Resolves#44088.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Linux as a label platform option.
* Linux labels now apply across supported distributions, including
Ubuntu, Debian, RHEL, CentOS, and generic Linux hosts.
* Updated platform names for improved clarity and consistency.
* **Bug Fixes**
* Improved platform matching so Linux labels apply consistently to
compatible hosts.
* Removed the obsolete Zorin platform option.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43544
This blueprint has drifted from the deployed `fleet-mcp` service in two
ways. `FLEET_LIVE_QUERY_REST_PERIOD=25s` is too short for a hosted
service aimed at a whole fleet: enough targeted hosts are asleep or
offline that `run_live_query` returns a near-empty result before they
check in, reading as "no data" rather than "still waiting." And `plan:
starter` disagrees with the Standard instance the service actually runs
on, so a blueprint sync risked silently downgrading it. Both fields
carry literal values, making them blueprint-managed, so a dashboard
override would be reverted on the next sync.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Configuration**
* Updated the hosted Fleet deployment to use the standard plan.
* Increased the live-query interval to 15 minutes.
* Clarified configuration guidance for Fleet server alignment and hosted
Fleet behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds press logos below "The road to AI in IT" report card.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a press coverage section to the AI in IT page.
* Displays logos for Apple World Today, Cybersecurity Insiders, and IT
Brief, linking to related articles.
* Added responsive layouts for desktop, tablet, and mobile screens.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
## Summary
- Adds a **Target hosts with labels** section to the Configuration
profiles guide (`articles/custom-os-settings.md`).
- Documents the three targeting modes (**Include all**, **Include any**,
**Exclude any**), that only one can be used per profile, and that
profiles are inherently platform-scoped (no label needed to keep a
profile on the right platform).
- Shows the flow across Fleet UI, GitOps (`labels_include_all` /
`labels_include_any` / `labels_exclude_any`, with a YAML example), and
the Fleet API.
- Bumps `publishedOn` to the current date. Author unchanged.
## Why
Prospects and customers hit this gap when trying to scope a profile to a
subset of hosts: the label include/exclude syntax lived only in the YAML
and REST API reference docs, with no walkthrough in the guide.
## Test plan
- [ ] Article renders correctly on the fleetdm.com preview
- [ ] All links resolve
- [ ] Meta tags present with updated `publishedOn` date
- [ ] Style guide compliance verified
Update the Manage Users API key display label from "API Key" to "API
key" for consistent capitalization in the UI.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated the API key label wording for consistency in the admin user
page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected the capitalization of the “Android Enterprise ID” tooltip
label in Android MDM settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes: https://github.com/fleetdm/fleet/actions/runs/30610975232
New run: https://github.com/fleetdm/fleet/actions/runs/30632404621.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security**
* Added vulnerability assessments for five CVEs affecting a transitive
XML-parsing dependency.
* Recorded that the application is not affected because vulnerable XML
processing cannot be controlled by an attacker.
* Updated security transparency records with supporting applicability
justifications.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **AOMEI Backupper Standard** as a Windows Fleet-maintained app. One
of the 11 apps split out of #48501 that failed the FMA validator; #50016
shipped the 6 that passed.
## Why it was failing
Install and detection were already fine on the SYSTEM-context Windows
runner — the validator installed it and osquery found `AOMEI Backupper`
8.4.0. **Uninstall** was the failure:
```
ERROR msg="Error uninstalling app: exit status 1" app="AOMEI Backupper Standard"
ERROR msg="Output: Uninstaller for 'AOMEI Backupper Standard' not found."
```
AOMEI unified the ARP `DisplayName` across editions around v7.4 — the
registry entry reads `AOMEI Backupper`, with no `Standard` suffix. The
uninstall script searched for the catalog name and matched nothing.
`unique_identifier` was already corrected to `AOMEI Backupper`; this
fixes the uninstall script to match.
## Notes
- **Edition matching.** `AOMEI Backupper` also matches the paid
Pro/Workstation/Server editions — AOMEI shares the DisplayName across
editions and no registry value distinguishes them. Detecting the free
edition specifically isn't possible from inventory.
- **Non-pinned installer URL.**
`https://www2.aomeisoftware.com/download/adb/AOMEIBackupperStd.exe` is a
"latest" URL, so the pinned SHA will drift when AOMEI ships a new build
until the FMA auto-update bumps it.
- x86-only installer, so it lands in `C:\Program Files (x86)`. The
validator's "no changes detected in `C:\Program Files`" line is an
expected warning, not a failure.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30383902487](https://github.com/fleetdm/fleet/actions/runs/30383902487)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries reviewed for name + publisher
correctness, `apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added **AOMEI Backupper Standard** (version **8.4.0.0.0**) to the
Windows software catalog, including verified installer download
(SHA-256).
- Introduced dedicated silent **install** and **uninstall** support,
with version gating and idempotent uninstall behavior when the app isn’t
present.
- Added a **new software icon** and updated the listing so the correct
icon now appears for this product.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **Gpg4win** as a Windows Fleet-maintained app. One of the 11 apps
split out of #48501 that failed the FMA validator; #50016 shipped the 6
that passed.
## Why it was failing
Same root cause as GNU Privacy Guard (#50025) — Gpg4win bundles GnuPG.
The install worked; the *script* never returned:
```
20:30:53 INFO msg="Executing install script..." app=Gpg4win
20:40:53 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later
20:40:53 INFO msg="New application detected at: C:\Program Files\Gpg4win"
```
Ten minutes on the nose is the validator's `executeScript` timeout.
**`Start-Process -Wait` waits for the process *and all of its
descendants***, and Gpg4win leaves `gpg-agent`, `dirmngr`, `keyboxd` and
`scdaemon` resident (plus Kleopatra), so `-Wait` never returns. The same
run left `gpg4win-5.0.2.exe` locked in the validator's temp dir,
confirming a live child process.
The install script now follows the pattern already established by
[`ollama_install.ps1`](ee/maintained-apps/inputs/winget/scripts/ollama_install.ps1):
start with `-PassThru` (no `-Wait`), wait on the installer process alone
with a 7-minute cap (below the caller's 10-minute script budget), poll
for the Add/Remove Programs entry, then stop the leftovers.
The uninstall script stops those processes up front (they hold file
locks that make the uninstall fail), uses NSIS's `_?=<dir>` switch so
the uninstaller runs in place rather than relaunching itself detached
from `%TEMP%`, and polls the ARP key to confirm removal.
## Notes
- **Versioned ARP name.** The registry `DisplayName` is `Gpg4win
(5.0.2)`, so the input uses `fuzzy_match_name` and the exists query is
`name LIKE 'Gpg4win %'`. The uninstall script matches the same prefix.
- x86-only installer. Publisher `The Gpg4win Project`.
- Ships a new catalog icon and website asset.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30384125610](https://github.com/fleetdm/fleet/actions/runs/30384125610)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries reviewed for name + publisher
correctness, `apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added Gpg4win as a supported Windows application.
- Added Gpg4win version 5.0.2 with Security categorization.
- Added a Gpg4win icon to the software interface.
- Introduced silent install and uninstall support with process cleanup,
timeouts, and registry-based verification to confirm install/removal
outcomes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#50285
## Summary
- Restore the `All Hosts` and Apple platform built-in label memberships
in the same transaction that clears stale host state during Automated
Device Enrollment (ADE).
- Backfill missing built-in memberships for existing macOS, iOS, and
iPadOS hosts.
- Add regression coverage confirming that an iPadOS update declaration
remains targeted and reaches verified status after the enrollment reset.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one host's records do not affect another)
- [ ] QA'd all new/changed functionality manually
Automated verification:
```sh
MYSQL_TEST=1 go test -run 'TestMDMApple/MDMAppleResetOnReenrollment' ./server/datastore/mysql
MYSQL_TEST=1 go test -run TestUp_20260731100711 ./server/datastore/mysql/migrations/tables
MYSQL_TEST=1 go test -run 'TestIntegrationsMDM/TestIPadOSUpdateDeclarationAfterMDMReset' ./server/service
go test -run TestMDMTokenUpdateResetOnReenrollment ./server/service
go vet ./server/datastore/mysql ./server/service
go build ./server/datastore/mysql/migrations/...
make test-schema
```
## Database migrations
- [x] Checked schema for all modified tables for columns that
auto-update timestamps during migration.
- [x] Confirmed that timestamp behavior is acceptable and will not cause
unwanted side effects. The migration inserts only missing memberships
and leaves existing membership timestamps unchanged.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Apple devices now retain their built-in label memberships after
Automated Device Enrollment or MDM reset.
* Label-scoped profiles, software, and operating system updates can now
continue to be delivered after a reset.
* Platform-specific memberships are restored for macOS, iOS, and iPadOS
devices, including applicable hosts with unspecified platforms.
* iPadOS update declarations now reconcile successfully after an MDM
reset.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
It's not used by CI or tests. Probably a leftover from when we tested
some Prometheus integration manually.
While I was at it fixed some typos on the `writing.md` file.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed the Prometheus monitoring service from the local development
environment.
* Removed the associated metrics scraping configuration for the
application.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Restricted fleet deletion to users with global write permissions,
including global administrators and GitOps.
* Corrected team deletion authorization to require global write access.
* Prevented global technicians, team technicians, and observer-level
users from deleting teams.
* Updated authorization behavior to consistently enforce the required
access level.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Manually QA'd the change (handbook-only: previewed the Markdown
rendering)
## Details
Adds a "Let's get you set up" calls section to the 🚂 Go-To-Market
operations handbook page, documenting:
- Ownership: Dave Siederer (@ds0x) on the Solutions Consulting team owns
these calls. Scheduling is tied to his calendar, and he coordinates
coverage when he is unable to attend.
- Staffing: every call includes a Solutions Consultant and a Solutions
Specialist.
- Schedule: every Friday at 10 AM and 2 PM US Central time.
The section is placed after the "Solution Specialist inbound lead
follow-up" process and before "Proof of value (POV)", matching the
meeting-booking stage of the funnel. No product code changes, so no
changes file is needed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a new customer testimonial entry, including the quote, author
name and job title, profile image, LinkedIn link, and product category
tags.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#49966
Adds the schema for custom DDM activations (parent story #48222).
- **Creates `mdm_apple_ddm_activations`** — stores the activation JSON
as-is (`mediumtext`, so the generated `token` column hashes the exact
stored bytes) with a `declaration_uuid` FK to `mdm_apple_declarations`
that cascades on delete.
- **Extends `mdm_configuration_profile_variables`** with
`apple_ddm_activation_uuid` so activations can carry Fleet variables
(needed by #49970).
- **Adds `activation_updated_at`** to `host_mdm_apple_declarations` so a
changed activation regenerates the declaration's effective token,
mirroring `variables_updated_at` / `assets_updated_at`.
- **Drops `mdm_apple_declaration_activation_references`** — created with
the original DDM tables in `20240327115530_AddDDMTables.go`, never
written to by any code path, so it is empty in every deployment.
### Deviations from the SQL in #49966
The `declaration_uuid` FK is the one addition, [confirmed with
@MagnusHJensen](https://github.com/fleetdm/fleet/issues/49966): it keeps
the 1:1 lifecycle enforced by the database rather than requiring cleanup
in every delete path. `configuration_identifier` is kept alongside it
for validation and DDM serving. Its unique key doubles as the FK's
backing index.
The rest are corrections needed for the specced SQL to work, all
following the precedent in `20260409153715_AddDDMVariablesSupport.go`:
- **`ck_mdm_configuration_profile_variables_exactly_one` is dropped and
re-added** to count the new column. That constraint requires exactly one
owner column to be non-null; adding a seventh without updating it means
any row setting `apple_ddm_activation_uuid` sums to 0, fails the check,
and is rejected.
- **`UNIQUE (apple_ddm_activation_uuid, fleet_variable_id)` added** to
match the six existing owner columns. That table's write path is `INSERT
... ON DUPLICATE KEY UPDATE`, which needs a unique key to collide on.
- **`activation_updated_at` is `DATETIME(6)`, not `TIMESTAMP(6)`** — its
siblings are `datetime(6)` and `EffectiveDDMToken` formats them into the
token string, so `TIMESTAMP`'s session-timezone conversion on read would
change tokens and re-push declarations to every host.
- **`team_id` gets `DEFAULT '0'`** to match `mdm_apple_declarations`,
where 0 is Unassigned.
### Note for #49970
`declaration_uuid` is `NOT NULL`, so the upload path must populate it in
addition to `configuration_identifier`. The declaration UUID prefix has
no separator (`MDMAppleDeclarationUUIDPrefix = "d"`, 1 char + 36-char
UUID = the full `varchar(37)`).
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
No changes file: this sub-task adds schema only and ships no
user-visible behavior.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
`TestUp_20260729115013` covers: the stale table is present before and
gone after; pre-existing `mdm_configuration_profile_variables` rows
survive the check constraint replacement (that `ADD CONSTRAINT`
revalidates every existing row); an activation attaches to a declaration
and gets its generated token; the 1:1 unique key and the FK both reject
bad inserts; a variable row binds to an activation (the case the old
constraint would have rejected); the constraint still rejects two-owner
and zero-owner rows; and deleting the declaration cascades to the
activation and through it to the activation's variable rows.
Also ran the full migrations suite (`MYSQL_TEST=1 go test
./server/datastore/mysql/migrations/...`) to confirm no other migration
is disturbed, and verified the regenerated `schema.sql` diff contains
only changes from this migration.
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
Neither modified table has an `ON UPDATE CURRENT_TIMESTAMP` column, so
no rows have their timestamps touched.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for Apple DDM custom activations.
* Added activation-specific tokens and timestamps to support reliable
declaration updates.
* Enabled configuration variables to be associated with a specific
activation.
* Added validation to prevent duplicate or invalid activation
associations.
* Activations and related settings are now automatically removed when
their declaration is deleted.
* **Tests**
* Added coverage for activation creation, uniqueness, validation,
associations, token generation, and cascading cleanup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves #
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
Updated stat to lead with 87% and fixed wording to match actual data
from the report.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Content Updates**
* Updated the AI in IT report statistic to state that 87% of
organizations manage devices with multiple tools.
* Clarified that 13% use a single platform.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Added a new landing page: /capex-savings
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a CapEx savings page available at `/capex-savings`.
* Added guidance on device refresh cycles, hardware performance, and
recommended replacement timing.
* Added a savings calculator for device cost, refresh cycle, and fleet
size, with estimated annual savings and assumptions.
* Added responsive layouts, imagery, calls to action, and
mobile-friendly calculator controls.
* Added supporting content on refresh recommendations, Fleet hardware
performance, and device lifecycle planning.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Brave Browser for macOS to version 151.1.93.129.
* Updated IBM Semeru JRE 8 for Windows to version 8.0.502.0.
* Updated NordPass for macOS to version 7.9.3.
* Refreshed installer information, checksums, and version detection for
the updated releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Refreshed Windows packages for 1Password, Claude, Cursor, GitKraken,
Node.js, OBS Studio, VirtualBox, and IBM Semeru JDK/JRE releases.
- Refreshed macOS packages for Arc, Beeper, BrickLink Studio, ChatGPT,
Firefox Nightly, Kiro CLI, Melodics, Azure Storage Explorer, Nextcloud
Talk, Spokenly, and Warp.
- Updated installer metadata, version detection, download sources, and
integrity checks to support the latest releases.
- Updated uninstall handling where required for 1Password and Node.js.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A
# What this does
Removes the **Captin** software icon: the `Captin.tsx` fallback icon
component and its
`SOFTWARE_NAME_TO_ICON_MAP` entry.
Captin is deprecated and is being removed as a Fleet-maintained app. Its
manifest fails
the FMA validator because the download at the pinned URL now installs
2.0.1 while
Homebrew still declares 1.3.1:
```
level=INFO msg="Looking for app: Captin, version: 1.3.1" app=Captin
level=INFO msg="Found app: 'Captin' at /Applications/Captin.app, Version: 2.0.1, Bundled Version: 203"
level=ERROR msg="App version '1.3.1' was not found by osquery" app=Captin
```
Split out of the FMA removal so the frontend change can be reviewed on
its own.
> [!NOTE]
> **Merge order.** The FMA removal (input, output manifest, and
`apps.json` entry) is in a
> separate PR. Merging this one first leaves the Captin FMA without a
fallback icon until
> that PR lands, so it should merge after — or at the same time as — the
FMA removal.
Verified nothing else references `Captin` after the removal. The one
remaining mention in
the repo is a row in `cmd/osquery-perf/software-library/software.sql`,
which is a
load-test software inventory corpus rather than an FMA reference, so it
is left alone.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
No changes file: this is not a user-visible change on its own, and
matches how other FMA
catalog/icon PRs ship (e.g. #50028, #50024).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Removed the obsolete Captin icon from the software listings.
* Prevented the retired icon from appearing in software name mappings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#50097
## Summary
FMA auto-update preserves an admin-customized install script by
comparing the active script against the new manifest's, but FMA scripts
hardcode the versioned installer filename, so a routine version bump
looked like an edit and the old script (old filename) was kept against
the newly downloaded installer, and the install failed. The fix
neutralizes the installer filename in both scripts before comparing
(mirroring the existing uninstall `$PACKAGE_ID` handling), so a
filename-only difference adopts the new script while a genuine edit is
still preserved.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
(`changes/50097-fma-auto-update-keeps-stale-install-script`).
## Testing
- [x] Added/updated automated tests (adopt-on-version-bump regression +
preserve-genuine-edit counterpart).
- [x] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed Fleet-maintained app auto-updates that could keep an outdated
install script after downloading a newer version, causing install
failures.
* Improved install-script change detection by ignoring version-only
installer filename differences.
* Continued to preserve administrator-customized install scripts when
updates change more than just the installer filename.
* **Tests**
* Added and expanded coverage for installer-script normalization and
auto-update install-script selection behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#50070
The "YAML docs" link in the GitOps callout on the custom-package flows
pointed at the unregistered slug `learn-more-about/software-yaml`,
returning a 404. Corrected to the registered
`learn-more-about/yaml-software` (302 →
`docs/configuration/yaml-files#software`). The link lives in the shared
`GitOpsCustomPackageBanner`, so this fixes it in both places it renders:
the **Add software → Custom package** page and the **Add package** modal
on the software title details page. Also updated the two unit tests that
asserted the old slug.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the GitOps custom package “YAML docs” link to direct users to
the new YAML software documentation page.
* **Bug Fixes**
* Corrected YAML documentation links in the custom package banner and
package addition modal.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes:
https://github.com/fleetdm/fleet/actions/runs/30519842615/job/90797961257.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved end-to-end test packaging reliability on macOS by adding a
retry mechanism with delays and failing after repeated unsuccessful
attempts.
* Updated end-to-end test environment hostname setup on Ubuntu to use a
transient hostname derived from the target architecture.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- updated the quote shown on the /contact page
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Content Updates**
* Updated the contact page testimonial with refreshed customer feedback
and revised attribution.
* Updated the testimonial’s company logo, as well as the author
portrait, name, and job title.
* **Style**
* Adjusted the testimonial profile image styling to render as a fully
circular image.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
…orrect URL.
Fixed a broken embedded link in the README. The link was pointing to
[old/broken destination] and now correctly points to the correct
destination.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#50056
## Summary
macOS FMA install scripts never checked the exit code of the install
command (`installer -pkg` / `cp -R`) — the script's last statement is
always `relaunch_application`, which exits 0 — so a failed install
exited 0 and Fleet reported it installed.
**Generated scripts.** The generator now propagates failure: both
`installer -pkg` variants end with `|| exit $?`, and the `cp -R` path
exits non-zero on a failed copy, removes the partial copy (so a failed
fresh install isn't inventoried as the new version), and restores the
app it moved aside. Regenerated `outputs/` for non-frozen generated apps
are produced by the `ingest-maintained-apps` job, so they aren't
committed here.
**Custom scripts.** 9 of the 18 custom input scripts had the same bug
and are fixed with the same pattern: Google Chrome, Zoom, Microsoft
Edge, GitHub Desktop, Webex, Cycling '74 Max, Pd, Grammarly Desktop, and
P4V. The DMG-based ones also now fail before removing/moving the
existing app when the mount or staging copy fails, so a bad download
can't leave a host with nothing. Their `outputs/*/darwin.json` are
updated in the same commit (script content + recomputed 8-char sha256
ref, versions untouched), following the precedent of #49033. Docker
Desktop (`set -euo pipefail`), 1Password/Slack/LogiTune (installer is
the last statement), and the rest already propagated errors.
**Frozen apps.** The ingest job never rewrites frozen outputs, so the 10
frozen apps with generated scripts (adobe-acrobat-pro, comet, evernote,
firealpaca, keeper-password-manager, nvidia-geforce-now, pritunl,
vnc-viewer, wins, worksheet-crafter) had the fix applied directly to
their published `darwin.json` scripts — the exact text the current
generator would emit, with pinned versions/URLs/hashes untouched. The
11th frozen app (logi-options+) uses a custom script that was already
correct and in sync.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
(`changes/50056-fma-install-scripts-ignore-errors`).
- [x] Untrusted data interpolated into shell scripts is validated
against shell metacharacters. (No new untrusted interpolation: the guard
reuses the same curated cask-derived name the adjacent lines already
interpolate.)
## Testing
- [x] Added/updated automated tests (three generator tests: pkg,
pkg-with-choices, cp-R restore — the last now pins the exact emitted
block).
- [x] All 19 updated output manifests validated: embedded scripts pass
`bash -n`, refs match `sha256(script)[:8]`, refs map stays key-sorted
like Go's encoder.
- [x] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* macOS Fleet-maintained app installations now fail fast when
installers, DMG extraction/mounting, or app copy steps error.
* If an upgrade fails, the system removes any partial app and restores
the previously installed version when available.
* Improved robustness during app staging/copying, including safer
handling of paths with spaces or special characters.
* **Tests**
* Added unit coverage to verify installer failure propagation and
rollback behavior.
* **Documentation**
* Clarified that the install-script error handling applies to both
generated and custom scripts, including already-published frozen apps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Proton Drive for Windows to version 3.0.4.
* Refreshed the installer download reference and checksum verification.
* Improved uninstall behavior by adding a pre-uninstall stop for running
Proton Drive processes and introducing a timeout-based “watchdog” to
prevent the uninstaller from hanging.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
**Related issues:** Resolves#50068, Resolves#50106, Resolves#50107,
Resolves#50108, Resolves#50110, Resolves#50114
Follow-on fixes from QA of #41470 (Python script-only packages):
- Software-installer validation errors are action-neutral, so the Add
and Edit flows each show the correct single verb, and the
unsupported-file error names a content/format mismatch instead of
blaming the extension (#50068, #50107).
- `.py` packages accept `setup_experience_platform` (`darwin`/`linux`),
matching `.sh` (#50106).
- A failed-to-run install script (exit code `-1`) now renders a
diagnostic instead of empty output, and orbit surfaces the underlying
execve error (#50108).
- The install-rejection message for `.sh`/`.py` packages says "macOS and
Linux hosts" instead of "linux" (#50110).
- Orbit writes each script's temp file with an extension matching its
shebang (`.py`/`.sh`/`.ps1`), so tracebacks reference the right file
type (#50114).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes.
- [x] Verified compatibility with the latest released version of Fleet
(orbit-only change; the server↔agent `SoftwareInstallDetails` contract
is unchanged).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved installer validation and rejection messaging for
unsupported/invalid package contents (including correcting “add” vs
“edit” wording and avoiding duplicated phrasing).
* Added clearer diagnostics when install scripts fail to start
(including empty output cases).
* Corrected handling of script-only packages so Python scripts use the
proper script type/extension, reducing misleading tracebacks.
* Updated platform availability messaging so `.sh`/`.py` packages
display macOS+Linux support.
* **New Features**
* Python script-only packages can now specify macOS and Linux setup
experience platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#48416
When adding a Fleet-maintained app, a large-installer download that's
canceled or times out now returns a clear message pointing at the likely
proxy/load-balancer timeout, instead of a raw `context canceled`.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved error messages when adding Fleet-maintained apps times out or
is canceled during large installer downloads.
* Added clearer guidance for configuring server, proxy, and load
balancer timeouts.
* Properly handles additional timeout and upstream cancellation
responses, including HTTP 408, 499, and 504.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The host transfer endpoint recorded raw requested host IDs in the
transferred_hosts activity verbatim, letting an authorized user inject
fabricated IDs into the audit trail. Derive the activity's host IDs and
names only from hosts that actually exist, and skip the activity when
none exist.
Reset tokens are base64url (case-sensitive) but the
password_reset_requests.token column used case-insensitive
utf8mb4_unicode_ci, so a case-mutated token copy still matched. Switch
the column to utf8mb4_bin for byte-exact comparison.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Evernote for Windows to version 11.27.5.
* Updated Granola for Windows to version 7.452.1.
* Updated Postman for Windows to version 12.21.7.
* Updated Trezor Suite for macOS to version 26.7.3.
* Refreshed installer links and verification checksums for each release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added availability for the latest releases of numerous maintained
applications across Windows and macOS.
* Updated applications include Chrome, Firefox Nightly, Postman, Signal,
Notion, Podman Desktop, Draw.io, CMake, JDK/JRE, and many others.
* **Bug Fixes**
* Refreshed installer links, version detection, and package verification
data to ensure updates install and validate correctly.
* Updated app-specific installation handling where required for newer
releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA — fixing a failing scheduled "Update
Fleet-maintained apps" run.
Removes the **macOS** Dynalist Fleet-maintained app. The Windows
(winget) FMA is unaffected and stays.
## Why
The `dynalist` cask was deleted from homebrew-cask on 2026-07-30
([commit
`adac21ffc4`](https://github.com/Homebrew/homebrew-cask/commit/adac21ffc401)),
completing Homebrew's full deprecation lifecycle:
- `deprecate!` 2024-07-29, `because: :unmaintained`
- `disable!` 2025-07-29
- cask file removed 2026-07-30
`https://formulae.brew.sh/api/cask/dynalist.json` now returns 404, so
the scheduled ingester panics:
```
{"level":"INFO","msg":"ingesting homebrew app","name":"Dynalist"}
panic: ingesting homebrew app: app not found in brew API
```
Marking the app `"frozen": true` does **not** fix this — the ingester
fetches the cask JSON before the frozen flag is consulted
(`cmd/maintained-apps/main.go`), so removal is the only fix for a dead
upstream cask.
## What changed
Deletions only (39 lines, no additions):
- `ee/maintained-apps/inputs/homebrew/dynalist.json` — deleted
- `ee/maintained-apps/outputs/dynalist/darwin.json` — deleted
- the `dynalist/darwin` entry in `ee/maintained-apps/outputs/apps.json`
— removed; `dynalist/windows` remains
## Deliberately kept
Because the Windows FMA still needs them:
- `ee/maintained-apps/outputs/dynalist/windows.json`,
`ee/maintained-apps/inputs/winget/dynalist.json`, and its
install/uninstall scripts
- `frontend/pages/SoftwarePage/components/icons/Dynalist.tsx` and its
`dynalist:` mapping in `icons/index.ts` — the map is keyed by lowercased
app name and is shared across platforms
- `website/assets/images/app-icon-dynalist-60x60@2x.png` — keyed by slug
token, still serving the Windows entry in the app library
## Note for reviewers
Hosts that currently have the macOS Dynalist FMA installed will lose the
maintained-app entry on the next sync. This matches the behavior of
prior FMA removals (Nocturnal #50050, Dell Display Manager #47420,
Messenger #46541).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
Not applicable — consistent with prior FMA removal PRs, which do not add
a changes file.
## Testing
- [x] QA'd all new/changed functionality manually
Verified that `ee/maintained-apps/outputs/apps.json` still parses as
valid JSON (1381 apps) and that `Dynalist` now resolves to only
`dynalist/windows`. Confirmed the 404 against the brew API and read the
pre-removal cask at `adac21ffc4~1` to establish the deprecation reason.
`git diff` confirms the change is deletions-only.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Standardized websocket error responses when requested campaigns are
unavailable.
* Prevented campaign existence from being inferred through differing
error messages.
* Improved consistency for both nonexistent campaigns and campaigns
inaccessible to the current user.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Dante Catalfamo
