
reports list, until a hard refresh. This happened because the
reports-list query cache was never invalidated after a create/update,
and the host details modal additionally disabled refetch-on-mount, so it
kept serving stale cached data even when reopened.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
Premium license:
https://github.com/user-attachments/assets/b045b8da-b7d6-4ba6-b18d-b944208c75d2
Free license:
https://github.com/user-attachments/assets/974106e5-e620-4c46-b3ec-a74c955fe26d
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Newly created or updated reports now appear immediately in the host
details “Live report” modal and reports list without requiring a hard
refresh.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
We missed a space under Controls > Setup experience > Users > End user
authentication.
Before:
<img width="846" height="207" alt="Screenshot 2026-07-09 at 14 56 09"
src="https://github.com/user-attachments/assets/ef0e0022-aba4-4087-84ad-6657af77ec93"
/>
After:
<img width="861" height="205" alt="Screenshot 2026-07-09 at 14 56 04"
src="https://github.com/user-attachments/assets/8eeff380-4616-4621-b06c-88fc748329d0"
/>
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the spacing in the “Lock end user info” help text so the
highlighted field names now display more clearly in the UI.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#37972
This also fixes the sort order of fleets for flee-level users.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the user menu to show the correct settings sections based on
account type and access level, with clearer separation between sections.
* **Bug Fixes**
* Fixed fleet sorting for fleet-level users.
* Corrected top navigation behavior so the menu only shows
role/tier-appropriate items.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45729
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Self-service software table on My device page now shows both installed
and available version columns for each app, making it easier to see
current and updateable versions at a glance.
* **Tests**
* Added/updated tests covering installed and available version display
scenarios, including cases with missing installed versions and when both
versions are present to ensure correct UI rendering.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated Windows installer metadata (versions, download URLs, and
checksums) for AWS CLI, Fellow, Google Drive, Logi Options+, MongoDB
Compass, Ollama, Signal, TablePlus, TextExpander, and Zed to match the
latest releases.
* **Bug Fixes**
* Improved Google Drive uninstall handling by treating common
success/reboot exit codes as successful outcomes, ensuring non-zero
codes don’t get recorded incorrectly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Refreshed Windows and macOS app packages to their latest available
versions, including browsers, developer tools, productivity apps,
security software, and utilities.
* Updated installer download locations and integrity checks to match the
refreshed releases.
* Improved installation and removal support for select applications with
updated package handling.
* Updated version detection so available upgrades are accurately
identified across supported platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49260
This fix is based on direct discussion with Apple and consultation of
the Apple docs. We are not currently sure if this is actually issue the
customer is running into but we have identified it as an issue with our
enrollment process.
As far as testing my iPad running 18.7 gets prompted to update every
time now when I enroll it with updates turned on. If I back up and don't
take the upgrade and try to enroll again I get an error but I believe
this is an Apple bug which we've been told was fixed in 26+
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue during Android Device Enrollment where devices assigned
a mandatory software update could incorrectly show a failure status.
* Resolved cases where the required software update was not displayed
correctly.
* Improved Apple device enrollment update details by reporting the
operating system version consistently.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49329
## What & why
Fresh **Windows 11 25H2** (build 10.0.26200) devices failed Microsoft
Entra / Autopilot MDM auto-enrollment during OOBE with error
**80180006**. The device advertises an MS-MDE2 discovery
`RequestVersion` of `"9.0"`, and Fleet's `IsValidDiscoveryMsg()`
rejected it via an exact-match allow-list (`{"4.0","5.0","6.0","7.0"}`)
that could only be changed by rebuilding the server.
The discovery **response** already pins the protocol to
`EnrollmentVersionV4` (`"4.0"`) and the client negotiates down, so the
exact-match check was the only blocker. This PR implements the issue's
preferred fix: **accept any `RequestVersion >= 4.0`**, which is
forward-compatible with future Windows version bumps.
- `server/mdm/microsoft/syncml/syncml.go`: replaced the
`SupportedEnrollmentVersions` allow-list var with a
`MinSupportedEnrollmentVersion` constant.
- `server/fleet/microsoft_mdm.go`: added `enrollmentVersionAtLeast`
(numeric component-wise compare, so `"10.0" > "9.0"`) and changed
discovery validation to accept any version at or above the minimum.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed MDM enrollment failures on fresh Windows 11 25H2 and other
recent builds.
* Discovery requests now accept supported MDE2 `RequestVersion` values
at or above the minimum supported version (instead of requiring an exact
match).
* Invalid or outdated discovery versions now return more specific
validation errors.
* **Tests**
* Added unit test coverage for minimum, equal, newer, and invalid
enrollment version comparisons.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
**Related issue:** Resolves#28108
Adds support for uploading multiple custom packages (up to 10) for the
same software title on a team — so IT admins can deploy different
versions or architectures (for example, Arm vs. Intel builds or staged
rollouts) to label-scoped hosts instead of splitting them across teams.
The software title keeps a single first-added `software_package` for
backwards compatibility, and first-added-wins resolves overlaps
consistently across self-service, manual install, policy automation, and
setup experience.
Feature branch combining the sub-PRs: migration (#48596), packages[] API
and add/edit/delete-package endpoints (#48607), install-time precedence
and setup experience (#48708), GitOps (#48710), Library and
Add/Edit/Delete modals (#48520), secondary UI — policy automation, setup
experience, and install-details hash (#49079), and the host
install-result `hash_sha256` field (#49085).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Support up to 10 custom packages per software title, with
package-scoped deploy/install settings and package-specific edit/delete.
* Policy automation can pin “Install software” to a specific package.
* GitOps generation now outputs repeatable multi-package YAML per title.
* Software install details now display the package SHA-256 hash (when
available) with a copy-to-clipboard action.
* **Bug Fixes**
* Improved deterministic “first-added” precedence for installs,
listings, setup experience, and policy dispatch when multiple packages
match.
* Fixed installer targeting and per-package metadata persistence
(including installer-specific activity details).
* **Accessibility/UX**
* Added optional `aria-label` support for dropdowns.
* Info banners can now render a leading icon with configurable color.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44954
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Custom Host Vitals management (create/edit/delete, search) with
copyable variable tokens and per-host values.
* Show Custom Host Vitals on host details, including role-based editing.
* Enabled Custom Host Vitals in host-vitals labels and the activity
feed.
* Extended GitOps to manage global Custom Host Vitals declaratively
(including dry-run behavior).
* Split Controls → Variables into Global Variables and Custom Host
Vitals, including routing updates.
* **Bug Fixes**
* Improved validation and expansion of Custom Host Vital references
across scripts, profiles, installers, and deployments, with clearer
failures when values are missing or invalid.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Use platforms (macOS) instead of hardware (Mac) to be consistent with
other spots in UI
- Include Windows and Linux
- Just say "online" instead of "check in and count as online". Reduce
word count. We're looking at the "Hosts online chart" anyways.
Context is in [this Slack
thread](https://fleetdm.slack.com/archives/C084F4MKYSJ/p1783370095727719).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the uptime explanation text to better reflect how “online”
status varies by platform when devices are locked vs. unlocked.
* Clarified wording for iOS/iPadOS, macOS/Windows/Linux, and Android to
match actual check-in behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Steven Palmesano <3100993+spalmesano0@users.noreply.github.com>
**Related issue:** Resolves#49234
Editing a software installer to a new version failed with "The selected
package is for different software" when the title's stored
(osquery-reported) name differed from the installer's extracted name.
The edit now validates by software identity (bundle identifier / upgrade
code / name) instead of an exact name match.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
**Related issue:** N/A — CI improvement for the FMA validation
workflows.
## Summary
Restructures the Windows and macOS Fleet-maintained app validation
workflows around a cheap Linux detect/shard job, with Windows apps
additionally routed to a CI runner whose native architecture matches the
app's installer.
**Both platforms:**
- Change detection and sharding run on `ubuntu-latest`. Expensive
Windows/macOS runners only spin up when their platform actually has
changed apps — e.g. a Windows-only letter-batch PR no longer boots a
macOS runner just to discover there's nothing to do (and vice versa) —
and they check out at depth 1 instead of full history.
- A new `.github/scripts/partition-fma-apps.sh <windows|darwin>` emits
the job matrix; validation steps move unchanged into reusable workflows
(`test-fma-windows-validate.yml`, `test-fma-darwin-validate.yml`).
- Large PRs shard into parallel jobs (Windows: 25 apps/shard, macOS:
30), and the manual full-run workflows gain a `shard_size` input
(Windows default 20 → ~20 shards over 384 apps; macOS default 25 → ~39
shards over 961 apps). Neither full run could previously finish:
hundreds of sequential installs blow the 6-hour job limit.
- Pre-installed app handling is computed per shard from that shard's
slug list — Windows removals (Chrome, 7-Zip, Firefox, Node.js,
PowerShell, R, Git) and macOS steps (Chrome, Xcode for Icon Composer,
the Fleet Desktop MDM config stub) only run on the runner validating
that app. This also brings the full-run workflows to parity with the PR
gates (they previously only removed Chrome).
- Stable summary jobs (`test-fma-pr-only`, `test-fma`) aggregate the
dynamic matrix results so branch protection / PR gating keeps a fixed
check name.
**Windows arch routing:**
- Each changed `<name>/windows` slug's `installer_arch` is read from
`ee/maintained-apps/inputs/winget/<name>.json`: `arm64` apps →
`windows-11-arm`, x64/x86/neutral apps → `windows-latest` (x64). Missing
input files default to x64 with a warning. This fixes installers that
check the native OS architecture and abort under Prism emulation on the
ARM runner (Inno Setup `ArchitecturesAllowed=x64` — GOG Galaxy, Reqable
— and Docker Desktop). Future arm64 FMAs need no workflow change —
`installer_arch: arm64` in the winget input is enough.
- macOS needs no arch matrix: `macos-latest` is arm64 and x86-only casks
run under Rosetta 2, which matches how customer Macs run them.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually
Manual QA:
- Partition script is shellcheck-clean and tested against the real repo
for both platforms: empty input, mixed-platform slug lists, x86/neutral
routing to the x64 runner, single-slug arrays, missing input file
fallback, arm64/x64 split with sharding (via a synthetic arm64 input),
invalid platform/shard-size rejection, and full-catalog partitions (384
Windows apps → 20 shards, 961 darwin apps → 39 shards, all slugs
accounted for, matrix outputs well under the 1 MB job-output limit).
- All six workflows pass `actionlint` and zizmor 1.25.2 (with the repo's
`.github/zizmor-gate.yml` config) with no findings.
- The rewritten Windows PR gate ran on this PR itself: the Linux detect
job correctly found no changed Windows apps, skipped the Windows
runners, and the `test-fma-pr-only` summary check passed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added sharded validation for maintained macOS and Windows apps to run
tests in parallel.
* Added configurable `shard_size` for manual validation runs.
* Introduced reusable validation workflows for Darwin and Windows.
* Improved Windows testing to be architecture-aware (ARM64 vs x64).
* **Bug Fixes**
* Improved pull request gating to validate only changed apps and report
results more reliably.
* Workflows now gracefully handle scenarios where no matching apps are
found (avoid unnecessary failures).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47922https://github.com/user-attachments/assets/d3cfa329-10bb-45c6-911a-fbe84f1dcffb
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue where symbols in input fields could unexpectedly change
height depending on nearby characters.
* Improved text rendering consistency in input and textarea fields.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Refreshed managed application releases across macOS and Windows,
including Affinity, Android Studio, Badgeify, Beeper, Chrome Remote
Desktop Host, Cursor, Discord, Docker, Dropbox, Git, Microsoft 365 apps,
Raycast, Reqable, and others.
* Updated installer links, checksums, and version detection for newly
released builds.
* Improved Dropbox and Microsoft app installation or removal handling to
support their latest packages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Relates to #38806
Host name templates previously accepted only built-in $FLEET_VAR_*
variables and rejected custom $FLEET_SECRET_* (secret) variables. Allow
secret variables so admins can embed an org-wide custom value in an
Apple host's name.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
**Related issue:** Resolves#49208
Host software details now show the status and install details for the
installer scoped to the host, for titles with multiple packages.
No `changes/` file: this is an unreleased bug fix, and the
multiple-packages feature PR carries the changes entry.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Related to: https://github.com/fleetdm/fleet/issues/41908
Changes:
- Updated Android proxy endpoints (`create-android-enrollment-token`,
`create-enterprise-webapp`, `delete-android-device`,
`get-android-device`, `get-android-devices`,
`get-enterprise-applications`, `issue-command-on-android-device`,
`modify-android-device`, `modify-android-policies`, and
`modify-enterprise-app-policy`) to send requests to the Android
Management API without verifying that an enterprise is still managed by
Fleet with the getIsEnterpriseManagedByFleet helper, and to return a
`enterpriseNotAccessible` (notFound) response to Fleet servers if the
Android management API returns a 403 response.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Android management flows to handle authorization failures
more consistently.
* Requests now return a clearer “not accessible” response when access to
an Android enterprise is denied.
* Several Android device, app, policy, and enterprise actions now
surface this response instead of falling back to generic errors.
* Streamlined Android enterprise operations by removing an extra
pre-check, letting the API response determine the final outcome.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated webhook sender classification to reflect the current list of
recognized bot and maintainer accounts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** NA
## What & why
The FMA validator (`cmd/maintained-apps/validate`) downloads each app's
installer with a hardcoded 2-minute context timeout. Large installers
can't finish in that window — e.g. Android Studio (Windows) is ~1.39 GB,
which needs ~12.4 MB/s sustained to complete in 2 minutes. When the
runner is slower, the download aborts with `context deadline exceeded`,
failing validation with a misleading error that looks URL-related.
This bumps the validator timeout from 2 to 5 minutes. (For reference,
the production download path already uses `InstallerTimeout = 15 *
time.Minute`.)
# Checklist for submitter
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Increased the installer download timeout to five minutes, improving
reliability for slower downloads.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
dependabot[bot]