Add support for PostgreSQL 18 on Windows: new winget input manifest and
per-machine installer/uninstaller PowerShell scripts; outputs metadata
for version 18.4-1 (installer URL, sha256, and script refs) and app
registration in apps.json. Also add frontend icon component and 60x60
image asset, and update icons index to include the new icon. This
enables silent install/uninstall via the EnterpriseDB (BitRock)
installer and exposes the app in the software listing.
## Problem
The Slack Windows (winget/MSIX) uninstall script selected provisioned
packages with:
```powershell
$packageFamilyName = $PACKAGE_ID
Get-AppxProvisionedPackage -Online | Where-Object { $_.PackageFamilyName -eq $packageFamilyName }
```
Two bugs compound here:
1. **`Get-AppxProvisionedPackage` objects have no `PackageFamilyName`
property** (that's on `Get-AppxPackage` results), so
`$_.PackageFamilyName` is `$null` for every provisioned package.
2. **The FMA validator never substitutes `$PACKAGE_ID`** — it runs the
raw ref script with no substitution — so `$packageFamilyName` is also
`$null`.
The filter reduces to `$null -eq $null` → **true for every package**, so
the script tries to remove *all* provisioned packages on the machine and
fails on protected ones like `Microsoft.DesktopAppInstaller` (exit code
1603). This is the same failure mode just fixed for Affinity.
## Fix
Rewrite `slack_uninstall.ps1` to match Slack by literal identity —
across `DisplayName`/`PackageName` for provisioned packages and
null-guarded `Name`/`PackageFamilyName`/`Publisher` for installed
packages — following the working `claude_uninstall.ps1` pattern. No
longer depends on `$PACKAGE_ID` substitution or a property the
provisioned object lacks, so it works in both the validator and
production.
Regenerated the output manifest ref: `ae79ce28` → `1be2e38e` (content
hash verified against the source script).
## Note on MS Teams
`msteams_uninstall.ps1` is **not** affected — it matches a literal
`DisplayName` (`"MSTeams"`), a real property on provisioned packages,
rather than `PackageFamilyName`/`$PACKAGE_ID`. No change needed.
## Testing
- [ ] FMA validator run on a Windows host with Slack installed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Slack uninstallation reliability by enhancing package
detection logic to handle various package identification methods instead
of exact ID matching.
* Enhanced uninstall process with more robust error handling, timeout
protection (5-minute limit), and verbose progress logging for better
visibility during removal operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for several new Windows applications to
the maintained apps catalog, along with robust PowerShell install and
uninstall scripts for each. The main focus is on enabling automated,
silent deployment and removal of these apps using Winget, with careful
handling of installer quirks and registry lookups to ensure reliability
in enterprise environments.
**New application support:**
* Added `Citrix Workspace`, `Evernote`, `ExpressVPN`, `Front`, `Hyper`,
`Jabra Direct`, `Microsoft Teams`, `OneDrive`, `Opera`, `Podman
Desktop`, and `REAPER` to the `ee/maintained-apps/inputs/winget` catalog
with appropriate metadata for each app.
[[1]](diffhunk://#diff-3ba331a553f359a02dd3d824d3edab85292e2d1d9c1a6a739e313a9b63d5a88fR1-R13)
[[2]](diffhunk://#diff-917d3e25bae801c48ae70f70bf43e8540d962046bb773dbeed633eb52323e084R1-R12)
[[3]](diffhunk://#diff-b8f4026fc2a89254c0bdeb905120761ee78c6a76101deaf3dadd814ce3cafa94R1-R12)
[[4]](diffhunk://#diff-72a2bcc2c2b9fadcf09505f8caefb681e79679ee99fb068a84698c783e81f17dR1-R12)
[[5]](diffhunk://#diff-5bdb4220ac0cc23ff96963f975a55ef081493ee797545e0a1f65f9f4c50ef982R1-R12)
[[6]](diffhunk://#diff-941487a1c1f2ba4d2da50e47f47bbab46478f2bb7c7e009fdd21bf2b68090413R1-R12)
[[7]](diffhunk://#diff-9b5681ffd0b55fd89ce4f69e07668fa23df9582a921bf2000d9d2230429e16c9R1-R12)
[[8]](diffhunk://#diff-b69363f34d224c471ec183bf7a2d6bab13d776c8905e499cac0e39f31868fd19R1-R12)
[[9]](diffhunk://#diff-c8b49c5881565261369d37c862e055087cc65819900f961841c7dc76a83a879dR1-R13)
[[10]](diffhunk://#diff-88ceb0a6b8de6484bfcb3f0d19264e307d3166a34f992eba11fcc9d60facb052R1-R13)
[[11]](diffhunk://#diff-2557d37d79e9889f60f30557f28efb327e02bf33d4b255deefa912f855111412R1-R14)
**Install script implementations:**
* Added PowerShell install scripts for each new app, ensuring silent,
machine- or user-scoped installs as appropriate, with correct handling
of installer arguments and exit codes (including treating
reboot-required codes as success for Citrix Workspace and ExpressVPN).
[[1]](diffhunk://#diff-ccd33aec25bdbda547e3c4c9b4bcc32d923dcacfe6ebda1a80256d3388bb9003R1-R41)
[[2]](diffhunk://#diff-2b0d909e843c3c8265f67dd0e69843c4b59cea7d33741c5be8662ad464f39832R1-R34)
[[3]](diffhunk://#diff-fa9d859aa98e8240b9882363a62dc7c69a61186d186cf07c8065a8e11547a3c7R1-R37)
[[4]](diffhunk://#diff-9baf7c34c008963410a30fec1e6949023d03d3c400ec0166c029dd5eebcfaefeR1-R27)
**Uninstall script implementations:**
* Added PowerShell uninstall scripts for each new app, using registry
lookups to locate the correct uninstaller and applying silent uninstall
arguments. Scripts handle argument parsing defensively and ensure
correct removal in both per-user and per-machine contexts.
[[1]](diffhunk://#diff-ab38143c2c6f191c4f57aff0adb35e8c7a67cd95522da13da25febc8f65cc73eR1-R92)
[[2]](diffhunk://#diff-4657653f749298d4ae84fb467023108a273c8e621c8cc711d5821fbeacfa03cdR1-R91)
[[3]](diffhunk://#diff-1280127be173a1bdce9e7f18343fa6aae26fc3d15e1935e196669131deb484bdR1-R89)
These additions significantly expand the catalog's Windows app coverage
and improve reliability and automation for enterprise deployments.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Google Antigravity is now available for macOS via DMG installer.
* Supports automatic install and uninstall, preserving app state and
relaunching if needed.
* App appears in the software library with a dedicated icon for easier
discovery.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
This pull request adds support for several new Windows applications to
the maintained apps list by introducing new configuration JSON files for
each app under the `ee/maintained-apps/inputs/winget/` directory. Each
file defines metadata and installation details for a specific
application, including installer type, architecture, scope, categories,
and optional install/uninstall scripts. This update expands the range of
applications that can be managed and deployed.
**New application definitions:**
*Communication and Collaboration:*
- Added `Amazon Chime` (`amazon-chime.json`), `Front` (`front.json`),
and `Microsoft Teams` (`microsoft-teams.json`) with configuration for
installation, uninstallation, and categorization under "Communication".
[[1]](diffhunk://#diff-296db54aa9d8cea8e1302cc76e43abfd7565ab011bb3d1318a0d46c12b4b35f7R1-R12)
[[2]](diffhunk://#diff-72a2bcc2c2b9fadcf09505f8caefb681e79679ee99fb068a84698c783e81f17dR1-R12)
[[3]](diffhunk://#diff-9b5681ffd0b55fd89ce4f69e07668fa23df9582a921bf2000d9d2230429e16c9R1-R12)
*Productivity and Utilities:*
- Added `AnyDesk`, `Citrix Workspace`, `DeepL`, `Egnyte`, `Elgato
Control Center`, `Elgato Stream Deck`, `Evernote`, `ExpressVPN`,
`Hyper`, `Jabra Direct`, `Keeper Password Manager`, `LibreOffice`, and
`MindManager` with appropriate installer details, categories, and
scripts where applicable.
[[1]](diffhunk://#diff-9a7ba8c0afb32ab31c2950a4a95847fa1293411416302cd6698dc2bcb519fbfdR1-R12)
[[2]](diffhunk://#diff-3ba331a553f359a02dd3d824d3edab85292e2d1d9c1a6a739e313a9b63d5a88fR1-R13)
[[3]](diffhunk://#diff-03fc24bba02df2bcfb57acabaffd8d3afac94bafbda450c4336a67f85bc4429eR1-R12)
[[4]](diffhunk://#diff-ab44cad18bc633e446e1acd1714034464a92721e175cd0bd835fdb8eb4a7e0c8R1-R10)
[[5]](diffhunk://#diff-e5b9495ea0a996194b5c04a9327b33220a7b24e0e9abff2153c98ec949018bc0R1-R10)
[[6]](diffhunk://#diff-53b6cdd6d7032bffc8307f93a03eae3f1e82b57fa03316ad10b5b1af02b6c103R1-R10)
[[7]](diffhunk://#diff-917d3e25bae801c48ae70f70bf43e8540d962046bb773dbeed633eb52323e084R1-R12)
[[8]](diffhunk://#diff-b8f4026fc2a89254c0bdeb905120761ee78c6a76101deaf3dadd814ce3cafa94R1-R12)
[[9]](diffhunk://#diff-5bdb4220ac0cc23ff96963f975a55ef081493ee797545e0a1f65f9f4c50ef982R1-R12)
[[10]](diffhunk://#diff-941487a1c1f2ba4d2da50e47f47bbab46478f2bb7c7e009fdd21bf2b68090413R1-R12)
[[11]](diffhunk://#diff-605ef361eebaf639aaa110d3599f53f84c5cd3fc2cbcb5960bb741385b59e5eaR1-R12)
[[12]](diffhunk://#diff-fde7bf26f42621dd7f096bbb626af339e27312c0ca380ca2ef4a9f68ab1278ddR1-R11)
[[13]](diffhunk://#diff-c293d2eda9fea8cc74547aefd99e078d181f29b04b4289ee88bbf91b09432ae1R1-R13)
*Developer Tools:*
- Added `Arduino IDE` and `iMazing Profile Editor` with installer
metadata and categorized as "Developer tools".
[[1]](diffhunk://#diff-eaf314e8b4d4156a5f428809d9dd6484d5585bfc7382658fc93744750347773fR1-R10)
[[2]](diffhunk://#diff-649ae93e725621f9ee7d5fcddb3e81a2338eb3017ffae40a5dd915f42b75c8cfR1-R12)
*Browsers and Utilities:*
- Added `Arc` (browser) and `iMazing` (utility) with installation
details and script paths.
[[1]](diffhunk://#diff-bc27e68e5949eb7e4fd3c1d54f9f89b86cb6aed0e908f6687a4549dc81b65f49R1-R12)
[[2]](diffhunk://#diff-7c778f4e3418f1b5ad0094b2c5d366d3690ae480ef3910f1833fba1197d71d9bR1-R12)
This pull request adds support for the Comet browser (an AI-integrated
browser from Perplexity) to the maintained apps catalog for both macOS
and Windows. It introduces metadata, installation, and uninstallation
scripts, as well as versioned definitions for both platforms.
**New application support: Comet browser**
*Metadata and catalog integration:*
- Added `comet.json` metadata files for Homebrew (macOS) and Winget
(Windows) in the `inputs` directory, defining identifiers, installer
types, and categories.
[[1]](diffhunk://#diff-60e2346d602b7538ba08314f7adfdde98ca8e802dd3706c65bb75273fe7bbbd4R1-R8)
[[2]](diffhunk://#diff-ecdccc5ed1a1f1e6f2b66439941fcd74419b2706c1df155cb4bc1940abd6bfa7R1-R13)
- Updated `apps.json` to include Comet for both `darwin` (macOS) and
`windows` platforms with descriptive text.
*macOS support:*
- Added `outputs/comet/darwin.json` with versioned app definition,
install/uninstall queries, download URL, and references to
install/uninstall scripts.
*Windows support:*
- Added `outputs/comet/windows.json` with versioned app definition,
install/uninstall queries, download URL, SHA256, and references to
install/uninstall scripts.
- Added PowerShell scripts for silent installation (`comet_install.ps1`)
and uninstallation (`comet_uninstall.ps1`) of Comet, handling
machine-wide deployment and proper exit codes.
[[1]](diffhunk://#diff-5b9c60857fd2a49958f05124e8744394683297127503578e9b4eaf227470f1f7R1-R31)
[[2]](diffhunk://#diff-3433e05da3c0601490c7d90084264d4a793d0feef4211569b4aff884f85116dbR1-R101)
Add TablePlus Windows packaging: input manifest, PowerShell
install/uninstall scripts, and outputs. The install script runs the Inno
Setup installer silently with /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
/ALLUSERS; the uninstall script locates the Inno Setup uninstaller via
registry and runs it with silent args. apps.json was updated to include
TablePlus and a new outputs/tableplus/windows.json was added with
version 7.1.2, installer URL, sha256, and script references.
## Summary
Adds **WinRAR 7.22.0** as a Fleet-maintained app (Windows / winget
`RARLab.WinRAR`).
## Details
- **Installer type**: `exe` (WinRAR self-extracting installer), machine
scope → custom install/uninstall scripts (the ingester only
auto-generates for machine-scope MSI).
- **Silent install**: `-s1` — from the winget manifest's documented
`InstallerSwitches.Silent`.
- **Silent uninstall**: `uninstall.exe /S` located via the registry
`UninstallString`, parsed with the defensive 3-shape matcher.
- **Identity**: `unique_identifier: "WinRAR"` + `fuzzy_match_name: true`
→ exists query `name LIKE 'WinRAR %' AND publisher = 'win.rar GmbH'`.
Fuzzy match is required because WinRAR's registry DisplayName embeds the
version (`WinRAR 7.22.0 (64-bit)`). Registry Publisher matches the
winget locale Publisher, so no `program_publisher` override.
- **SHA**: matches the manifest's en-x64 installer; version `7.22.0`
reconciles with osquery's DisplayVersion.
- **Icon**: generated component, website PNG, and `index.ts` map entry
(`winrar`).
## Notes / risks
- Installer URL (`https://www.rarlab.com/rar/winrar-x64-722.exe`) is
version-pinned, so the SHA is stable until the FMA auto-update bumps it.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added WinRAR application support, including version 7.22.0 with
automated installation and uninstallation capabilities.
* Added custom WinRAR icon for improved visibility on the software page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add Zen Browser support: new PowerShell install and uninstall scripts
(silent NSIS installer with /S and /PreventRebootRequired; uninstaller
detects registry entries and runs uninstall string). Add winget input
manifest ee/maintained-apps/inputs/winget/zen-browser.json referencing
those scripts. Update outputs: add a apps.json entry for Zen Browser and
create ee/maintained-apps/outputs/zen-browser/windows.json containing
version 1.20b metadata, installer URL, sha256, and script refs.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated installer metadata for 13 apps (new versions, updated download
links and checksums) across Windows and macOS.
* Added a Windows uninstall script for TextExpander and registered it in
the package manifest to improve uninstall behavior and exit-code
handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Introduce a new content-style skill under .claude/skills/content-style
with a SKILL.md and three reference docs (content-types.md,
positioning.md, style-rules.md) to capture Fleet's voice, format rules,
and messaging guidance for authoring and reviewing public-facing
content. Also add .kilo/kilo.jsonc to register the .claude/skills path
so Kilo Code loads the skill automatically.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated project configuration to support automated skill management
infrastructure.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46467?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Introduce Groove OmniDialer to the maintained apps dataset and UI. Adds
a homebrew input (dmg) and an apps.json entry, plus a darwin-specific
output with version 26.603.1017, installer URL, sha256, and embedded
install/uninstall script refs. Also adds a frontend SVG icon component,
registers it in the icons index, and includes the app PNG asset.
Install/uninstall scripts handle quitting/relaunching the app and
cleaning user data.
Add ClickShare to maintained apps and frontend. Creates a Homebrew input
(ee/maintained-apps/inputs/homebrew/clickshare.json), adds an apps.json
entry, and adds an outputs file for darwin with version 4.50.0
(installer URL, sha256, and install/uninstall script refs). Also adds a
React SVG icon component, registers it in the icon map, and includes the
60x60@2x PNG asset for the app. Default category set to Communication.
Register Microsoft 365 Copilot: add a Homebrew input (unique_identifier
com.microsoft.m365copilot), add an apps.json entry, and add
darwin-specific output with version 1.2605.2501 (installer URL, sha256,
install/uninstall script refs). Also add a React SVG icon component,
update the icons index map, and include the app icon image asset.
Introduce Power Monitor (corp.sap.PowerMonitor) for Darwin: add Homebrew
input, register app in ee outputs/apps.json, and add detailed
ee/maintained-apps/outputs/power-monitor/darwin.json with version 1.3.3,
installer URL, sha256 and install/uninstall script refs. Also add
frontend assets — a React SVG icon component, register it in the icon
map, and include a 60x60@2x PNG app icon. This enables listing,
installation, and clean uninstallation of the Power Monitor app.
Introduce support for Cinc Workstation across the app catalog and UI.
Adds a winget input (ee/maintained-apps/inputs/winget/cinc.json), a new
apps catalog entry (ee/maintained-apps/outputs/apps.json), and a
Windows-specific output with versioned metadata
(ee/maintained-apps/outputs/cinc/windows.json) including installer URL,
SHA256, and install/uninstall script refs for version 23.5.1040. Also
adds a React SVG icon component, maps the app name to the icon
(frontend/pages/SoftwarePage/components/icons/*), and includes the 60x60
PNG asset for the app icon.
Rename Windsurf to Devin Desktop across EE manifests and frontend
assets. Bump darwin version to 3.0.28 and update installer URL, SHA256,
and install/uninstall script refs and contents
(ee/maintained-apps/inputs/homebrew/* and ee/maintained-apps/outputs/*).
Update ee/maintained-apps/outputs/apps.json to list Devin Desktop and
remove the old Windsurf entry. Add a new React SVG icon component and
register it in the icons index, and add the corresponding PNG asset
(frontend/pages/SoftwarePage/components/icons/DevinDesktop.tsx,
frontend/pages/SoftwarePage/components/icons/index.ts,
website/assets/images/*).
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Claude Windows to version 1.11187.4
* Updated Ollama Windows to version 0.30.6
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Claude Desktop (macOS) to version 1.11187.4
* Updated Cursor (macOS) to version 3.7.12
* Updated Figma Desktop (macOS) to version 126.4.13
* Updated Fork (Windows) to version 2.20.0
* Updated Ollama (macOS) to version 0.30.6
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected redirect links for Apple Business Manager documentation
resources, ensuring users are directed to the appropriate help content
within the Fleet UI.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for PowerShell as a managed Windows app,
including its metadata, versioning, install/uninstall scripts, and
validation logic in the CI workflow. It also ensures that any
pre-installed PowerShell 7 is removed from the test environment before
validation. The most important changes are:
**PowerShell app definition and metadata:**
* Added a new entry for PowerShell in
`ee/maintained-apps/inputs/winget/powershell.json` and included its
metadata in `ee/maintained-apps/outputs/apps.json`, enabling PowerShell
to be managed as a Windows app.
[[1]](diffhunk://#diff-7e4899a379d327948f55b7e6ba4c9893501713edd16020b128b68343569fcbfbR1-R10)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1985-R1991)
* Created `ee/maintained-apps/outputs/powershell/windows.json`
containing version information, SQL queries for existence and patch
status, installer/uninstaller scripts, and download URL for PowerShell
7.6.2.0.
**CI workflow enhancements for PowerShell:**
* Updated `.github/workflows/test-fma-windows-pr-only.yml` to detect
changes involving PowerShell, set the appropriate output flags, and
conditionally execute PowerShell-specific steps.
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR102)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR116)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR155-R162)
* Added a workflow step to remove any pre-installed PowerShell 7 from
the GitHub Actions runner, ensuring a clean environment for validation.
* Ensured that validation and related steps use Windows PowerShell 5.1
(not pwsh) after uninstalling PowerShell 7, to avoid shell availability
issues.
These changes collectively enable PowerShell to be validated, installed,
and uninstalled as part of the managed apps ecosystem and ensure
reliable, repeatable CI validation.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added PowerShell as a supported application with full Windows
integration, including installation and uninstall management
capabilities.
* Enhanced deployment scripts to support flexible input handling for app
configurations.
* Added PowerShell icon to the frontend UI for visual identification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/46872
Changes:
- Updated the `productCategories` value of the testimonial from Adam
Pippert to show it on the /software-management page.
- Updated the order of testimonials on the homepage,
/software-management, /device-management, and /linux-management
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* In-house iOS app manifest and package downloads now use secure
per-install tokens embedded in the URL path instead of query parameters
* Installation tokens are bound to specific devices and teams, enhancing
security
* Installation tokens automatically expire after 6 hours
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jonathan Katz <yehonatankatz@gmail.com>
**Related issue:** Resolves#35148
## What was added
| CVE | Rule | Reason |
|-----|------|--------|
| **CVE-2017-17522** | `IgnoreAll` | DISPUTED by Python maintainers; not
exploitable (`webbrowser.py` uses `subprocess.Popen` with
`shell=False`). Broad NVD CPE matched modern Python. |
| **CVE-2023-36632** | `IgnoreAll` | NVD-DISPUTED — Python states it's
"neither a vulnerability nor a bug" (intentional `RecursionError` in
`email.utils.parseaddr`). |
| **CVE-2024-3219** | `IgnoreIf target_sw != "windows"` | Only affects
platforms lacking AF_UNIX (Windows). Linux/macOS unaffected, but
NVD/VulnCheck CPE uses `target_sw=*`. |
**Files touched:**
- `cpe_matching_rules.go` — three new rules
- `cpe_matching_rule_test.go` — assertions covering all three (incl.
Windows-vs-macOS/Linux distinction for CVE-2024-3219)
- `changes/35148-python-cve-false-positives` — changelog
**Correctness note:** `target_sw` derives from software *source*
(`apps`/`homebrew_packages` → `macos`, `programs` → `windows`), so the
CVE-2024-3219 rule suppresses on macOS while preserving the genuine
Windows
positive.
## What was skipped, and why
| CVE | Why skipped |
|-----|-------------|
| **CVE-2024-12718** | Conflicting evidence: getvictor confirmed it's a
**true positive** (3.9.22 < fixed 3.9.23), contradicting the customer's
"only 3.12+ affected" reasoning. Needs a product/security ruling, not a
code change. |
| **CVE-2025-1795** | Likely a VulnCheck patch-level miss (customer says
3.10.17 has the backported fix). Needs the actual VulnCheck version
range to fix safely. |
| **CVE-2023-32681** | Affects `python:requests` and is **correctly
matched**; the customer dismissed it on deployment grounds ("corporate
servers only"). Not a detection bug. |
| **CVE-2007-4559** | Real tarfile path-traversal (CVSS 9.8, **not
disputed**); the customer labeled it "Other issue," not a false
positive. Suppressing it would hide a genuine vulnerability. |
**Related issue:** Resolves#42757
## Summary
Resending or renewing the Okta conditional access profile leaves an
orphaned SCEP certificate in the per-user macOS keychain, accumulating
duplicates with every renewal. This PR auto-runs an existing
keychain-cleanup script after a successful `InstallProfile` ack for the
Okta CA profile, so admins no longer have to find and run the script
manually.
## Root cause
Investigation in the issue thread isolated the trigger:
- The Okta CA `.mobileconfig` bundles `com.apple.security.scep` with
`com.apple.security.identitypreference` in a single profile (macOS
rejects the alternative — `Identity payload not found in same profile as
identity preference payload`).
- The Identity Preference payload creates a keychain-resident preference
item that keeps the *old* cert pinned across profile replacement, even
though the rewritten Identity Preference now points to the fresh SCEP
enrollment.
- EAP-TLS Wi-Fi profiles renew cleanly because they reference the cert
via SystemConfiguration (`PayloadCertificateUUID`), not the keychain —
so this isn't a generic SCEP-bundling issue.
The team decision in the issue (`@sharon-fdm`) was to delete the
duplicate certificate rather than restructure the profile. A standalone
cleanup script already shipped at
`docs/solutions/macos/scripts/delete-duplicate-scep-certificates.sh` and
was linked from the Okta CA guide; admins had to find and run it.
## Approach
Hook the existing Apple MDM `InstallProfile` ack path in
`MDMAppleCheckinAndCommandService.CommandAndReportResults`, parallel to
the existing ACME `CertificateList` follow-up. When the ack is for the
Okta CA profile and status is `verifying`, enqueue an internal host
script run that executes the cleanup script targeting the host's
per-user MDM enrollment short name.
Key properties:
- **Single hook, three paths covered.** Admin "Resend" nulls the profile
status and the reconciliation cron re-enqueues an `InstallProfile`; the
SCEP renewal cron also re-issues `InstallProfile`. Both flow through the
same ack handler this hook attaches to.
- **Idempotent.** The cleanup script no-ops when only one matching cert
is present, so triggering on initial installs (not just renewals) is
safe and removes the need to distinguish "is this a renewal".
- **Tightly gated.** Single indexed lookup keyed on `(host_uuid,
command_uuid, profile_identifier, platform='darwin')`. Other
SCEP-bearing profiles do not trigger the script. No work happens for
hosts with no per-user enrollment.
- **Internal-script semantics** (matches lock/unlock/wipe prior art).
Runs even when scripts are globally disabled. Does not appear in the
user-facing host activity feed.
- **Failure-isolated.** Enqueue errors are logged but do not break the
ack path; the renewal itself is what matters.
- **Defense in depth on the shell call.** The macOS short name is
validated against a strict regex (`^[A-Za-z0-9_][A-Za-z0-9_.-]*$`, ≤31
chars) before being interpolated, and POSIX single-quote-escaped on the
way through.
## Files
**New**
- `server/service/conditional_access_cleanup.go` — `//go:embed` of the
cleanup script, the hook helper `maybeRunOktaCACleanupScript`, the
validated shell-wrapper builder, and the POSIX single-quote escape
helper.
- `server/service/conditional_access_cleanup_test.go` — unit coverage
for username validation, shell escaping, the routing decisions of the
hook helper (mock-based), and an embed-sync assertion against the docs
copy.
-
`server/service/embedded_scripts/delete-duplicate-scep-certificates.sh`
— embed source-of-truth copy, byte-for-byte equal to the public
`docs/solutions/macos/scripts/` script.
- `changes/42757-okta-conditional-access-duplicate-scep-cert-cleanup` —
user-visible changes note.
**Datastore**
- `server/datastore/mysql/mdm.go` —
`OktaCACleanupTargetForInstallCommand`: single SQL lookup that returns
`(host_id, user_short_name, ok)` for the new hook. Returns `ok=false`
for non-Okta profiles, non-darwin hosts, or hosts without a user-channel
enrollment.
- `server/datastore/mysql/scripts.go` —
`NewInternalHostScriptExecutionRequest`: thin wrapper that routes
through the existing internal-script codepath (`isInternal=true`) used
by lock/unlock/wipe. Refactored the existing public method to share an
internal helper.
**Interface / mocks**
- `server/fleet/conditional_access_idp.go` — exported
`ConditionalAccessOktaProfileIdentifier`,
`ConditionalAccessOktaCertificateCN`, and the new `OktaCACleanupTarget`
struct, so both the template-render path and the SQL lookup can
reference the same source of truth.
- `server/fleet/datastore.go` — `OktaCACleanupTargetForInstallCommand`
and `NewInternalHostScriptExecutionRequest` added to the `Datastore`
interface.
- `server/mock/datastore_mock.go` — regenerated (additions only).
**Wiring**
- `server/service/apple_mdm.go` — call into
`maybeRunOktaCACleanupScript` from the InstallProfile
`MDMDeliveryVerifying` branch, alongside the existing ACME
`maybeQueueCertificateListForACMEProfile` follow-up. Warns on error
rather than failing the ack.
- `server/service/conditional_access_idp.go` — use the new
`fleet.ConditionalAccessOktaCertificateCN` constant when rendering the
profile template, eliminating the magic string duplication.
**Tests touched**
- `server/datastore/mysql/mdm_test.go` — integration test
`testOktaCACleanupTargetForInstallCommand` covering the happy path,
non-Okta profile, device-only enrollment, and unknown command.
- `server/datastore/mysql/scripts_test.go` —
`testNewInternalHostScriptExecutionRequest` confirming the internal flag
is set correctly and the new entry only appears under the internal-only
listing filter.
- `server/service/apple_mdm_test.go` — added the new mock stub for
`OktaCACleanupTargetForInstallCommandFunc` to
`TestMDMCommandAndReportResultsProfileHandling` so the existing test
continues to pass with the new hook in the codepath.
- `server/service/conditional_access_idp_test.go` — the rendered-profile
assertion now also pins on the shared
`ConditionalAccessOktaProfileIdentifier` and
`ConditionalAccessOktaCertificateCN` constants so the template can't
drift from the SQL lookup.
Fixes#44805
Fixed a bug where the "Add custom variable" modal would clear entered
values when switching focus to another browser tab or application window
due to network refetches.
For the following quick win:
- https://github.com/fleetdm/fleet/issues/45965
<img width="852" height="288" alt="Screenshot 2026-06-05 at 3 30 08 PM"
src="https://github.com/user-attachments/assets/22967048-8752-4194-b5a6-9014f061e413"
/>
"Learn more" takes me to here:
https://fleetdm.com/guides/mdm-migration#end-user-workflow
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added "Learn more" link in the end user migration section that opens
the Fleet MDM migration guide documentation in a new tab.
* Configured redirect route to direct users to the end user workflow
section of the migration guide.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated GitHub Actions dependencies to latest stable versions across
CI/CD workflows for improved reliability, security, and performance.
* Enhanced build provenance attestation configuration for macOS, Linux,
and Windows builds.
* **Security**
* Strengthened workflow validation by removing override exception for
build artifact version mismatch rules, ensuring stricter security
compliance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46790
Example live run off this branch:
https://github.com/fleetdm/fleet/actions/runs/27005120262
Example stale issue with comment:
https://github.com/fleetdm/fleet/issues/18421
- Added `@author` mention when marking issue as stale
- Refactored so that both Fleetie and eng-initiated stale issue bots use
the same core JS code
- Run Fleetie-initiated workflow on a schedule
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Automated stale-issue workflows for engineering-initiated and Fleetie
issues with configurable dry-run, max-operations, manual triggers, and
scheduled runs.
* **Tests**
* Added shared test helpers and expanded, tightened test suites covering
staleness, closing, unstale, and error/boundary behaviors.
* **Refactor**
* Introduced a shared stale-issue engine used by thin,
author/label-based wrappers for consistent behavior and messaging.
* **Chores**
* Updated workflow triggers, permissions, and CI test matrix to include
the new core and wrappers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated internal code review assignments for documentation paths.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45263
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Android devices no longer lose team assignments or certificate
configuration when a host is deleted and the device re-enrolls.
* Re-enrollment restores a device’s previously known team when
available, preserving certificate templates and team-specific settings.
* Team transfers for Android devices now reliably update device records
so certificates and access remain consistent.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add support for Microsoft Visual C++ Redistributable (x64) via winget:
new installer and uninstaller PowerShell scripts that handle the WiX
"burn" bootstrapper, a winget input manifest, an app entry in
outputs/apps.json, and a detailed outputs/vc-redist-x64/windows.json
with version metadata (14.51.36231.0), installer URL, SHA256 and
embedded script refs. The uninstall script targets the bundle
ProductCode (falls back to the Package Cache) and normalizes /uninstall,
/quiet and /norestart handling; the install script runs the bootstrapper
with /quiet /norestart and treats reboot codes (3010, 1641) as success.
- Move "Re-enrolling" to troubleshooting because I think that's the best
spot we have for it. I don't think we want it in the top of the "AB"
section because we link to this section from "Add AB" UI and we want to
steps to add AB to be easy to find:
<img width="795" height="431" alt="Screenshot 2026-06-04 at 5 57 12 PM"
src="https://github.com/user-attachments/assets/8b691577-bc20-4b6d-92a8-7b5655fc4ebf"
/>
- Also did some other language cleanup
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated BBEdit macOS to version 16.0.1
* Updated Figma Windows to version 126.5.6
* Updated WhatsApp macOS to version 26.22.26
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#45178
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually. _Note: Only windows
and Mac OS. Android required by someone with a device._
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved MDM profile applicability on Android, Windows, and Apple to
handle combined include-all, include-any, and exclude-any label rules,
yielding more accurate install/remove decisions.
* **Tests**
* Added cross-platform tests covering combined include/exclude label
scenarios to verify correct profile selection, installation, and removal
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This pull request introduces support for managing Node.js as a
maintained Windows app in the system. It adds Node.js metadata,
versioning, install/uninstall scripts, and a custom SVG icon for the
frontend. The Windows workflow is updated to detect Node.js changes and
ensure any pre-installed Node.js is removed before installing the
managed version.
**Node.js app support:**
* Added `nodejs/windows` to the maintained apps with metadata
(`ee/maintained-apps/inputs/winget/nodejs.json`,
[[1]](diffhunk://#diff-07f6dd0fa793aa5ad8e559c540e6f85df3f3ef15f3c7582462441b85f84fb244R1-R10)
and output definitions
(`ee/maintained-apps/outputs/nodejs/windows.json`,
[[2]](diffhunk://#diff-da3a5f86c5330f52227f66bf34701870ff49b5a00651f89366b092c10c5d717fR1-R22)
including version, installer URL, and install/uninstall scripts.
* Updated `apps.json` to include Node.js as a Windows app with
description and identifiers (`ee/maintained-apps/outputs/apps.json`,
[ee/maintained-apps/outputs/apps.jsonR1698-R1704](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1698-R1704)).
**CI/CD workflow enhancements:**
* Modified `.github/workflows/test-fma-windows-pr-only.yml` to detect
Node.js changes in PRs, output `has_nodejs` flags, and remove
pre-installed Node.js before managed installation
(`.github/workflows/test-fma-windows-pr-only.yml`,
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR101)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR114)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR145-R152)
[[4]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR340-R407).
**Frontend improvements:**
* Added a custom Node.js SVG icon component
(`frontend/pages/SoftwarePage/components/icons/Nodejs.tsx`,
[frontend/pages/SoftwarePage/components/icons/Nodejs.tsxR1-R14](diffhunk://#diff-5c0b7f670e49e55467eb93b875eae2c00f83eee90e5b7b61eafab363df95165eR1-R14)).
* Registered the Node.js icon in the software icon map for display in
the UI (`frontend/pages/SoftwarePage/components/icons/index.ts`,
[[1]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR49)
[[2]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR486).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## New Features
* Added Node.js support for Windows platform with automated detection
and management capabilities
* Node.js is now displayed with a dedicated icon in the application
interface
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46912
<!-- Summary of what was resolved -->
- Webhook/ticket checkbox is now disabled (locked, no explanation) for
**Maintainers** in `PolicyAutomationsFields` — covers the create modal,
edit form, and manage automations modal since all three share the
component. (Any role below maintainer can't edit automations.)
- Automations cell pencil icon and `cursor: pointer` are now hidden for
roles that can't open the automations modal (technician and below).
- Config and team data are now fetched for all authenticated roles so
the webhook automation shows correctly in the table for technicians
(previously gated on `canAddOrDeletePolicies`, which excluded them).
## Testing
- [x] QA'd all new/changed functionality manually
#### Before
With a global/fleet technician user, Automations cell on Policies page
showed "2 automations" when there were actually 3 automations
configured.
Also, the pencil (edit) icon and cursor pointer are shown even though
technicians can't access the Manage automations modal.
https://github.com/user-attachments/assets/276f11f2-4d5c-46ed-80c8-cc5172fab62b
Maintainers can manage automations but they can't configure webhooks or
tickets (product requirement + also forbidden by BE). This silently
failed when checking the "Send webhook" checkbox when creating or
editing.
https://github.com/user-attachments/assets/482e546a-5cd6-4c7d-a74a-362e54b7ee09
#### After
Technicians see all available automations on the Policies page (and this
matches the Details page).
Also, the edit icon is no longer shown, and the Automations cell is no
longer clickable.
https://github.com/user-attachments/assets/21848ad8-42aa-4fe1-87f3-9c0d873c9d10
Locked "Send webhook" / "Create ticket" for Maintainers.
https://github.com/user-attachments/assets/f0c0b058-db02-4174-bb8e-33165014806f
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features / Improvements**
* Users without policy modification permissions can now access and view
the policies page.
* Automations column displays read-only state for users without edit
permissions.
* Non-global admin users can view webhook/ticket automations but see
them as locked and uneditable.
* Enhanced visual feedback distinguishing read-only elements from
interactive ones.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#4890
* Optimized listing labels query by refactoring correlated subquery.
* Optimized aggregate that counts host's labels to executed once, and
skip the join to hosts entirely when the team filter allows all hosts.
Allen Houchins
