<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41418
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
To manually QA, I put an early return with `msg.Fail` in the
`mdm_scep.go` file under PKIOperation method, and then triggered a SCEP
renewal.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Activity logging for Apple MDM enrollment profile renewal failures to
improve auditing and diagnostics.
* Host display enhancements: include computer name and hardware model to
improve host identification in activities and UI.
* **Tests**
* Integration tests verifying enrollment renewal failure activity
creation, association to the correct host, and activity payload
contents.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added Docker Compose configuration to deploy Percona PMM v2
monitoring: includes server and client services, persistent storage for
monitoring data, network connectivity across environments, and secure
agent-to-server communication setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
- @noahtalerman: We're updating the default profile for new Fleet
instances as part of this story:
- https://github.com/fleetdm/fleet/issues/40905
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Configuration Updates**
* Updated the default macOS enrollment profile name to "Fleet default
enrollment profile."
* Enrollment onboarding now shows the full setup flow (no setup items
are auto-skipped).
* Removed region-specific configuration constraints.
* **Behavioral Changes**
* MDM profile can be removed after enrollment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43928
This PR adds a Redis-backed cache in front of the two host-by-key
lookups on the agent auth paths.
Docs: https://github.com/fleetdm/fleet/pull/44504
## What changes
**Read path (osquery/orbit auth):**
- `LoadHostByNodeKey` and `LoadHostByOrbitNodeKey` now check Redis
before falling through to MySQL.
- Successful lookups are cached for 60s ± 10% jitter (configurable via
`FLEET_REDIS_HOST_CACHE_TTL`).
- `NotFound` results are cached for 5s as a negative entry, dampening
repeated probes for keys that
do not exist (deleted hosts whose agents are still polling, attacker
scans, retry storms).
- Concurrent lookups for the same key collapse into one DB query via
`singleflight`. The shared
query runs under a context detached from any one caller's deadline so
the leader giving up does
not abort the work for joiners. The shared query is itself bounded by a
30s timeout so a wedged
DB call cannot pin the singleflight slot indefinitely.
**Write path (invalidations):**
- These methods now invalidate the cache after a successful inner call:
`UpdateHost`, `SerialUpdateHost`, `UpdateHostOsqueryIntervals`,
`UpdateHostRefetchRequested`,
`UpdateHostRefetchCriticalQueriesUntil`,
`UpdateHostIdentityCertHostIDBySerial`, `EnrollOsquery`,
`EnrollOrbit`, `NewHost`, `DeleteHost`, `DeleteHosts`,
`CleanupExpiredHosts`,
`CleanupIncomingHosts`, `AddHostsToTeam`.
- `AddHostsToTeam`, `DeleteHosts`, `CleanupExpiredHosts`, and
`CleanupIncomingHosts` use a pipelined
batch invalidator so 10k-host operations stay in the millisecond range
instead of taking minutes
of sequential round-trips.
- Inner-call errors are not invalidations: a failing write leaves cached
state intact.
**Configuration:**
- New flags `FLEET_REDIS_HOST_CACHE_ENABLED` (default `true`) and
`FLEET_REDIS_HOST_CACHE_TTL`
(default `60s`).
- Server refuses to start if the cache is enabled with `TTL <= 0`.
**Observability:**
- Three new OTEL counters under the `fleet` meter:
- `fleet.host_cache.lookups{result=hit|negative_hit|miss}`
- `fleet.host_cache.errors{op=get|set|del}`
-
`fleet.host_cache.invalidations{reason=update|enroll|team|delete|cert}`
- A pre-built SigNoz dashboard ships in
`tools/signoz/host_cache_dashboard.json`.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Optional Redis-backed host lookup cache for osquery and orbit auth,
with automatic invalidation and metrics/monitoring dashboard.
* **Bug Fixes**
* Fixed host-removal batching so cache-related removals use correct
chunks.
* **Tests**
* Added comprehensive host-cache unit tests covering hits, negative
cache, invalidation, concurrency, and JSON round-trips.
* **Chores**
* New config flags to enable the cache and set TTL (default 60s ±10%
jitter).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This is no longer used, but gets flagged by AI.
https://github.com/fleetdm/fleet/pull/44511#discussion_r3169700014
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Removed a now-redundant exported activity list from the codebase,
simplifying internal activity declarations. This streamlines internal
structures without changing user-visible behavior or altering existing
activity types.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Added app/kilo-code-bot exclude
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Updated internal tooling to recognize an additional bot account in
pull request filtering processes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated supported application versions: Calibre (9.8.0), Fork
(2.66.7), Granola (7.162.5), Microsoft Edge (147.0.3912.98), Microsoft
Teams (26093.311.4599.3126), Ollama (0.22.1), Teleport Connect & Suite
(18.7.6), and Zotero (9.0.2) with latest installer packages and
verification checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Fleet version from v4.84.0 to v4.84.1 across deployment
configurations (Helm values, container images, Terraform for AWS/GCP,
and npm package) and bumped Helm chart package version v6.9.1 → v6.9.2.
* **Documentation**
* Updated CLI help/example text to reference the v4.84.1 milestone.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44194
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Team-level disk encryption can be toggled when at least one MDM
platform (Windows or Apple) is configured, enabling BitLocker control
for Windows-only deployments.
* **Bug Fixes**
* Updates validation to reject disk-encryption changes only when no MDM
platforms are configured.
* **Tests**
* Added coverage for platform combinations and expected behavior,
including Apple-specific profile creation when applicable.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
There was a change and now https://github.com/fleetdm/fleet/issues/44374
is to be released in 4.84.2
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated recommended patch versions for addressing critical security
vulnerabilities to ensure enhanced protection.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#36976
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Label operations (create, edit, delete) now generate activities shown
in the activity feed with label and optional fleet context.
* Host label add/remove operations emit corresponding label edited
activities; duplicate label names are deduplicated.
* Label activity types are selectable/filterable in the activity
dashboard.
* **Tests**
* Added unit, integration, and UI tests covering label activity
emission, rendering, filtering, and GitOps label lifecycle scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Changed the "See how it works" button on the homepage hero section to
navigate to https://fleetdm.com/gitops-workshop instead of opening the
video modal.
- Commented out the "3 mins" kicker text using EJS template comments
(code preserved but not rendered).
- The old video modal code (`clickOpenVideoModal`) remains in the
codebase untouched.
## Changes
`website/views/pages/homepage.ejs` — Updated the hero "See how it works"
link:
- Replaced `@click="clickOpenVideoModal('fleet-in-three-minutes')"` with
`href="https://fleetdm.com/gitops-workshop"`
- Wrapped `<span>3 mins</span>` in `<%/* ... */%>` EJS comments
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1777602444215539)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Arc to version 1.145.0
* Updated ExpressVPN to version 14.1.0
* Updated LibreOffice to version 26.2.3
* Updated Loom to version 0.346.4
* Updated Microsoft Edge to version 147.0.3912.98
* Updated Zen to version 1.19.11b
* Switched Dialpad installer format to pkg
* **Bug Fixes**
* Dialpad: installer integrity check disabled (no_check) and uninstall
now uses package receipt-aware removal instead of direct app deletion
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
## Summary
- Adds a new subsection to the Go-To-Market Operations handbook page
with instructions for removing a contact from the "Top contacts" list in
Salesforce.
- The new subsection is placed in the Salesforce operations area of the
page, after the "Create a quote" section and before the "Signatures"
section.
## Changes
- `handbook/company/go-to-market-operations.md`: Added `### Remove a
contact from the "Top contacts" list in Salesforce` with two-step
instructions (navigate to contact, uncheck the ⭐ field in system info,
save).
---
Built for [Sam
Pfluger](https://fleetdm.slack.com/archives/C08BTMFTUCR/p1777580786812059?thread_ts=1777580130.791709&cid=C08BTMFTUCR)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
Changes:
- Updated the docs-nav-and-search component to support a new
`searchFilter` value
- Updated the search filter on pages in the "Controls" section of the
docs.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44170 and Resolves#44422
Pagination is now pushed into each branch of the merged query, so
per-tick work scales with page size instead of total commands. The
Windows side was rewritten to avoid a disjunctive join that forced a
nested-loop plan. `per_page` is capped (default 10), `page` is capped,
and `order_key` is enforced against a closed allowlist on both code
paths. Cursor pagination is fixed and is the recommended way to traverse
beyond the page cap.
This PR improves but does not fix the use case of fetching commands from
all hosts. Deprecate usage without host_identifier:
https://github.com/fleetdm/fleet/pull/44392/changes
API doc updates: https://github.com/fleetdm/fleet/pull/44292
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enforced pagination on MDM commands list: per_page defaults to 10 (max
1,000) and page is capped at 100; traversal beyond page 100 requires
cursor pagination via after.
* **Bug Fixes / Performance**
* Improved MDM command listing performance and de-duplication for large
queries; fixed SQL error when combining host identifier with cursor
pagination.
* **Validation**
* Requests exceeding pagination caps return 400; invalid sort keys
return 422.
* **Tests**
* Added tests for pagination boundaries, cursor behavior, sort-key
validation, and error responses.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds a note under the SCEP section of the Apple MDM setup guide
clarifying that, for manually enrolled devices, MDM is turned off on the
host if SCEP certificate renewal fails, and the user must re-enroll to
restore MDM management.
- This documents already-released behavior.
## Test plan
- [ ] Verify the SCEP section in `articles/apple-mdm-setup.md` reads
correctly and renders properly on the docs site.
Replaces #44512 (which targeted `docs-v4.86.0` and had merge conflicts
when rebased to main).
https://claude.ai/code/session_01WacVBQENufY9uWfb1Aj48W
---
_Generated by [Claude
Code](https://claude.ai/code/session_01WacVBQENufY9uWfb1Aj48W)_
Co-authored-by: Claude <noreply@anthropic.com>
Fixes a lint issue in (currently unused) code for the 24-hr
checkerboard, that was causing one of our build tests to fail.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced 24-hour checkerboard visualization tooltips to display
complete data values and totals alongside percentage information.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated deployment workflow configuration to source Slack
notifications from the correct webhook endpoint.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43928
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Redis image version to 6.2 across Docker Compose
configurations for improved stability and compatibility.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Thunderbird metadata from version 150.0 to version 150.0.1 for
macOS and Windows, including updated installer artifacts and integrity
verification checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Google Drive (Windows) version configuration from 123.0.1.0 to
124.0.3.0 with new installer details
* Updated NordPass (macOS) version configuration from 7.6.18 to 7.6.20
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added support for Postman 12.8.4 on macOS and Windows
* Added support for Wireshark 4.6.5 on macOS and Windows
* Added support for Warp build 0.2026.04.27.15.32.03 on macOS
* Updated P4V installer validation on macOS
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com>
In response to https://github.com/fleetdm/fleet/pull/44398
<img width="963" height="423" alt="image"
src="https://github.com/user-attachments/assets/023fe231-2d00-461e-a97b-82eddccbe011"
/>
## Summary
- Removed the uppercase eyebrow text (`<h4>`) that appeared above the
main hero heading on the homepage
- Added the same text ("Open MDM + patching + vuln management for every
OS.") as a styled subtitle paragraph below the `<h1>` heading
- Applied the specified styles: color #515774, Inter font, 16px, weight
400, line-height 24px
## Changes
- `website/views/pages/homepage.ejs` — Removed `<h4>` eyebrow, added `<p
purpose="hero-subtitle">` below the heading
- `website/assets/styles/pages/homepage.less` — Added
`[purpose='hero-subtitle']` styles within the hero-text block
---
Built for [Michael
Thomas](https://fleetdm.slack.com/archives/D0AL6RD36GL/p1777554126602589)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
modern device management image update
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated feature image assets on multiple pages with higher resolution
variants
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The `hostVPPInstalls` function in `server/datastore/mysql/software.go`
contains a SQL condition:
```sql
(hvsi.platform != 'android' OR ncr.id IS NULL) AND
```
This is a logical tautology — it **never filters any rows**:
- **Android rows**: `ncr.id` is always `NULL` because Android installs
use Google's Android Management API, not nanoMDM. The condition
evaluates to `(FALSE OR TRUE) = TRUE`.
- **Apple rows**: The first operand `hvsi.platform != 'android'` is
`TRUE`, so the whole expression is `TRUE` regardless of `ncr.id`.
The condition was likely added during early Android VPP support to guard
against unexpected NCR joins for Android. However, since
`nano_command_results` is only written by the nanoMDM Apple MDM storage
layer (`server/mdm/nanomdm/storage/mysql/queue.go:168`), the guard can
never trigger.
Elsewhere in the codebase, the canonical pattern for NCR filtering is:
```sql
-- vpp.go:248, software_installers.go:1812
(ncr.id IS NOT NULL OR (:platform = 'android' AND ncr.id IS NULL))
```
This pattern has *different semantics* — it filters per-app aggregate
status counts to only include confirmed installs. The `hostVPPInstalls`
function serves the host software list where showing all statuses
(including pending) is intentional, so no NCR filter is needed.
## Changes
- Removed the dead condition from the `last_vpp_install` UNION branch
- Added a clarifying comment explaining why no NCR filter is applied and
how this differs from other query sites
- Added changelog entry
## Testing
- No behavior change — the removed condition was always TRUE
- Existing tests pass without modification
- `go build ./server/datastore/mysql/...` compiles clean
#android #sql #cleanup
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
- We often encounter bugs where the expected behavior is clear, but the
Product Development team cannot provide a specific solution. It often
requires engineer (tech lead) to understand what's broken and provide
technical details in the "To fix" section.
- Some time ago, we added a requirement to change the bug title to
reflect the expected behavior rather than what is broken. I find this
approach counterintuitive and often confusing. Additionally, I believe
we haven't consistently followed this practice, despite it being
documented.
---------
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Visual Studio Code updated to version 1.118.1 on macOS and Windows
with new installer checksums.
* **Bug Fixes**
* Improved installation and uninstallation workflows for Druva insync,
Fleet Desktop, and Zoom Rooms on macOS for better reliability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Apparently they actually said "GitOps" and not "infrastructure as code".
The quote at the bottom of the page was incorrect. Now they are both
right.
Thanks for the catch @eashaw
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated website testimonials and case study quotes with refreshed
terminology and messaging to better reflect current positioning.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request introduces support for ingesting Homebrew casks from
third-party taps (not available in the official
`Homebrew/homebrew-cask`) into the Fleet Maintained Apps (FMA) system.
It does this by allowing cask metadata to be committed directly into the
repository and referenced via a new `cask_path` field. The PR also
updates CI workflows to better support Fleet Desktop validation and
documents the new contributor flow.
**Support for custom Homebrew casks:**
* Added a new `cask_path` field to app manifests, allowing the FMA
ingester to read cask metadata from a local JSON file instead of
fetching from the Homebrew API. This enables ingestion of apps from
third-party taps or custom casks not present in the official Homebrew
repository.
[[1]](diffhunk://#diff-be469dd148f0c50ad56489c48bdb514522e1a46d21336e8f747b5880d71a6d1bR49-R66)
[[2]](diffhunk://#diff-abd7db4bef16a062c1bd81f54a7c846f1e91b913a9fe9f87976c8075f39b8cd2R270-R276)
* Refactored the Homebrew ingester (`brewIngester`) to use a new
`fetchCask` helper, which reads from the local file if `cask_path` is
set, or falls back to the API otherwise. Includes robust error handling.
[[1]](diffhunk://#diff-abd7db4bef16a062c1bd81f54a7c846f1e91b913a9fe9f87976c8075f39b8cd2L99-R101)
[[2]](diffhunk://#diff-abd7db4bef16a062c1bd81f54a7c846f1e91b913a9fe9f87976c8075f39b8cd2R200-R251)
* Added comprehensive documentation and examples for the custom tap
workflow, including a new `custom-tap/` directory with cask DSL sources,
generated JSON, and a regeneration script.
[[1]](diffhunk://#diff-2dfa2fc79b9becad555db38289a16afe4ce651665a31868d386fed8b4e160740R1-R85)
[[2]](diffhunk://#diff-be469dd148f0c50ad56489c48bdb514522e1a46d21336e8f747b5880d71a6d1bR49-R66)
* Added new custom casks for `fleet-desktop`, `druva-insync`, and
`zoom-rooms` under `inputs/homebrew/custom-tap/Casks/`.
[[1]](diffhunk://#diff-2555a54830de2bfb0ffca8bc487aac67de84dee5d431fe5f42e90e1754f63bb6R1-R36)
[[2]](diffhunk://#diff-db1fa8a43a27c5adf49a5ade04e61405ce1e9420f266e3160156cabf69ed4ea8R1-R40)
[[3]](diffhunk://#diff-effd461583140683d41dc68d9a93692d039be5ad5e52b6b108ece79f17155107R1-R44)
**Testing and validation:**
* Added a new test (`TestIngestCaskPath`) to ensure the ingester
correctly reads from `cask_path` and does not make unnecessary HTTP
requests, with error handling for missing files.
**CI workflow improvements:**
* Updated GitHub Actions workflows to handle Fleet Desktop's installer
requirements in CI by creating a managed preferences stub when
validating Fleet Desktop, ensuring the installer succeeds even without
MDM enrollment.
[[1]](diffhunk://#diff-28b30c8601cb7662d59efbfbbcf800cae91455fd3d875627659dced8c1257a24R100)
[[2]](diffhunk://#diff-28b30c8601cb7662d59efbfbbcf800cae91455fd3d875627659dced8c1257a24R116-R123)
[[3]](diffhunk://#diff-28b30c8601cb7662d59efbfbbcf800cae91455fd3d875627659dced8c1257a24R148-R172)
[[4]](diffhunk://#diff-c263ffc3062c3b5e4e4eb65976080c6cbddac478a5fed3392fe8b23c49bb2da8R69-R92)
These changes make it possible to maintain and test apps from custom
Homebrew taps within the Fleet repo, improving flexibility and
reliability for Fleet-maintained apps.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for three new macOS apps: Fleet Desktop, Druva inSync,
and Zoom Rooms
* Added UI icons for Fleet Desktop and Zoom Rooms
* **Enhancements**
* Fleet Desktop includes an MDM enrollment caveat and improved installer
validation for macOS installers
* Support for overriding Homebrew cask input via a local cask JSON file
* **Tests**
* Added unit coverage for local cask JSON ingestion behavior
* **Chores**
* Added a deterministic script to regenerate Homebrew custom-tap
manifests
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add forceful Adobe Acrobat Reader patch policy for all devices
Add critical patch policies for Adobe Acrobat Reader on macOS and
Windows that enforce immediate automatic updates via install_software:
true. This ensures all devices running Adobe Reader are patched without
user intervention, addressing the high-risk security profile of PDF
readers.
Changes:
- Add macOS patch policy (adobe-acrobat-reader/darwin) with critical
flag
- Add Windows patch policy (adobe-acrobat-reader/windows) with critical
flag
- Register Adobe Acrobat Reader as a fleet_maintained_app for both
platforms
in workstations.yml
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Adobe Acrobat Reader added as self-service software for macOS and x86
Windows; categorized under Productivity.
* Adobe Acrobat Pro added as self-service software for macOS;
categorized under Productivity.
* Automatic device targeting now surfaces these apps only to hosts that
already have them installed.
* New critical patch policies for macOS and Windows enable automatic
updates with self-service fallback on install failures.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Updating CVE notes with new information for:
- CVE-2026-39883 (only affects BSD and Solaris).
- CVE-2026-32281, CVE-2026-32283: To be fixed in
[v4.84.1](https://github.com/fleetdm/fleet/milestone/246).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security Updates**
* Updated Fleet vulnerability advisories and remediation guidance with
corrected upgrade recommendations to ensure users receive accurate
information for addressing security issues
* Enhanced vulnerability assessments with additional platform
compatibility information to help users better evaluate applicable risks
to their environments
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Magnus Jensen