fleet

Author	SHA1	Message	Date
Lucas Manuel Rodriguez	0dc8c382c5	Add 'linux' as platform for labels (#50270 ) Resolves #44088. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [X] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added Linux as a label platform option. * Linux labels now apply across supported distributions, including Ubuntu, Debian, RHEL, CentOS, and generic Linux hosts. * Updated platform names for improved clarity and consistency. * Bug Fixes * Improved platform matching so Linux labels apply consistently to compatible hosts. * Removed the obsolete Zorin platform option. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-31 15:02:57 -03:00
Allen Houchins	c3474e7a50	Standardize API key label casing (#48978 ) Update the Manage Users API key display label from "API Key" to "API key" for consistent capitalization in the UI. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit Style * Updated the API key label wording for consistency in the admin user page. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-31 10:32:09 -05:00
RachelElysia	70a802360c	Frontend: document form validation rules and error copy register (#49041 )	2026-07-31 08:14:38 -07:00
Steven Palmesano	f2a6dd04ef	Fix "ID" capitalization (#49130 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Corrected the capitalization of the “Android Enterprise ID” tooltip label in Android MDM settings. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-31 17:13:37 +02:00
kitzyandAllen Houchins	7837b8ec8f	Add AOMEI Backupper Standard as a Windows Fleet-maintained app (#50021 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: #50020 # What this does Adds AOMEI Backupper Standard as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing Install and detection were already fine on the SYSTEM-context Windows runner — the validator installed it and osquery found `AOMEI Backupper` 8.4.0. Uninstall was the failure: ``` ERROR msg="Error uninstalling app: exit status 1" app="AOMEI Backupper Standard" ERROR msg="Output: Uninstaller for 'AOMEI Backupper Standard' not found." ``` AOMEI unified the ARP `DisplayName` across editions around v7.4 — the registry entry reads `AOMEI Backupper`, with no `Standard` suffix. The uninstall script searched for the catalog name and matched nothing. `unique_identifier` was already corrected to `AOMEI Backupper`; this fixes the uninstall script to match. ## Notes - Edition matching. `AOMEI Backupper` also matches the paid Pro/Workstation/Server editions — AOMEI shares the DisplayName across editions and no registry value distinguishes them. Detecting the free edition specifically isn't possible from inventory. - Non-pinned installer URL. `https://www2.aomeisoftware.com/download/adb/AOMEIBackupperStd.exe` is a "latest" URL, so the pinned SHA will drift when AOMEI ships a new build until the FMA auto-update bumps it. - x86-only installer, so it lands in `C:\Program Files (x86)`. The validator's "no changes detected in `C:\Program Files`" line is an expected warning, not a failure. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) passes* on the SYSTEM-context Windows runner — [run 30383902487](https://github.com/fleetdm/fleet/actions/runs/30383902487) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Added AOMEI Backupper Standard (version 8.4.0.0.0) to the Windows software catalog, including verified installer download (SHA-256). - Introduced dedicated silent install and uninstall support, with version gating and idempotent uninstall behavior when the app isn’t present. - Added a new software icon and updated the listing so the correct icon now appears for this product. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Allen Houchins <allenhouchins@mac.com>	2026-07-31 09:58:02 -05:00
kitzy	43bff98998	Add Gpg4win as a Windows FMA (#50026 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: #50020 # What this does Adds Gpg4win as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing Same root cause as GNU Privacy Guard (#50025) — Gpg4win bundles GnuPG. The install worked; the script never returned: ``` 20:30:53 INFO msg="Executing install script..." app=Gpg4win 20:40:53 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later 20:40:53 INFO msg="New application detected at: C:\Program Files\Gpg4win" ``` Ten minutes on the nose is the validator's `executeScript` timeout. *`Start-Process -Wait` waits for the process and all of its descendants*, and Gpg4win leaves `gpg-agent`, `dirmngr`, `keyboxd` and `scdaemon` resident (plus Kleopatra), so `-Wait` never returns. The same run left `gpg4win-5.0.2.exe` locked in the validator's temp dir, confirming a live child process. The install script now follows the pattern already established by [`ollama_install.ps1`](ee/maintained-apps/inputs/winget/scripts/ollama_install.ps1): start with `-PassThru` (no `-Wait`), wait on the installer process alone with a 7-minute cap (below the caller's 10-minute script budget), poll for the Add/Remove Programs entry, then stop the leftovers. The uninstall script stops those processes up front (they hold file locks that make the uninstall fail), uses NSIS's `_?=<dir>` switch so the uninstaller runs in place rather than relaunching itself detached from `%TEMP%`, and polls the ARP key to confirm removal. ## Notes - Versioned ARP name.** The registry `DisplayName` is `Gpg4win (5.0.2)`, so the input uses `fuzzy_match_name` and the exists query is `name LIKE 'Gpg4win %'`. The uninstall script matches the same prefix. - x86-only installer. Publisher `The Gpg4win Project`. - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) passes* on the SYSTEM-context Windows runner — [run 30384125610](https://github.com/fleetdm/fleet/actions/runs/30384125610) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Added Gpg4win as a supported Windows application. - Added Gpg4win version 5.0.2 with Security categorization. - Added a Gpg4win icon to the software interface. - Introduced silent install and uninstall support with process cleanup, timeouts, and registry-based verification to confirm install/removal outcomes. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-31 09:57:32 -05:00
Allen Houchins	347fa6ca55	Remove Captin software icon (#50277 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: N/A # What this does Removes the Captin software icon: the `Captin.tsx` fallback icon component and its `SOFTWARE_NAME_TO_ICON_MAP` entry. Captin is deprecated and is being removed as a Fleet-maintained app. Its manifest fails the FMA validator because the download at the pinned URL now installs 2.0.1 while Homebrew still declares 1.3.1: ``` level=INFO msg="Looking for app: Captin, version: 1.3.1" app=Captin level=INFO msg="Found app: 'Captin' at /Applications/Captin.app, Version: 2.0.1, Bundled Version: 203" level=ERROR msg="App version '1.3.1' was not found by osquery" app=Captin ``` Split out of the FMA removal so the frontend change can be reviewed on its own. > [!NOTE] > Merge order. The FMA removal (input, output manifest, and `apps.json` entry) is in a > separate PR. Merging this one first leaves the Captin FMA without a fallback icon until > that PR lands, so it should merge after — or at the same time as — the FMA removal. Verified nothing else references `Captin` after the removal. The one remaining mention in the repo is a row in `cmd/osquery-perf/software-library/software.sql`, which is a load-test software inventory corpus rather than an FMA reference, so it is left alone. # Checklist for submitter - [x] QA'd all new/changed functionality manually No changes file: this is not a user-visible change on its own, and matches how other FMA catalog/icon PRs ship (e.g. #50028, #50024). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Removed the obsolete Captin icon from the software listings. * Prevented the retired icon from appearing in software name mappings. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-30 23:06:34 -05:00
Carlo	e6c8c9a2bf	Fix YAML docs link 404 in custom package GitOps callout (slug reversed) (#50267 ) Related issue: Resolves #50070 The "YAML docs" link in the GitOps callout on the custom-package flows pointed at the unregistered slug `learn-more-about/software-yaml`, returning a 404. Corrected to the registered `learn-more-about/yaml-software` (302 → `docs/configuration/yaml-files#software`). The link lives in the shared `GitOpsCustomPackageBanner`, so this fixes it in both places it renders: the Add software → Custom package page and the Add package modal on the software title details page. Also updated the two unit tests that asserted the old slug. # Checklist for submitter ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Documentation * Updated the GitOps custom package “YAML docs” link to direct users to the new YAML software documentation page. * Bug Fixes * Corrected YAML documentation links in the custom package banner and package addition modal. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-30 17:30:21 -04:00
Carlo	a442d7af3a	Python script-only packages: follow-on QA fixes (#50143 ) Related issues: Resolves #50068, Resolves #50106, Resolves #50107, Resolves #50108, Resolves #50110, Resolves #50114 Follow-on fixes from QA of #41470 (Python script-only packages): - Software-installer validation errors are action-neutral, so the Add and Edit flows each show the correct single verb, and the unsupported-file error names a content/format mismatch instead of blaming the extension (#50068, #50107). - `.py` packages accept `setup_experience_platform` (`darwin`/`linux`), matching `.sh` (#50106). - A failed-to-run install script (exit code `-1`) now renders a diagnostic instead of empty output, and orbit surfaces the underlying execve error (#50108). - The install-rejection message for `.sh`/`.py` packages says "macOS and Linux hosts" instead of "linux" (#50110). - Orbit writes each script's temp file with an extension matching its shebang (`.py`/`.sh`/`.ps1`), so tracebacks reference the right file type (#50114). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes. - [x] Verified compatibility with the latest released version of Fleet (orbit-only change; the server↔agent `SoftwareInstallDetails` contract is unchanged). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Improved installer validation and rejection messaging for unsupported/invalid package contents (including correcting “add” vs “edit” wording and avoiding duplicated phrasing). * Added clearer diagnostics when install scripts fail to start (including empty output cases). * Corrected handling of script-only packages so Python scripts use the proper script type/extension, reducing misleading tracebacks. * Updated platform availability messaging so `.sh`/`.py` packages display macOS+Linux support. * New Features * Python script-only packages can now specify macOS and Linux setup experience platforms. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-30 14:40:24 -04:00
Carlo	294a172d11	Clarify maintained app download timeout errors (#50104 ) Related issue: Resolves #48416 When adding a Fleet-maintained app, a large-installer download that's canceled or times out now returns a clear message pointing at the likely proxy/load-balancer timeout, instead of a raw `context canceled`. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Improved error messages when adding Fleet-maintained apps times out or is canceled during large installer downloads. * Added clearer guidance for configuring server, proxy, and load balancer timeouts. * Properly handles additional timeout and upstream cancellation responses, including HTTP 408, 499, and 504. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-30 14:39:56 -04:00
Juan Fernandez	554c62e470	Add apps installed through Windows app store to software inventory Resolves #14717 Add apps installed through Windows app store to software inventory	2026-07-30 14:12:55 -04:00
Noah Talerman	3d3912554e	Fix help text for Apple OS target form (#50221 ) - Remove period because the "Learn more" link comes right after: <img width="645" height="111" alt="Screenshot 2026-07-30 at 8 42 32 AM" src="https://github.com/user-attachments/assets/1b5b45e6-0276-43bd-ba8b-99c1c293b71b" />	2026-07-30 08:59:32 -07:00
RachelElysia	39cbfeda30	Fleet UI: Move Add-entity buttons out of table headers (#50102 )	2026-07-30 07:17:55 -07:00
Magnus Jensen	a1b35aeb23	fix icon text gap across product (#50209 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #48217 This does update a couple of places, but I checked and it should only be for Status indicators. Figma spec with 4px rather than 8px: https://www.figma.com/design/gxvU745LfOdkE9AuRg64wi/%F0%9F%A7%A9-Product-design-system?node-id=858-23&t=QwTqGmpK0V3inArL-0 <img width="1119" height="407" alt="image" src="https://github.com/user-attachments/assets/8cae52d6-dbb9-4b8d-80d6-1a899790ad82" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit Bug Fixes * Reduced the spacing between icons and text for a more compact, consistent layout across the product. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-30 14:21:08 +02:00
Lucas Manuel Rodriguez	1397531199	Authorize packs before returning them in query responses (#50148 ) - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Query responses now include pack details only when the requester has permission to view them. * Prevented pack metadata from being disclosed across fleets when query names overlap. * Corrected target selection labels and empty-state messaging for fleet-based targets. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 13:35:47 -03:00
Magnus Jensen	451319b384	Hide Account Provisioning on Fleet free (#50130 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #50122 <img width="730" height="148" alt="image" src="https://github.com/user-attachments/assets/e7a803bd-b50d-404f-8af2-9fa32cc34772" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. (Unreleased bug) - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features* - Account provisioning settings now indicate when the feature is included with Fleet Premium. - Premium-tier accounts continue to see the full provisioning configuration and save controls. - Bug Fixes - Improved license-tier handling so account provisioning displays the appropriate experience for free and premium plans. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 14:31:36 +02:00
kitzy	f4d7064f9a	Add Rtools as a Windows FMA (#50028 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: #50020 # What this does Adds Rtools as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing The install script hit the validator's 10-minute `executeScript` cap exactly: ``` 20:41:22 INFO msg="Executing install script..." app=Rtools 20:51:22 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later 20:51:22 WARN msg="failed to remove rtools45-6768-6492.exe: ... Access is denied." ``` The locked installer in the temp dir shows a process was still alive. `Start-Process -Wait` waits for the process and all of its descendants, which is the same root cause as the other install-timeout apps in this batch. Rtools is also the one app in the batch where a slow unpack is a plausible second cause — the installer is ~460 MB and expands a full toolchain. So rather than assume, the script now waits on the installer process alone with a 480s cap (under the caller's 10-minute budget) and logs elapsed time plus Add/Remove Programs registration state on every poll. If the cap is reached: - registered → the install finished and only a lingering child remains, so it stops that process and succeeds; - not registered → the unpack genuinely didn't finish, and it fails with that stated explicitly. Either way the CI log now says which one happened instead of just timing out. ## Notes - Identity verified against the installer, not winget metadata. The setup stub's PE version resource reads `CompanyName: The R Foundation`, `ProductName: Rtools`. Inno derives `VersionInfoCompany` from `AppPublisher`, so the ARP publisher is `The R Foundation` — which is what the exists query uses. - Versioned ARP name. The registry `DisplayName` is `Rtools 4.5 (6768-6492)`, so the input uses `fuzzy_match_name` and the exists query is `name LIKE 'Rtools %'`. - Installs to `C:\rtools45`, not Program Files, so the validator's "no changes detected in `C:\Program Files`" line is an expected warning, not a failure. - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) passes* on the SYSTEM-context Windows runner — [run 30384196159](https://github.com/fleetdm/fleet/actions/runs/30384196159) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries checked against the installer's PE version resource, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added Rtools as a supported Windows application. * Added installation and uninstallation support with silent setup and silent removal. * Added Rtools version metadata, installer verification, and Developer tools categorization. * Added a dedicated Rtools icon for software listings. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 23:01:31 -05:00
kitzy	c61632305a	Add Logitech Unifying Software as a Windows FMA (#50024 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: #50020 # What this does Adds Logitech Unifying Software as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing Install and detection were already fine on the SYSTEM-context Windows runner — osquery found `Logitech Unifying Software 2.52` at `C:\Program Files\Common Files\LogiShrd\Unifying`. Uninstall was the failure: ``` 20:40:55 INFO msg="Executing uninstall script for app..." 20:40:57 INFO msg="Found app: 'Logitech Unifying Software 2.52' ... Version: 2.52.33" 20:40:57 ERROR msg="App still present after uninstall (expected no match for version '2.52.33' in programs)" ``` Two seconds start to finish — the uninstaller hadn't actually done anything yet. This is standard NSIS behavior: the uninstaller copies itself to `%TEMP%` and relaunches, so the process the script starts exits almost immediately while the real work happens in a detached child. The fix passes NSIS's `_?=<dir>` switch, which runs the uninstaller in place instead of relaunching, making it synchronous. It has to be the last argument and unquoted, so the script builds a single argument string rather than an array (PowerShell would quote an element containing spaces). A bounded poll on the ARP key follows as a backstop, and the script fails explicitly if the entry is still there. ## Notes - Versioned ARP name. The registry `DisplayName` is `Logitech Unifying Software 2.52`, so the input uses `fuzzy_match_name` and the exists query is `name LIKE 'Logitech Unifying Software %'`. The uninstall script matches the same prefix rather than an exact string. - Publisher `Logitech` confirmed against the winget locale manifest. - Installs under `C:\Program Files\Common Files`, so the validator's "no changes detected in `C:\Program Files`" line is an expected warning, not a failure. - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) passes* on the SYSTEM-context Windows runner — [run 30384010810](https://github.com/fleetdm/fleet/actions/runs/30384010810) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added Logitech Unifying Software to the Windows software catalog, including the version 2.52.33 download, checksum, and install-detection metadata. * Implemented silent installation and a robust, registry-aware uninstall flow (with process lock handling and timeout behavior). * Added a dedicated Logitech Unifying Software icon to the software page UI. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 22:59:09 -05:00
kitzy	cfbb5a59fa	Add GNU Privacy Guard as a Windows FMA (#50025 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: #50020 # What this does Adds GNU Privacy Guard as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing The install itself worked — the validator logged `New application detected at: C:\Program Files\GnuPG`. The script never returned: ``` 20:18:36 INFO msg="Executing install script..." app="GNU Privacy Guard" 20:28:36 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later 20:28:36 INFO msg="New application detected at: C:\Program Files\GnuPG" ``` Ten minutes on the nose is the validator's `executeScript` timeout. The cause is a PowerShell detail rather than anything wrong with the installer: *`Start-Process -Wait` waits for the process and all of its descendants**. GnuPG's installer starts `gpg-agent`, `dirmngr`, `keyboxd` and `scdaemon` and leaves them resident, so `-Wait` never returns. The same run left the installer `.exe` locked in the validator's temp dir, which is the other tell that a child process was still alive. The install script now follows the pattern already established by [`ollama_install.ps1`](ee/maintained-apps/inputs/winget/scripts/ollama_install.ps1): start with `-PassThru` (no `-Wait`), wait on the installer process alone with a 7-minute cap (below the caller's 10-minute script budget), poll for the Add/Remove Programs entry so a fast-returning installer can't be mistaken for a finished one, then stop the daemons. Stopping the daemons also fixes the uninstall, which would otherwise fail on files those processes hold open. The uninstall script stops them up front, uses NSIS's `_?=<dir>` switch so the uninstaller runs in place instead of relaunching itself detached from `%TEMP%`, and polls the ARP key to confirm removal. ## Notes - Clean ARP `DisplayName` (`GNU Privacy Guard`), so exact name matching — no `fuzzy_match_name` needed. Publisher `The GnuPG Project`. - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) passes on the SYSTEM-context Windows runner — [run 30384069714](https://github.com/fleetdm/fleet/actions/runs/30384069714) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added GNU Privacy Guard as a supported Windows application in the maintained apps catalog. * Added install/upgrade detection and uninstall support for Windows. * Added GNU Privacy Guard to the software catalog (Security category). * Added a dedicated GNU Privacy Guard icon to the software interface for proper name-based display. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 22:56:46 -05:00
kitzy	2fc41c7592	Add Azure Data Studio as a Windows FMA (#50027 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: #50020 # What this does Adds Azure Data Studio as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing The install itself worked — the validator logged `New application detected at: C:\Program Files\Azure Data Studio`. The script never returned: ``` 20:08:19 INFO msg="Executing install script..." app="Azure Data Studio" 20:18:19 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later 20:18:19 INFO msg="New application detected at: C:\Program Files\Azure Data Studio" ``` Ten minutes on the nose is the validator's `executeScript` timeout. Azure Data Studio is a Visual Studio Code fork and ships the same Inno Setup script — including the `runcode` task, which launches the app when the install finishes. Because `Start-Process -Wait` waits for the process and all of its descendants, the launched app kept the script blocked forever. The fix is the switch VS Code's own FMA already uses: `/MERGETASKS=!runcode` (see [`vscode_install.ps1`](ee/maintained-apps/inputs/winget/scripts/vscode_install.ps1) and [`vscodium_install.ps1`](ee/maintained-apps/inputs/winget/scripts/vscodium_install.ps1), both of which pass validation). The script also waits on the installer process alone rather than its descendants, polls for the Add/Remove Programs entry, and stops a stray `azuredatastudio` process as a backstop in case a future build ignores the task suppression. ## Notes - Machine-scope x64 installer, per the winget manifest — Azure Data Studio publishes both user and machine scope, and Fleet installs run as SYSTEM, so machine scope is required. - Clean ARP `DisplayName` (`Azure Data Studio`), so exact name matching. Publisher `Microsoft Corporation`. - Uninstall is unchanged: the Inno uninstaller doesn't leave anything resident, and `-Wait` waiting on descendants is the desired behavior there (Inno relaunches itself from `%TEMP%`). - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) passes* on the SYSTEM-context Windows runner — [run 30384162280](https://github.com/fleetdm/fleet/actions/runs/30384162280) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added Azure Data Studio to the available Windows software catalog. * Added support for installing and uninstalling Azure Data Studio (version 1.52.0) via silent installer and uninstaller flows with completion detection. * Added an Azure Data Studio icon to the software interface for better visual identification. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 22:56:00 -05:00
Allen Houchins	a3cdb7e14b	Fix macOS-only copy on two Windows FMA catalog entries (#50111 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: N/A — found while removing the macOS Yubikey Manager FMA (#50109) Two Windows Fleet-maintained apps describe themselves as macOS software in `ee/maintained-apps/outputs/apps.json`, because the entries were copy-pasted from their macOS counterparts. This copy is customer-facing: it shows in the Fleet UI's software catalog and on `fleetdm.com/software-catalog/<slug>`. - `proxyman/windows` — "Proxyman is a high-performance macOS app that enables developers to view HTTP/HTTPS requests and responses." → drops "macOS". (The `proxyman/darwin` description keeps it; it's accurate there.) - `wechat/windows` — name "WeChat for Mac" and "WeChat for Mac is a free messaging and calling application." → "WeChat". The winget input (`inputs/winget/wechat.json`) already declares `"name": "WeChat"`, so this also makes `apps.json` agree with its own input. The `wechat/darwin` entry keeps "WeChat for Mac", which is the actual macOS product name. Renaming the Windows entry needs a matching icon key. `getMatchedSoftwareIcon` matches on the lowercased app name and requires an exact match or a whole-word prefix (`matchLoosePrefixToKey`: `s === key \|\| s.startsWith(key + " ")`), so the existing `"wechat for mac"` key would not match a name of "WeChat" and the app would fall back to the generic package icon. Added a `wechat: Wechat` key alongside it (both point at the same component; the `"wechat for mac"` key stays for macOS and for hosts reporting that name in inventory). No server-side impact: `UpsertMaintainedApp` keys on `slug` and updates `name` in place, and `ReconcileMaintainedAppSoftwareNames` only renames `darwin` titles, so the Windows rename doesn't touch existing software titles. Website icons resolve from the slug (`build-static-content.js` builds `app-icon-<slug>-60x60@2x.png`), not the name, so `app-icon-wechat-60x60@2x.png` is unaffected. Descriptions here mirror upstream cask/winget copy, so these are minimal factual corrections rather than a voice rewrite. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually: - `apps.json` still parses; 1378 apps; verified the four `proxyman`/`wechat` entries read as intended and the `darwin` ones are untouched. - Traced the icon lookup by hand: name "wechat" now hits the new exact-match key; "wechat for mac" still hits the original. - Swept every non-darwin entry in `apps.json` for macOS-only phrasing (`Rosetta`, `macOS`, `Mac`, `Apple`) — these two were the only genuine mismatches. `duo-desktop/windows` (lists macOS, Windows, and Linux) and `imazing-profile-editor/windows` (edits Apple configuration profiles) are correct as written. Note: `node_modules` isn't installed in my working copy, so ESLint/Prettier weren't run locally — the added line is a one-line map entry matching the surrounding style. CI will confirm.	2026-07-28 21:47:42 -05:00
Noah Talerman	3a78739c10	Low contrast text on dashboard charts (#49651 ) - [x] QA'd all new/changed functionality manually For the following bug: - https://github.com/fleetdm/fleet/issues/49626 Before: <img width="1362" height="492" alt="Screenshot 2026-07-28 at 12 59 19 PM" src="https://github.com/user-attachments/assets/2a8be8a5-4687-4259-8aec-7b49e4c2b93e" /> <img width="1365" height="477" alt="Screenshot 2026-07-28 at 1 00 11 PM" src="https://github.com/user-attachments/assets/855b19c7-e855-40b9-9952-3ca45a443dee" /> <img width="928" height="443" alt="Screenshot 2026-07-28 at 1 01 51 PM" src="https://github.com/user-attachments/assets/f66ed7f9-9f0f-4416-a938-57a6c6b3d984" /> <img width="923" height="443" alt="Screenshot 2026-07-28 at 1 01 54 PM" src="https://github.com/user-attachments/assets/83fab0ae-1496-44b0-b65e-c256e4f0d0bc" /> After: <img width="1349" height="469" alt="Screenshot 2026-07-28 at 12 59 08 PM" src="https://github.com/user-attachments/assets/f51e6cce-6f2f-4385-8c7d-81a8d3e99ec3" /> <img width="1368" height="552" alt="Screenshot 2026-07-28 at 12 59 55 PM" src="https://github.com/user-attachments/assets/75557fea-d614-4383-a557-8ef7f6a8f3ef" /> <img width="919" height="378" alt="Screenshot 2026-07-28 at 1 01 39 PM" src="https://github.com/user-attachments/assets/82db0bdf-c8c2-40a2-90e0-f531c0cfb9b3" /> <img width="920" height="435" alt="Screenshot 2026-07-28 at 1 01 42 PM" src="https://github.com/user-attachments/assets/ed01a037-22ba-40a6-9833-a7f98541e536" />	2026-07-28 14:30:26 -07:00
Rahul Raghunathan	8f7a4ba2a0	Redirect to software inventory on 404 when switching fleets on title (#48389 )	2026-07-28 13:58:55 -07:00
Rahul Raghunathan	5bdbcc8495	48792 fix actions dropdown layout shift (#49430 )	2026-07-28 13:56:50 -07:00
RachelElysia	f7c2cf4106	Fleet UI: PR #49292 follow-up — buttons, 8px gaps, focus ring (#50049 )	2026-07-28 13:52:48 -07:00
Juan Fernandez	360e4b74ff	Update macOS disk encryption banner copy for ADE-enrolled hosts Relates #47832 Both the Host details and My device pages told the reader to log out or restart when Fleet didn't have a Mac's FileVault key. That's wrong for ADE-enrolled hosts: they escrow the key automatically, and the only thing standing between the host and a cleared banner is the next vitals refetch. It stays correct for manual enrollment, where Escrow Buddy only generates a new key at next login.	2026-07-28 15:33:26 -04:00
LeAnn	418fd60e9c	Clarify "Not supported" on Hosts page by adding tooltip (#49301 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #39987 - Added tooltips to the "Agent," "Last restarted," and "Status" column headers on the Hosts page explaining which platforms are supported and why. - On the Host details page, vitals with a "Not supported" value are now hidden instead of shown. - Fixed the "Last restarted" vital showing on ChromeOS hosts, where it's not actually collected. - Updated the "Last opened" tooltip on the Host details Software table to explain why it's only supported for native macOS, Windows, and Linux apps and packages. - Remove cellProps.rows.length === 1 workaround (which suppresses the tooltip whenever the table has exactly one row) by adding the correct CSS which removes the tooltip overflowing if host table is only 1 row # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Added/updated explanatory tooltips for Hosts table column headers (Agent, Last restarted, Status) with clearer supported-platform wording. - Clarified “Last opened” tooltip scope to native macOS, Windows, and Linux app/package entries. - Bug Fixes - Removed “Last restarted” from Host details for ChromeOS hosts when the value isn’t collected. - Prevented vitals rows from rendering when their values resolve to “Not supported,” and tightened “Last restarted” platform visibility. - Fixed tooltip overflow/positioning in the single-row Host software table case. - Tests - Updated and expanded vitals/header coverage to match the new display rules. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 10:30:21 -07:00
Carlo	5250936179	Consistent URL/email on-blur validation across forms (#40410 follow-up) (#49932 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #40410 Follow-up to #48854, which added on-blur validation to the software vulnerability automations webhook. QA found three more forms with inconsistent validation, in two flavors: - Validated only on save (no on-blur feedback): Policies > Manage automations > Other workflows > Destination URL. - Errored before any input (validation fired on mount/enable): Settings > Users > Add/edit user > Email, and the host status webhook Destination URL (both global and fleet settings). This makes them consistent with the rest of the app: no error on open/enable → validate on blur → clear the field's error as the user edits → validate on submit. - `OtherWorkflowsModal` — added an on-blur handler for the Destination URL (guarded by the field's disabled condition). - `UserForm` — on-blur now validates only the blurred field (so blurring the autofocused Name no longer flags the empty Email/Password); submit validates all fields. - `GlobalHostStatusWebhook` — removed the `useEffect` that validated the moment the webhook was enabled; validation now runs on blur and submit. - `TeamSettings` (fleet host status webhook) — the Destination URL error is no longer surfaced on change/enable; it validates on blur and submit. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated (URL and email fields validate on blur and on submit; no errors are shown before the user interacts). ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Improved webhook destination URL validation across integrations, team settings, and workflow automation forms. * Validation messages now appear after leaving the URL field, rather than prematurely while enabling or editing. * Prevented saving or submitting forms with missing or invalid destination URLs. * Correctly clears validation errors once a valid URL is entered. * Improved user form validation so field-specific errors appear only for the field being reviewed, while submit continues to validate the full form. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 13:23:48 -04:00
Victor Lyuboslavsky	ffc85a42ae	Add Windows admin account config (#49863 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #48720 Subtask of https://github.com/fleetdm/fleet/issues/43488 This PR only adds the Windows config, and doesn't mess with macOS configs. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added managed local account settings for Windows to app and team configuration, including GitOps support. * Exposed an explicit enabled/disabled toggle in configuration output and Fleet controls. * Added licensing and Windows MDM prerequisites for enabling the setting. * Bug Fixes * Managed local account enable/disable actions are now correctly persisted and declaratively applied. * Activity feed messages now display platform-specific (macOS vs Windows) wording. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 12:10:33 -05:00
kitzyandAllen Houchins	3ce3e238ed	Add 6 Windows Fleet-maintained apps (#50016 ) Related issue: N/A — Windows Fleet-maintained app (FMA) coverage for apps found deployed in a customer's ManageEngine SDP environment but missing from Fleet. ## What this does Adds 6 Windows Fleet-maintained apps — the subset of a larger batch that passes the FMA validator cleanly. Each has a winget-sourced input, a generated output manifest, and a catalog icon. Detection identity was verified against each app's real registry DisplayName; apps whose DisplayName carries a version suffix use fuzzy name matching, the rest match exactly. MSI (clean, auto upgrade-code uninstall): - Git Extensions — versioned ARP name (`Git Extensions 7.2.0.92`) → fuzzy match - TightVNC, Yarn, SonicWall NetExtender (WiX), Zoom Outlook Plugin — clean ARP names → exact match EXE — NSIS (custom `/S` install + registry-lookup uninstall): - Spyder — versioned ARP name (`Spyder 6`) → fuzzy match ## Notes - Detection verification. Every app's `unique_identifier` (registry DisplayName / osquery `programs.name`) and publisher were verified per the `new-fma` skill against winget `AppsAndFeaturesEntries`, MSI Property tables (`msiinfo`), and vendor installer scripts — not assumed. Git Extensions' MSI `ProductName` is `Git Extensions 7.2.0.92` and Spyder's ARP entry is `Spyder 6`, so both need `fuzzy_match_name`; the four exact-match apps were confirmed clean (e.g. TightVNC registers as `TightVNC`, not a versioned string). - Validated on a real Windows host. All six pass the FMA CI validator (install → detect → uninstall) on the SYSTEM-context Windows runner. - Icons. Git Extensions, SonicWall NetExtender, TightVNC, Yarn, and Zoom Outlook Plugin ship new catalog icons + website assets; Spyder reuses the existing `Spyder` icon. ## Testing - [x] FMA CI validator (install → detect → uninstall) on the SYSTEM-context Windows runner. - Generated outputs verified locally: all 6 produce valid manifests; MSI apps carry the correct UpgradeCode-based uninstall; exists/patched queries reviewed for name + publisher correctness; `go test ./ee/maintained-apps/...` passes. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added maintained Windows catalog entries for Git Extensions, SonicWall NetExtender, Spyder, TightVNC, Yarn, and Zoom Outlook Plugin, including silent install, version upgrade detection, and maintenance-ready uninstall flows. * Added new software icons for these apps and expanded icon matching so they display correctly in the catalog. * Bug Fixes * Improved Spyder Windows uninstall targeting and command/argument handling for more reliable removals. * Documentation * Refreshed Spyder supported version details to 6.1.5. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Allen Houchins <allenhouchins@mac.com>	2026-07-28 10:14:53 -05:00
Allen Houchins	aea7c4068f	Remove Nocturnal as a macOS FMA (#50050 ) Related issue: N/A — fixes the failing scheduled "Update Fleet-maintained apps" workflow The `nocturnal` cask was removed from homebrew-cask on 2026-07-28 ([Homebrew/homebrew-cask@517db75](https://github.com/Homebrew/homebrew-cask/commit/517db75b78)) after being deprecated on 2024-07-27 and disabled on 2025-07-27, both `because: :unmaintained` (upstream repo's last push was in 2018). The brew API now returns 404 for it, so the maintained-apps ingester panics: ``` panic: ingesting homebrew app: app not found in brew API ``` This removes Nocturnal as a Fleet-maintained app, following the same pattern as #46541 (Messenger) and #47420 (Dell Display Manager): - `ee/maintained-apps/inputs/homebrew/nocturnal.json` — Homebrew input - `ee/maintained-apps/outputs/nocturnal/darwin.json` — macOS output data - `ee/maintained-apps/outputs/apps.json` — Nocturnal entry - `frontend/pages/SoftwarePage/components/icons/Nocturnal.tsx` and its import/mapping in `index.ts` - `website/assets/images/app-icon-nocturnal-60x60@2x.png` # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually (verified `apps.json` still parses, no remaining `nocturnal` references, ESLint passes on the icons index) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Removed Apps* - Removed Nocturnal from the maintained application catalog. - Removed its installation and uninstallation support. - Removed the Nocturnal icon from software listings. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 09:53:17 -05:00
Andrew Mellor	8e0c038eff	47701 abm errors UI (#49896 ) Related issue: Resolves #47701 # Checklist for submitter ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually: Not able to test token_rejected, terms and conditions or apple server error. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added an Apple Business Manager invalid-token warning banner that lists the affected organization names. * Introduced dedicated invalid-token state support so the banner can appear with the correct priority. * Bug Fixes * Ensured invalid-token state is cleared when no tokens are returned and consistently set on token fetch success/error. * Improved Apple/DEP status messaging and made profile-assignment rendering more resilient for non-DEP and partial-error responses. * Style * Adjusted banner spacing and added styling for DEP error presentation. * Tests * Added/expanded tests for invalid-token messaging, ABM expiry updates, and MDM status/error scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 15:01:48 +01:00
Rajendra KadamandMagnus Jensen	0504e5949e	Add host_id and host_serial to Apple mdm_enrolled activity (#49969 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #49777 ## Description Adds `host_id` and `host_serial` to the Apple `mdm_enrolled` activity so IT admins can build automations on top of it, and surfaces the activity on the individual host's activity timeline. - `server/fleet/activities.go` — added `HostID` to `ActivityTypeMDMEnrolled` and a `HostIDs()` method (mirrors the existing `ActivityTypeMDMUnenrolled` pattern), so the activity is linked to the host and appears on its timeline. - `server/mdm/lifecycle/lifecycle.go` — populate `host_id` for macOS/iOS/iPadOS enrollments. Account-driven user (BYOD) enrollments have no hardware serial, so they report the enrollment ID as `host_serial` too, keeping `host_serial` populated for automations regardless of enrollment type. - Frontend — new `MdmEnrolledActivityItem` component, registered in the host past-activity component map (and the `IHostPastActivityType` union), renders the now-host-linked `mdm_enrolled` activity on the host details Activity card. There's no Figma, so the copy mirrors the sibling `mdm_unenrolled` item (e.g. "Mobile device management (MDM) was turned on for this host"). `host_id` uses `omitempty`, so Windows (`microsoft_mdm.go`) enrollments keep their existing activity payload unchanged — Windows is intentionally out of scope, handled in #47874, which also owns the audit-log documentation update for the shared field. > For reviewer: the ADUE `host_serial = enrollment_id` behavior comes from the issue's test plan. It means `host_serial` and `enrollment_id` carry the same value for BYOD. Flagging in case Product would rather leave `host_serial` empty for ADUE and have automations read `enrollment_id`. ## Testing - Automated: `TestMDMEnrolledActivityHostIDAndSerial` (`server/mdm/lifecycle`) covers device enrollment (`host_serial` = hardware serial) and ADUE (`host_serial` = enrollment ID), both asserting `host_id`/`HostIDs()`. Also verified `server/datastore/mysql` `TestMDMEnrollment`, `server/activity/internal/mysql` `TestListActivities`, and `server/service` `TestMDMTokenUpdate` pass. - Live (simulated) manual macOS enrollment* via `osquery-perf`: the `mdm_enrolled` activity recorded `host_id` + `host_serial`, and an `activity_host_past` row linked it to the host (confirmed it shows on the host timeline). - Frontend: `MdmEnrolledActivityItem.tests.tsx` covers the rendered copy for macOS/iOS/Android and the actor/no-actor variants; also visually confirmed the activity renders on a host's Activity card in the running app. `yarn jest`, `eslint`, and `tsc` pass. - Updated the MDM integration tests (`integration_mdm_test.go`, `integration_mdm_dep_test.go`, `integration_vpp_install_test.go`) whose activity-detail and host-feed assertions changed now that `mdm_enrolled` carries `host_id` and appears on the host timeline (feed assertions now filter by activity type). - Pending on-device QA (next week): DEP/ADE macOS and account-driven user enrollment (iOS/iPadOS) on real hardware, per the issue's test plan. - Regression: Windows `mdm_enrolled` payload is unchanged (`host_id` is omitted when zero); both platforms' `mdm_unenrolled` are unaffected. # Screenshot for the frontend change <img width="706" height="382" alt="Screenshot 2026-07-28 at 11 16 57 AM" src="https://github.com/user-attachments/assets/8f57d129-f819-4399-8754-18b397a49db8" /> # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- manual macOS verified via simulator; DEP + real-device ADUE pending next week --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * New Features * Added support for rendering “MDM enrolled” in the host activity feed with platform- and actor-aware messaging. * Bug Fixes * Updated Apple “MDM enrolled” activity details to include the correct host identifier and serial/enrollment identifiers. * Ensured host-scoped activity behavior applies only when the host is known (host id present). * Tests * Expanded regression and integration coverage for “MDM enrolled” activity details and feed contents, including VPP-related assertion stability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Magnus Jensen <magnus@fleetdm.com>	2026-07-28 14:27:42 +05:30
Steven Palmesano Copilot Autofix powered by AI Lucas Manuel Rodriguez	bf3e1bab99	Add Apple marketing names to backend, frontend, and an osquery table (#46482 ) Related issue: Resolves https://github.com/fleetdm/fleet/issues/46818 and https://github.com/fleetdm/fleet/issues/48524. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Host lists and Host details now show human‑readable Apple hardware marketing names (macOS, iOS, iPadOS) where available (e.g., "MacBook Pro (16‑inch, 2021)"), replacing raw model identifiers. * Hardware model displays fall back to the original model identifier for non‑Apple or unmapped devices. * Bug Fixes / CSV * Exported host CSVs now align with the UI by using the marketing name for Apple devices when available. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>	2026-07-27 22:26:30 -03:00
LeAnn	84896a5687	Add tooltip explaining missing Refetch button for Android hosts (#50017 ) <img width="632" height="196" alt="Screenshot 2026-07-27 at 3 09 16 PM" src="https://github.com/user-attachments/assets/7bfc1440-48a4-4baf-8747-cc5e848a3a53" /> <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #50001 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added an explanatory tooltip to the “Last fetched” field for Android hosts. * The tooltip clarifies that Android hosts sync automatically and therefore do not have a “Refetch” button. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 15:39:22 -07:00
RachelElysia	29f20aca31	Fleet UI: Fix empty button boxes in batch run script modal (#49997 )	2026-07-27 13:07:01 -07:00
Victor Lyuboslavsky	19efda2d1b	Windows SCEP profiles now fail with non-printable chars (#49887 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #47492 Windows cert profile fails if challenge uses non-printable characters. <img width="987" height="329" alt="image" src="https://github.com/user-attachments/assets/04dc7c78-8e3e-41c8-823e-cb4a961a91eb" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * Bug Fixes * Windows SCEP profiles now fail with a clear error when the certificate authority challenge includes characters not supported by Windows ASN.1 PrintableString. * Prevents misleading “Verified” status when no certificate is installed. * Preserves valid challenge values, including leading/trailing spaces. * Improves Windows error tooltips by showing raw certificate-install error details. * Tests * Added coverage for invalid/valid Windows SCEP challenge scenarios and the updated error tooltip behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 12:49:14 -05:00
Rajendra Kadam	17669eca02	Center-align setup experience app icons (#49962 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #46973 > Draft: on-device QA (Mac/iPhone/iPad) is pending hardware, expected next week. Opening as draft for early review of the approach. ## Description FMA and custom-package app icons were misaligned on the macOS setup experience ("Setting up your device") screen — icons rendered at different sizes and their "Install …" labels didn't line up. Root cause: `SetupSoftwareProcessCell` forced `.software-icon__small { width: $pad-xlarge }` (32px, width only). That class lands on different elements in `SoftwareIcon`'s two render paths, so it hit them differently: - Fleet-maintained / VPP apps (icon URL) → the class is on the wrapper `<div>`; the 24px `<img>` inside stayed 24px, left-aligned. - Custom packages (no URL) → the class is on the fallback SVG itself, which got stretched to 32px wide. Result: different icon sizes/positions by app type → the misalignment. Fix: remove the width override so every app type renders `SoftwareIcon` at its consistent, vertically-centered 24px "small" size. ## Testing Verified in Storybook (added `SetupSoftwareProcessCell.stories.tsx`, `MixedAlignment` story) with real matched brand icons (Chrome, 1Password, VS Code, Zoom), a generic custom-package icon, and a URL/`<img>` icon stacked together: - Before (with the override): icons render at mixed 24/32px sizes; "Install …" labels don't align. <img width="1135" height="398" alt="before" src="https://github.com/user-attachments/assets/fe216ab4-0a7b-4211-b8aa-96e65e6ca3f5" /> - After (this change): all icons render at 24px, centered, labels aligned. <img width="1185" height="425" alt="after" src="https://github.com/user-attachments/assets/28257eb8-df6e-4168-a0bb-28dda4bb40ba" /> On-device QA to follow once hardware is available. ## Notes for reviewer - The `width: $pad-xlarge` (32px) was added in #33770, so 32px may have been the intended icon size. This change makes them a consistent 24px. If a larger icon is desired, that's a follow-up done properly via a real `SoftwareIcon` size (not a width-only override) — flagging for PD input since this is `:product`-labeled. - Included a Storybook story for visual verification/regression; happy to drop it if that's not wanted here. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [ ] QA'd all new/changed functionality manually <!-- pending on-device QA --> - Added a Storybook story for visual verification (not an automated test). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Improved software process cell styling for more consistent icon sizing and alignment. * Tests * Added Storybook scenarios covering fleet-maintained apps, custom packages, uploaded icons, and mixed app layouts. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 19:42:22 +05:30
melpike	af65282522	Align helper text with checkbox/radio labels (#49977 ) Moves changes from #49920 to `main`. Originally targeting `docs-v4.91.0` — retargeted to this branch. Related: #49920 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Improved checkbox and radio button helper-text alignment so it lines up with the associated label. * Adjusted spacing between controls, labels, and helper text for a cleaner form layout. * Documentation * Added component examples demonstrating checkbox and radio buttons with helper text. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 08:07:54 -06:00
Allen Houchins	f96cb9d6c7	Add Windows FMAs (letter I): 17 apps (#49923 ) Related issue: N/A — part of the ongoing Windows Fleet-maintained apps (FMA) parity workstream (letter I). ## What this does Adds 17 Windows Fleet-maintained apps for the letter-I batch. apps.json descriptions follow the house `"<Name> is a …"` convention. IBM Semeru Runtime Open Edition (Java) — 8 apps (MSI, machine, x64): JDK 8/11/17/21 and JRE 8/11/17/21. Per-major detection follows the Eclipse Temurin pattern — `name LIKE 'IBM Semeru Runtime Open Edition (JDK\|JRE)%' AND publisher = 'Semeru' AND version LIKE '<major>.%'` — so majors and JDK/JRE never cross-match. All 8 share the IBM Semeru logo. Other apps (9): - IronPython 3 — MSI; fuzzy `IronPython 3%` (excludes the EOL v2) - ImageGlass — dual-scope MSI, custom `ALLUSERS=1` install - install4j — install4j installer (bundled JRE), `-q` - IrfanView — custom installer `/silent /allusers=1`; versioned+arch name → fuzzy `IrfanView%` - iMazing HEIC Converter, IsoBuster, ImpExpPro — Inno Setup (`/VERYSILENT`) - Infix PDF Editor — Inno, x86 - Ibis Calculeren voor Bouw — InstallShield wrapper; uninstall via the MSI UpgradeCode (`uninstall_type: msi`) ## Dropped from this batch (recorded in the workstream tracker) - IBM Aspera Connect — MSI installs per-user by default (`ALLUSERS=2`/`MSIINSTALLPERUSER=1`, no machine switch in the manifest) + a rolling `/latest/` URL that 404s on the next release. - IcedTea-Web (Azul and AdoptOpenJDK) — both declare a hard, unbundled JRE dependency; it's a JNLP launcher that's dead-on-arrival without Java the FMA won't install (AdoptOpenJDK variant is also archived). - IronPython 2 — EOL (Python 2). install4j 9 — legacy 2022 build. IrfanView PlugIns — add-on that drops DLLs with no independent ARP entry (undetectable) and depends on the base app. - Intermedia Unite and its Teams Desktop Plugin — both use non-versioned "latest" URLs (winget-bot auto-updated; the pinned SHA rots each release); the plugin also depends on Teams + Unite. ## Notes - Ibis Calculeren voor Bouw, ImpExpPro, and Infix PDF Editor ship without a catalog icon — no clean ≥256px first-party logo exists for these niche apps (they fall back to the generic icon). - Ibis carries some risk: its DisplayName couldn't be verified offline (compressed InstallShield payload) and its installer URL is non-versioned — flagging for the validator; will drop if detection/version fails. - IsoBuster uses a non-versioned URL that currently matches the pinned 5.8, so no `ignore_hash`; winget re-ingestion tracks future drift. - Verification (installer type/scope/arch, ProductCode/UpgradeCode, dependencies, silent switches, URL stability, en-US locale) was done per the `new-fma` skill against the winget-pkgs manifests, with several DisplayNames confirmed via `innoextract`/`msitools`. ## Testing - [ ] FMA CI validator (install → detect → uninstall) on the SYSTEM-context Windows runner — pending. - Generated outputs verified locally: all 17 produce valid manifests; per-major Semeru queries and MSI UpgradeCode uninstalls confirmed; all apps.json descriptions present and convention-compliant.	2026-07-24 21:46:12 -05:00
RachelElysia	09fea47ce4	Fleet UI: Handle long fleet names across the Fleets UI (#49216 ) ## Issue Closes #47290 Also implements the "Cap free-text `maxLength` to the backend column length" pattern established in [#49041 (patterns.md thread)](https://github.com/fleetdm/fleet/pull/49041/files#r3572648691). ## Description Fleet name inputs had no `maxLength` cap and no service-layer length check, so a name >255 chars failed with a raw MySQL `Data too long` error, and several UI surfaces didn't handle long names gracefully. This PR fixes all four manifestations called out in the bug, plus a related label-overflow case on the host details page, and hardens adjacent name inputs across the app. Frontend fixes for #47290: - Create/Rename fleet name inputs now cap at 255 characters (matches `teams.name varchar(255)`). - Fleets table Name column uses `LinkCell` with `tooltipTruncate` + `className="w400"` so long names truncate with an ellipsis and full-name tooltip instead of overflowing across the Hosts/Users columns. - Fleet-detail page header (`.team-details__team-header`): h1 gets `overflow: hidden; text-overflow: ellipsis; white-space: nowrap;`, `__team-details` gets `min-width: 0; flex: 1`, and `.action-buttons` gets `flex-shrink: 0` + `white-space: nowrap` on buttons so Manage enroll secrets / Rename / Delete no longer wrap to a second line when the fleet name is long. - Manage enroll secrets modal body — `__description` gets `overflow-wrap: anywhere; min-width: 0` so a long `<b>{fleet name}</b>` wraps within the modal instead of spilling out the right edge. Backend fixes for #47290: - New `fleet.MaxTeamNameLength = 255` constant. - `NewTeam`, `ModifyTeam`, and `ApplyTeamSpecs` now return `fleet.NewInvalidArgumentError("name", "may not exceed 255 characters")` instead of surfacing a raw `Data too long` MySQL error. Covers UI, API, and GitOps entry points. Broader consistency pass (per [#49041 thread](https://github.com/fleetdm/fleet/pull/49041/files#r3572648691)): - New shared `MAX_ENTITY_CHAR_LENGTH = 255` constant in `frontend/utilities/constants.tsx`. - Refactored 8 existing files that had ad-hoc `NAME_MAX_LENGTH = 255` / `MAX_LABEL_NAME_LENGTH = 255` locals to use it. - Slotted it into 16 additional `InputField` name/description inputs that were missing a cap (API user, custom variable, certificate, label name + description, pack name + description, and all 5 CA forms — CustomEST, CustomSCEP, Smallstep, Digicert, Hydrant). - Pruned dead FE length validators that can no longer fire now that the DOM cap enforces the limit (certificate modal, custom variable modal, both label helpers, both category modals). Unusual/shorter caps (e.g. `varchar(64)`, custom business rules) still keep their inline validators — silent truncation is only appropriate for the common 255-char norm. Bonus: fixed the long-label overflow on the host details Labels card by capping the pill button `max-width` at 300px. ## Screenrecording https://github.com/user-attachments/assets/b917b72e-7437-4d0c-a1a1-c49b4b1c28ba https://github.com/user-attachments/assets/3a3efbb2-09d8-4f47-9fd4-f158b3453b9e https://github.com/user-attachments/assets/73e5e022-dc93-4381-82b3-be9549d050e6 Latest - max width 300px long label: <img width="1106" height="262" alt="Screenshot 2026-07-23 at 11 29 24 AM" src="https://github.com/user-attachments/assets/741fddbd-f78d-4578-a025-bddf64a81c25" /> ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Test coverage: - `CreateFleetModal.tests.tsx`, `RenameFleetModal.tests.tsx` — new case per file asserting the name input's `maxLength === 255`. - `AddCertificateModal.tests.tsx`, `Variables.tests.tsx` — the existing "shows too-long error when pasting 256 chars" tests are now unreachable via the DOM cap; converted to `maxLength === 255` assertions. - `ee/server/service/teams_test.go` — `TestNewTeamNameValidation`, `TestModifyTeamNameValidation`, and `TestApplyTeamSpecsNameValidation` each get two new cases (accepts at the limit, rejects one over with the expected error message). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Limited fleet, team, and other user-entered names and descriptions to 255 characters. * Replaced database errors for oversized names with clear validation messages. * Prevented long fleet and label names from overflowing tables, headers, modals, and host details. * Improved modal and dropdown layouts for long text. * Tests * Added coverage for character limits, boundary values, and multibyte names. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-24 11:22:06 -04:00
RachelElysia	3e3097cf49	Fleet UI: Drop I-beam cursor on non-underlined tooltips (#49859 )	2026-07-24 07:01:48 -07:00
Magnus Jensen	122c5d2709	don't stop propagation for react-select (#49878 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves unreleased bug with Fleet dropdown not working https://github.com/user-attachments/assets/6460efe2-2181-48bc-9ca0-67f64241a3e9 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. Unreleased - [ ] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit Bug Fixes * Improved fleet selection behavior so dropdown interactions work reliably without overriding built-in menu handling. * Selecting a fleet now correctly updates the displayed fleet and closes the dropdown menu. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-24 09:58:11 -04:00
Rajendra Kadam	aa572dcca4	Show ABM organization name in edit-fleets success toast (#49877 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #48914 ## Description The success toast shown after editing fleet assignments for an Apple Business Manager (ABM) organization read: > Successfully updated fleets for AB token. The trailing "AB token" made the message unclear. It now names the organization instead, matching the modal's title: > Successfully updated fleets for `<org name>`. The organization name (`token.org_name`) was already available in the component (it's used as the modal title), so this is a copy-only change with no new data plumbing. Note: the issue's expected behavior left the exact wording to Product ("TODO — Product to decide"). This implements Product's written suggestion (`Successfully updated fleets for {org name}`) so the awkward wording isn't blocking; the string is trivial to adjust if Product/design prefer different phrasing in review. ## Testing - Manually QA'd in the UI: with a configured ABM organization, edited a fleet assignment and confirmed the toast now shows the org name. - Existing unit tests for the modal's helpers (`getOptions`, `getSelectedTeamIds`) still pass; no test asserts the toast string. - `eslint` and `prettier` pass on the changed file (added `token.org_name` to the `useCallback` dependency array to satisfy `react-hooks/exhaustive-deps`). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit Bug Fixes * Updated the success notification shown after fleet teams are saved to include the associated organization name. * Ensured the notification always reflects the currently selected organization. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-24 13:30:57 +05:30
RachelElysia	9cfd907be6	Fleet UI: Hide empty host summary card on Free-tier Android hosts (#49848 )	2026-07-23 12:54:18 -07:00
Magnus Jensen	f85187bcd3	Added danger variant to checkbox (#49806 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves https://fleetdm.slack.com/archives/C02A8BRABB5/p1784765147322239?thread_ts=1784727509.435919&cid=C02A8BRABB5 https://github.com/user-attachments/assets/e6bdeeb9-9ec3-4ba6-9669-6ea18ec8362d # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added a danger variant for checkboxes, with red styling for default, hover, and active states. * Updated release and wipe confirmation checkboxes to clearly indicate destructive actions. * Added Storybook controls for checkbox values and variants. * Bug Fixes * Standardized checkbox values to use boolean states only. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-23 19:18:57 +02:00
Carlo	83f3f4b560	Add clear error for Firefox / Firefox ESR conflict (#49714 ) Related issue: Resolves #49682 Mozilla Firefox and Firefox ESR are distinct Fleet-maintained apps that share the macOS bundle identifier `org.mozilla.firefox`, so they resolve to one software title. Adding both to a fleet previously gave a generic conflict error (or no error at all). This adds a clear message — "Only one of Mozilla Firefox or Mozilla Firefox ESR can be added to the same fleet." — on both the single-add and GitOps/batch paths. The check is general (any two FMAs sharing a bundle identifier), with the app names filled in dynamically. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements). ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Bug Fixes* - Prevented adding both Mozilla Firefox and Firefox ESR to the same fleet when they share a bundle identifier. - Updated the UI to show a specific conflict message explaining that only one of the two can be added. - Ensured existing workflows still work for adding new versions of the already-selected app. - Tests - Added backend and frontend test coverage for the new conflict detection and error-message formatting. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-23 12:39:17 -04:00
RachelElysia	86528fa6bf	Fleet UI: Fix TS errors from removed button variants (#49828 )	2026-07-23 08:19:02 -07:00
RachelElysia	968ea20aeb	Fleet UI: Searchable fleets dropdown with add-fleet affordance (#49690 )	2026-07-23 07:26:04 -07:00
Steven Palmesano	62ed3583e6	Clear button styles (#49292 ) Related issue: Resolves #49276 New features - Added new "Secondary" (bordered, off-white fill) and "Subdued" (borderless, low-emphasis) button variants to match the Figma spec, alongside the existing Primary style. - Allowed rows to be selected in Controls > OS updates. Cleanup - Once nothing referenced the old styles anymore, fully removed the old `text-icon`, `brand-inverse-icon`, `inverse-alert`, `inverse`, and `icon` button variants (type, styles, and Storybook entries) from the shared `Button` component. - Removed the `iconStroke` prop, which had become a no-op once the old variants it supported were gone. - Renamed `ActionsDropdown`'s variants (`button`/`brand-button`/`small-button`) to `subdued`/`primary`/`secondary` to match the same naming used everywhere else. - Replaced a one-off dropdown implementation on the Software title page with the shared `ActionsDropdown` component, instead of maintaining duplicate styling logic. - Changed the button name on Host details > Reports > Report details from "View data for all hosts" to "View report for all hosts" (to match the previous page's Actions drop-down options). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <img width="1475" height="241" alt="Screenshot 2026-07-21 at 06 35 49" src="https://github.com/user-attachments/assets/7cfbd444-7837-40e8-854e-bc5989d57d85" /> <img width="661" height="306" alt="Screenshot 2026-07-21 at 06 37 18" src="https://github.com/user-attachments/assets/5d0c4873-8179-4089-b115-7e8cd3a53b4d" /> <img width="1427" height="423" alt="Screenshot 2026-07-21 at 06 37 30" src="https://github.com/user-attachments/assets/a4850a60-f44a-4902-b45e-0094f23a52f8" /> <img width="1427" height="640" alt="Screenshot 2026-07-21 at 06 37 46" src="https://github.com/user-attachments/assets/738a4a7f-cd7d-4162-b659-6f649c32204d" /> <img width="1445" height="479" alt="Screenshot 2026-07-22 at 07 03 22" src="https://github.com/user-attachments/assets/4f672dc0-5c6d-4eb8-8465-ed5233fcd1b2" /> <img width="811" height="871" alt="Screenshot 2026-07-21 at 06 41 20" src="https://github.com/user-attachments/assets/5421c96e-2dab-492a-af26-be0e5a7791ca" />	2026-07-23 07:11:59 -05:00

1 2 3 4 5 ...