This pull request adds support for PowerShell as a managed Windows app,
including its metadata, versioning, install/uninstall scripts, and
validation logic in the CI workflow. It also ensures that any
pre-installed PowerShell 7 is removed from the test environment before
validation. The most important changes are:
**PowerShell app definition and metadata:**
* Added a new entry for PowerShell in
`ee/maintained-apps/inputs/winget/powershell.json` and included its
metadata in `ee/maintained-apps/outputs/apps.json`, enabling PowerShell
to be managed as a Windows app.
[[1]](diffhunk://#diff-7e4899a379d327948f55b7e6ba4c9893501713edd16020b128b68343569fcbfbR1-R10)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1985-R1991)
* Created `ee/maintained-apps/outputs/powershell/windows.json`
containing version information, SQL queries for existence and patch
status, installer/uninstaller scripts, and download URL for PowerShell
7.6.2.0.
**CI workflow enhancements for PowerShell:**
* Updated `.github/workflows/test-fma-windows-pr-only.yml` to detect
changes involving PowerShell, set the appropriate output flags, and
conditionally execute PowerShell-specific steps.
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR102)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR116)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR155-R162)
* Added a workflow step to remove any pre-installed PowerShell 7 from
the GitHub Actions runner, ensuring a clean environment for validation.
* Ensured that validation and related steps use Windows PowerShell 5.1
(not pwsh) after uninstalling PowerShell 7, to avoid shell availability
issues.
These changes collectively enable PowerShell to be validated, installed,
and uninstalled as part of the managed apps ecosystem and ensure
reliable, repeatable CI validation.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added PowerShell as a supported application with full Windows
integration, including installation and uninstall management
capabilities.
* Enhanced deployment scripts to support flexible input handling for app
configurations.
* Added PowerShell icon to the frontend UI for visual identification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/46872
Changes:
- Updated the `productCategories` value of the testimonial from Adam
Pippert to show it on the /software-management page.
- Updated the order of testimonials on the homepage,
/software-management, /device-management, and /linux-management
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* In-house iOS app manifest and package downloads now use secure
per-install tokens embedded in the URL path instead of query parameters
* Installation tokens are bound to specific devices and teams, enhancing
security
* Installation tokens automatically expire after 6 hours
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jonathan Katz <yehonatankatz@gmail.com>
**Related issue:** Resolves#35148
## What was added
| CVE | Rule | Reason |
|-----|------|--------|
| **CVE-2017-17522** | `IgnoreAll` | DISPUTED by Python maintainers; not
exploitable (`webbrowser.py` uses `subprocess.Popen` with
`shell=False`). Broad NVD CPE matched modern Python. |
| **CVE-2023-36632** | `IgnoreAll` | NVD-DISPUTED — Python states it's
"neither a vulnerability nor a bug" (intentional `RecursionError` in
`email.utils.parseaddr`). |
| **CVE-2024-3219** | `IgnoreIf target_sw != "windows"` | Only affects
platforms lacking AF_UNIX (Windows). Linux/macOS unaffected, but
NVD/VulnCheck CPE uses `target_sw=*`. |
**Files touched:**
- `cpe_matching_rules.go` — three new rules
- `cpe_matching_rule_test.go` — assertions covering all three (incl.
Windows-vs-macOS/Linux distinction for CVE-2024-3219)
- `changes/35148-python-cve-false-positives` — changelog
**Correctness note:** `target_sw` derives from software *source*
(`apps`/`homebrew_packages` → `macos`, `programs` → `windows`), so the
CVE-2024-3219 rule suppresses on macOS while preserving the genuine
Windows
positive.
## What was skipped, and why
| CVE | Why skipped |
|-----|-------------|
| **CVE-2024-12718** | Conflicting evidence: getvictor confirmed it's a
**true positive** (3.9.22 < fixed 3.9.23), contradicting the customer's
"only 3.12+ affected" reasoning. Needs a product/security ruling, not a
code change. |
| **CVE-2025-1795** | Likely a VulnCheck patch-level miss (customer says
3.10.17 has the backported fix). Needs the actual VulnCheck version
range to fix safely. |
| **CVE-2023-32681** | Affects `python:requests` and is **correctly
matched**; the customer dismissed it on deployment grounds ("corporate
servers only"). Not a detection bug. |
| **CVE-2007-4559** | Real tarfile path-traversal (CVSS 9.8, **not
disputed**); the customer labeled it "Other issue," not a false
positive. Suppressing it would hide a genuine vulnerability. |
**Related issue:** Resolves#42757
## Summary
Resending or renewing the Okta conditional access profile leaves an
orphaned SCEP certificate in the per-user macOS keychain, accumulating
duplicates with every renewal. This PR auto-runs an existing
keychain-cleanup script after a successful `InstallProfile` ack for the
Okta CA profile, so admins no longer have to find and run the script
manually.
## Root cause
Investigation in the issue thread isolated the trigger:
- The Okta CA `.mobileconfig` bundles `com.apple.security.scep` with
`com.apple.security.identitypreference` in a single profile (macOS
rejects the alternative — `Identity payload not found in same profile as
identity preference payload`).
- The Identity Preference payload creates a keychain-resident preference
item that keeps the *old* cert pinned across profile replacement, even
though the rewritten Identity Preference now points to the fresh SCEP
enrollment.
- EAP-TLS Wi-Fi profiles renew cleanly because they reference the cert
via SystemConfiguration (`PayloadCertificateUUID`), not the keychain —
so this isn't a generic SCEP-bundling issue.
The team decision in the issue (`@sharon-fdm`) was to delete the
duplicate certificate rather than restructure the profile. A standalone
cleanup script already shipped at
`docs/solutions/macos/scripts/delete-duplicate-scep-certificates.sh` and
was linked from the Okta CA guide; admins had to find and run it.
## Approach
Hook the existing Apple MDM `InstallProfile` ack path in
`MDMAppleCheckinAndCommandService.CommandAndReportResults`, parallel to
the existing ACME `CertificateList` follow-up. When the ack is for the
Okta CA profile and status is `verifying`, enqueue an internal host
script run that executes the cleanup script targeting the host's
per-user MDM enrollment short name.
Key properties:
- **Single hook, three paths covered.** Admin "Resend" nulls the profile
status and the reconciliation cron re-enqueues an `InstallProfile`; the
SCEP renewal cron also re-issues `InstallProfile`. Both flow through the
same ack handler this hook attaches to.
- **Idempotent.** The cleanup script no-ops when only one matching cert
is present, so triggering on initial installs (not just renewals) is
safe and removes the need to distinguish "is this a renewal".
- **Tightly gated.** Single indexed lookup keyed on `(host_uuid,
command_uuid, profile_identifier, platform='darwin')`. Other
SCEP-bearing profiles do not trigger the script. No work happens for
hosts with no per-user enrollment.
- **Internal-script semantics** (matches lock/unlock/wipe prior art).
Runs even when scripts are globally disabled. Does not appear in the
user-facing host activity feed.
- **Failure-isolated.** Enqueue errors are logged but do not break the
ack path; the renewal itself is what matters.
- **Defense in depth on the shell call.** The macOS short name is
validated against a strict regex (`^[A-Za-z0-9_][A-Za-z0-9_.-]*$`, ≤31
chars) before being interpolated, and POSIX single-quote-escaped on the
way through.
## Files
**New**
- `server/service/conditional_access_cleanup.go` — `//go:embed` of the
cleanup script, the hook helper `maybeRunOktaCACleanupScript`, the
validated shell-wrapper builder, and the POSIX single-quote escape
helper.
- `server/service/conditional_access_cleanup_test.go` — unit coverage
for username validation, shell escaping, the routing decisions of the
hook helper (mock-based), and an embed-sync assertion against the docs
copy.
-
`server/service/embedded_scripts/delete-duplicate-scep-certificates.sh`
— embed source-of-truth copy, byte-for-byte equal to the public
`docs/solutions/macos/scripts/` script.
- `changes/42757-okta-conditional-access-duplicate-scep-cert-cleanup` —
user-visible changes note.
**Datastore**
- `server/datastore/mysql/mdm.go` —
`OktaCACleanupTargetForInstallCommand`: single SQL lookup that returns
`(host_id, user_short_name, ok)` for the new hook. Returns `ok=false`
for non-Okta profiles, non-darwin hosts, or hosts without a user-channel
enrollment.
- `server/datastore/mysql/scripts.go` —
`NewInternalHostScriptExecutionRequest`: thin wrapper that routes
through the existing internal-script codepath (`isInternal=true`) used
by lock/unlock/wipe. Refactored the existing public method to share an
internal helper.
**Interface / mocks**
- `server/fleet/conditional_access_idp.go` — exported
`ConditionalAccessOktaProfileIdentifier`,
`ConditionalAccessOktaCertificateCN`, and the new `OktaCACleanupTarget`
struct, so both the template-render path and the SQL lookup can
reference the same source of truth.
- `server/fleet/datastore.go` — `OktaCACleanupTargetForInstallCommand`
and `NewInternalHostScriptExecutionRequest` added to the `Datastore`
interface.
- `server/mock/datastore_mock.go` — regenerated (additions only).
**Wiring**
- `server/service/apple_mdm.go` — call into
`maybeRunOktaCACleanupScript` from the InstallProfile
`MDMDeliveryVerifying` branch, alongside the existing ACME
`maybeQueueCertificateListForACMEProfile` follow-up. Warns on error
rather than failing the ack.
- `server/service/conditional_access_idp.go` — use the new
`fleet.ConditionalAccessOktaCertificateCN` constant when rendering the
profile template, eliminating the magic string duplication.
**Tests touched**
- `server/datastore/mysql/mdm_test.go` — integration test
`testOktaCACleanupTargetForInstallCommand` covering the happy path,
non-Okta profile, device-only enrollment, and unknown command.
- `server/datastore/mysql/scripts_test.go` —
`testNewInternalHostScriptExecutionRequest` confirming the internal flag
is set correctly and the new entry only appears under the internal-only
listing filter.
- `server/service/apple_mdm_test.go` — added the new mock stub for
`OktaCACleanupTargetForInstallCommandFunc` to
`TestMDMCommandAndReportResultsProfileHandling` so the existing test
continues to pass with the new hook in the codepath.
- `server/service/conditional_access_idp_test.go` — the rendered-profile
assertion now also pins on the shared
`ConditionalAccessOktaProfileIdentifier` and
`ConditionalAccessOktaCertificateCN` constants so the template can't
drift from the SQL lookup.
Fixes#44805
Fixed a bug where the "Add custom variable" modal would clear entered
values when switching focus to another browser tab or application window
due to network refetches.
For the following quick win:
- https://github.com/fleetdm/fleet/issues/45965
<img width="852" height="288" alt="Screenshot 2026-06-05 at 3 30 08 PM"
src="https://github.com/user-attachments/assets/22967048-8752-4194-b5a6-9014f061e413"
/>
"Learn more" takes me to here:
https://fleetdm.com/guides/mdm-migration#end-user-workflow
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added "Learn more" link in the end user migration section that opens
the Fleet MDM migration guide documentation in a new tab.
* Configured redirect route to direct users to the end user workflow
section of the migration guide.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated GitHub Actions dependencies to latest stable versions across
CI/CD workflows for improved reliability, security, and performance.
* Enhanced build provenance attestation configuration for macOS, Linux,
and Windows builds.
* **Security**
* Strengthened workflow validation by removing override exception for
build artifact version mismatch rules, ensuring stricter security
compliance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46790
Example live run off this branch:
https://github.com/fleetdm/fleet/actions/runs/27005120262
Example stale issue with comment:
https://github.com/fleetdm/fleet/issues/18421
- Added `@author` mention when marking issue as stale
- Refactored so that both Fleetie and eng-initiated stale issue bots use
the same core JS code
- Run Fleetie-initiated workflow on a schedule
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Automated stale-issue workflows for engineering-initiated and Fleetie
issues with configurable dry-run, max-operations, manual triggers, and
scheduled runs.
* **Tests**
* Added shared test helpers and expanded, tightened test suites covering
staleness, closing, unstale, and error/boundary behaviors.
* **Refactor**
* Introduced a shared stale-issue engine used by thin,
author/label-based wrappers for consistent behavior and messaging.
* **Chores**
* Updated workflow triggers, permissions, and CI test matrix to include
the new core and wrappers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated internal code review assignments for documentation paths.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45263
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Android devices no longer lose team assignments or certificate
configuration when a host is deleted and the device re-enrolls.
* Re-enrollment restores a device’s previously known team when
available, preserving certificate templates and team-specific settings.
* Team transfers for Android devices now reliably update device records
so certificates and access remain consistent.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add support for Microsoft Visual C++ Redistributable (x64) via winget:
new installer and uninstaller PowerShell scripts that handle the WiX
"burn" bootstrapper, a winget input manifest, an app entry in
outputs/apps.json, and a detailed outputs/vc-redist-x64/windows.json
with version metadata (14.51.36231.0), installer URL, SHA256 and
embedded script refs. The uninstall script targets the bundle
ProductCode (falls back to the Package Cache) and normalizes /uninstall,
/quiet and /norestart handling; the install script runs the bootstrapper
with /quiet /norestart and treats reboot codes (3010, 1641) as success.
- Move "Re-enrolling" to troubleshooting because I think that's the best
spot we have for it. I don't think we want it in the top of the "AB"
section because we link to this section from "Add AB" UI and we want to
steps to add AB to be easy to find:
<img width="795" height="431" alt="Screenshot 2026-06-04 at 5 57 12 PM"
src="https://github.com/user-attachments/assets/8b691577-bc20-4b6d-92a8-7b5655fc4ebf"
/>
- Also did some other language cleanup
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated BBEdit macOS to version 16.0.1
* Updated Figma Windows to version 126.5.6
* Updated WhatsApp macOS to version 26.22.26
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#45178
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually. _Note: Only windows
and Mac OS. Android required by someone with a device._
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved MDM profile applicability on Android, Windows, and Apple to
handle combined include-all, include-any, and exclude-any label rules,
yielding more accurate install/remove decisions.
* **Tests**
* Added cross-platform tests covering combined include/exclude label
scenarios to verify correct profile selection, installation, and removal
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This pull request introduces support for managing Node.js as a
maintained Windows app in the system. It adds Node.js metadata,
versioning, install/uninstall scripts, and a custom SVG icon for the
frontend. The Windows workflow is updated to detect Node.js changes and
ensure any pre-installed Node.js is removed before installing the
managed version.
**Node.js app support:**
* Added `nodejs/windows` to the maintained apps with metadata
(`ee/maintained-apps/inputs/winget/nodejs.json`,
[[1]](diffhunk://#diff-07f6dd0fa793aa5ad8e559c540e6f85df3f3ef15f3c7582462441b85f84fb244R1-R10)
and output definitions
(`ee/maintained-apps/outputs/nodejs/windows.json`,
[[2]](diffhunk://#diff-da3a5f86c5330f52227f66bf34701870ff49b5a00651f89366b092c10c5d717fR1-R22)
including version, installer URL, and install/uninstall scripts.
* Updated `apps.json` to include Node.js as a Windows app with
description and identifiers (`ee/maintained-apps/outputs/apps.json`,
[ee/maintained-apps/outputs/apps.jsonR1698-R1704](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1698-R1704)).
**CI/CD workflow enhancements:**
* Modified `.github/workflows/test-fma-windows-pr-only.yml` to detect
Node.js changes in PRs, output `has_nodejs` flags, and remove
pre-installed Node.js before managed installation
(`.github/workflows/test-fma-windows-pr-only.yml`,
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR101)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR114)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR145-R152)
[[4]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR340-R407).
**Frontend improvements:**
* Added a custom Node.js SVG icon component
(`frontend/pages/SoftwarePage/components/icons/Nodejs.tsx`,
[frontend/pages/SoftwarePage/components/icons/Nodejs.tsxR1-R14](diffhunk://#diff-5c0b7f670e49e55467eb93b875eae2c00f83eee90e5b7b61eafab363df95165eR1-R14)).
* Registered the Node.js icon in the software icon map for display in
the UI (`frontend/pages/SoftwarePage/components/icons/index.ts`,
[[1]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR49)
[[2]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR486).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## New Features
* Added Node.js support for Windows platform with automated detection
and management capabilities
* Node.js is now displayed with a dedicated icon in the application
interface
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46912
<!-- Summary of what was resolved -->
- Webhook/ticket checkbox is now disabled (locked, no explanation) for
**Maintainers** in `PolicyAutomationsFields` — covers the create modal,
edit form, and manage automations modal since all three share the
component. (Any role below maintainer can't edit automations.)
- Automations cell pencil icon and `cursor: pointer` are now hidden for
roles that can't open the automations modal (technician and below).
- Config and team data are now fetched for all authenticated roles so
the webhook automation shows correctly in the table for technicians
(previously gated on `canAddOrDeletePolicies`, which excluded them).
## Testing
- [x] QA'd all new/changed functionality manually
#### Before
With a global/fleet technician user, Automations cell on Policies page
showed "2 automations" when there were actually 3 automations
configured.
Also, the pencil (edit) icon and cursor pointer are shown even though
technicians can't access the Manage automations modal.
https://github.com/user-attachments/assets/276f11f2-4d5c-46ed-80c8-cc5172fab62b
Maintainers can manage automations but they can't configure webhooks or
tickets (product requirement + also forbidden by BE). This silently
failed when checking the "Send webhook" checkbox when creating or
editing.
https://github.com/user-attachments/assets/482e546a-5cd6-4c7d-a74a-362e54b7ee09
#### After
Technicians see all available automations on the Policies page (and this
matches the Details page).
Also, the edit icon is no longer shown, and the Automations cell is no
longer clickable.
https://github.com/user-attachments/assets/21848ad8-42aa-4fe1-87f3-9c0d873c9d10
Locked "Send webhook" / "Create ticket" for Maintainers.
https://github.com/user-attachments/assets/f0c0b058-db02-4174-bb8e-33165014806f
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features / Improvements**
* Users without policy modification permissions can now access and view
the policies page.
* Automations column displays read-only state for users without edit
permissions.
* Non-global admin users can view webhook/ticket automations but see
them as locked and uneditable.
* Enhanced visual feedback distinguishing read-only elements from
interactive ones.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#4890
* Optimized listing labels query by refactoring correlated subquery.
* Optimized aggregate that counts host's labels to executed once, and
skip the join to hosts entirely when the team filter allows all hosts.
Adds a `macos_applications` boolean query parameter to the list host
software endpoint (`GET /api/_version_/fleet/hosts/{id}/software`). When
true, results are restricted to apps installed at the top level of the
macOS /Applications folder, hiding helper apps, system apps,
command-line tools, and user-local apps. The filter applies only to
macOS hosts and is ignored on other platforms.
The filter is applied by pruning the in-memory software maps in
ListHostSoftware down to the title IDs that have a top-level
`/Applications` bundle, so the count and paginated queries stay
consistent and the filter applies uniformly across regular, VPP, and
in-house apps. Top-level is determined from
`host_software_installed_paths` via
`installed_path LIKE '/Applications/%' AND NOT LIKE '/Applications/%/%'
on source 'apps'`.
**Related issue:** Resolves#39017
Introduce MindManager to the maintained apps set: add a Homebrew input
(mindmanager.json), register the app in
ee/maintained-apps/outputs/apps.json, and provide a darwin versions file
for v25.2.105 including installer URL, sha256, and install/uninstall
script refs. Also add a frontend SVG icon component, wire it into the
icon map, and include the 2x PNG asset. These changes enable the app to
be detected, installed/uninstalled, and displayed in the UI.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
for #44846
for #43458
- UPDATE: @noahtalerman: For the following story:
- https://github.com/fleetdm/fleet/issues/44846
---
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added a new Agent column on the Hosts page displaying Orbit version
with tooltips showing Osquery, Orbit, and Fleet Desktop versions for
comprehensive version visibility.
* **Improvements**
* Updated default column visibility on the Hosts page—Issues and Private
IP columns are now hidden by default for a cleaner view.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Scott Gress <scott@fleetdm.com>
- misfeature — rule enabled, waived only for the 6 Windows shell: cmd
workflows (catches any future misuse elsewhere).
- excessive-permissions and artipacked — fixed and fully enforced
(removed from gate).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved CI/CD security by disabling credential persistence across
many workflows.
* Tightened workflow permissions to least-privilege for selected build
and analysis jobs.
* Made runner hardening and credential handling explicit in several
deployment and test workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes#40303
### Summary
Adds support for Google Application Default Credentials (ADC) bearer
token authentication when using GCS's S3-compatible endpoint. This
allows Fleet deployments on GCP to use workload identity instead of
static HMAC keys.
Changes
- Add `s3_software_installers_gcs_iam_auth` config option for software
installer storage
- Add `s3_carves_gcs_iam_auth` config option for file carving storage
- Implement OAuth2 bearer token auth in S3 client via middleware
(removes AWS SigV4 signing)
- Add validation to ensure GCS IAM auth requires endpoint URL containing
`storage.googleapis.com`
- Add Helm chart values and deployment env vars for both options
- Add documentation for new configuration options
- Add tests for GCS IAM auth validation and integration
### Usage
Enable GCS IAM auth by setting the endpoint URL to Google's
S3-compatible endpoint and enabling the IAM auth flag:
```yaml
s3:
software_installers_endpoint_url: https://storage.googleapis.com
software_installers_gcs_iam_auth: true
software_installers_bucket: my-bucket
software_installers_force_s3_path_style: true
```
Or via environment variables:
```
FLEET_S3_SOFTWARE_INSTALLERS_ENDPOINT_URL=https://storage.googleapis.com
FLEET_S3_SOFTWARE_INSTALLERS_GCS_IAM_AUTH=true
FLEET_S3_SOFTWARE_INSTALLERS_BUCKET=my-bucket
FLEET_S3_SOFTWARE_INSTALLERS_FORCE_S3_PATH_STYLE=true
```
### Testing
- Unit tests validate configuration requirements (GCS endpoint, no HMAC
keys, no STS role)
- Integration test verifies bearer token is correctly injected into
requests
**Related issue:** Resolves #
## Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [TODO] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [X] Setting(s) is/are explicitly excluded from GitOps
> [!NOTE]
These are infrastructure-level server settings (env vars/config file),
not app-level settings managed via GitOps YAML.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Google Cloud Storage (GCS) IAM authentication support for file
carving and software installer storage using Google Application Default
Credentials
* **Configuration**
* New authentication configuration option available for both carving and
software installer S3 storage in Helm deployments and configuration
files
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/40374)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Carlo <1778532+cdcme@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Claude to version 1.11187.2
* Updated Postman to version 12.13.6 (macOS and Windows)
* Updated Sourcetree to version 3.4.31
* Updated Teleport Connect to version 18.8.3
* Refreshed installer resources for CleanMyMac and Warp
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44440
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] QA'd all new/changed functionality manually
^ I verified if within 1 minute it's still locked, after 1 minute it
removes the Locked state
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Reduced the delay for Apple MDM unlock status updates so recently
unlocked hosts are reflected as unlocked much faster (cleanup window
shortened from ~5 minutes to ~1 minute), improving Fleet responsiveness
and accuracy.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add multiple 60x60@2x PNG app icons to website/assets/images for app
listings: amazon-corretto (21, 24, 26), amazon-dcv (client, server),
imazing, prisma-browser, and tableau-desktop. These assets provide
high-DPI icons used by the website's app pages.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45192
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Deleting one of multiple duplicate Apple DEP hosts now properly
resolves the duplicate and prevents recreation of a pending host when
another host with the same serial and platform still exists.
* **Tests**
* Added unit tests covering deletion behavior for duplicate DEP hosts to
ensure correct resolution and no unintended pending-host restoration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45148 (it's part of the Manage Automations
Modal, didn't want to create a new issue just for this small
regression).
<img width="927" height="331" alt="Screenshot 2026-06-04 at 3 35 27 PM"
src="https://github.com/user-attachments/assets/400406fa-a99c-4f29-a8a2-571f5acb63eb"
/>
The platform/version subtitle logic (e.g. `Windows (.exe) • 8.9.6.4`)
was extracted from `InstallSoftwareModal` into the shared
`pages/policies/helpers.ts` so the new `PolicyAutomationsFields`
software dropdown can reuse it. `InstallSoftwareModal` is no longer
rendered anywhere and will be removed in a follow-up cleanup PR, at
which point its now-duplicate copy of this helper goes away with it.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
#### Before
<img width="405" height="222" alt="main"
src="https://github.com/user-attachments/assets/8be30833-1066-428d-baf2-4209c099c95f"
/>
#### After
<img width="839" height="724" alt="Screenshot 2026-06-04 at 3 26 26 PM"
src="https://github.com/user-attachments/assets/274fb185-c770-4445-89d9-35ece891f46f"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Software dropdown options now display platform and version details,
include App Store labeling, and show file-extension hints when
available.
* **Tests**
* Added tests for generation of dropdown descriptive text, covering
platform mapping, App Store/version handling, file-extension extraction,
and cases with missing platform or version.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds a new section to the IT handbook (`handbook/it/README.md`)
documenting that IT is responsible for emailing the Google Logins PDF
sheet to new team members on the morning of their first day, before
their onboarding calls begin.
- Placed after "Secure company-issued equipment for a team member" to
keep IT-owned onboarding tasks grouped together.
## Changes
- `handbook/it/README.md`: Added `### Send Google login credentials to a
new team member` section
---
Built for [Andrea
Pepper](https://fleetdm.slack.com/archives/D0AENPQMD2S/p1780603599123129?thread_ts=1776965257.297969&cid=D0AENPQMD2S)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44854
This PR explicitly enables the 1Password autofill icon for credential
fields, such as the ones in the login form.
Made the decision to have `ignore1password=true` by default (less LOC
changed since the vast majority of inputs aren't credential fields).
Note: even though the Certificate Authority input fields contain some
kind of secret or credentials, I feel like these differ enough from one
another (+ these are usually admin-pasted values) that it didn't make
sense to have the 1PW autofill on them.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
https://github.com/user-attachments/assets/c8539d8f-e0e3-4499-ae67-16cfd0f59e3a
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Prevented the 1Password autofill icon from appearing on non-credential
inputs.
* Ensured explicit 1Password autofill handling for email/password fields
across login, registration, password reset, and account forms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44901
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<img width="826" height="427" alt="Screenshot 2026-06-04 at 9 00 40 AM"
src="https://github.com/user-attachments/assets/a0b1d2fb-3077-4883-a69a-c37e6e81d3d7"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed the Add host modal so read-only installer command fields can no
longer be resized.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Extracts the Redis pool and the cached_mysql / mysqlredis datastore
wrappers out of `runServeCmd` and into a new `cmd/fleet/redis.go`. Same
pattern as the prior extractions on this issue (#44929, #45343, #45583,
#46166, #46421, #46517, #46742). Continues the path toward `serve.go`
>60% coverage per the discussion on #33370.
Three functions come out of the inline block:
- `initRedis` — builds the Redis pool, wraps the datastore with
`cached_mysql.New`, and applies `mysqlredis.New` with the
license-enforced host limit and host-cache options. Returns the pool,
the fully wrapped `fleet.Datastore`, and the outermost
`*mysqlredis.Datastore` (a few callers need the concrete type).
- `buildRedisPoolConfig` — translates `config.RedisConfig` into the
`redis.PoolConfig`, including the `redis://` scheme strip.
- `validateRedisConfig` — encodes the host-cache invariant:
`HostCacheEnabled` requires `HostCacheTTL > 0`. Returns an error so the
caller (or in this case `initRedis` via `initFatal`) can refuse boot
without that decision being buried inside a pure builder.
Behavior is preserved — `runServeCmd` calls these in the same order with
the same arguments, the host-cache validation still aborts startup when
violated, and the full `cmd/fleet` suite passes against MySQL + Redis.
`initRedis` returns early after `initFatal` so it's safe when the
caller's `initFatal` doesn't terminate (the case in tests). Following
the precedent established on #46742, the caller also has a loud
`initFatal` + `return` guard against a nil pool (covers the same nilaway
flow we hit on the datastore slice).
On test scope: `TestValidateRedisConfig` covers all four combinations of
`HostCacheEnabled` and `HostCacheTTL` — that's the real
boot/refuse-to-boot decision. `TestBuildRedisPoolConfigStripsScheme`
pins the `redis://` scheme-strip contract for Render-style URIs. I
didn't add a `buildRedisPoolConfig` field-mapping matrix or an
`initRedis` happy-path unit test: the former would just re-state the
struct literal, and the latter needs a real Redis pool (the smoke boot
exercises it end-to-end instead).
This completes the four named init-block extractions on this issue. If
further coverage gains are needed beyond what these have already moved,
the next conversation is whether to test `runServeCmd` directly via the
injected `initFatal`.
**Related issue:** Refs #33370
# Checklist for submitter
- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Consolidated Redis initialization and datastore wrapping into a
dedicated helper; startup now validates the Redis pool and handles
initialization failures explicitly.
* **Tests**
* Added unit tests for Redis address handling and host-cache TTL
validation to ensure config behavior is enforced.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45441
The issue is when hitting the `svc.DeleteMDMAppleBootstrapPackage` via
the API/UI, it only clears the row in `mdm_apple_bootstrap_packages`.
However when GitOps runs the next time, it compares the old team config,
which has a stale `macos_setup.bootstrap_package` config value. Which
forces it to call the same Delete method again. This PR adds the
defensive approach to gracefully handle a not found bootstrap package
when GitOps wants to delete it.
The reason the second run works, is that we only attempt to delete the
bootstrap package after we called SaveTeam with the new empty
`bootstrap_package` value. So next run sees it as empty and avoid
calling the Delete method.
_One question is if we want to add a more active approach on the delete
service method, which also handles updating the team config clearing out
this value? That would have prevented the cause, I think either keeping
only this layer, or doing both solutions is a good approach._
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* GitOps automation no longer fails on its first run after a bootstrap
package is deleted via the UI.
* Clearing a macOS bootstrap package (team or app config) now succeeds
even if the underlying package record is already missing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Allen Houchins
