**Related issue:** Resolves#36701
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added activity tracking for Android certificate template edits and
deletions via GitOps.
* **Chores**
* Updated certificate template batch operations to track which teams
were affected by changes.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#36867
This updates the UI to show the mdm commands for the past and upcoming
tabs in the activity card on the host details page.
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37307
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Improvements**
* Enhanced Android Mobile Device Management status reporting to
consolidate and accurately reflect both profile and certificate template
statuses in aggregated summaries.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#32777
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
This pull request adds support for managing the Inkscape application on
Windows. It introduces new configuration files and updates existing
outputs to include Inkscape as a managed app, complete with installation
and uninstallation scripts.
**Addition of Inkscape for Windows:**
* Added a new input configuration for Inkscape in `winget`, specifying
installer details and default categories in `inkscape.json`.
* Created a new output file `inkscape/windows.json` with version
information, download URL, SHA256 hash, install/uninstall scripts, and
upgrade code for Inkscape 1.4.2.
**Updates to application listings:**
* Updated `apps.json` to include Inkscape for Windows as a managed app,
with its platform, slug, unique identifier, and description.
This pull request adds support for managing Steam as a maintained
application on both macOS (darwin) and Windows platforms. It introduces
new metadata, installation, and uninstallation scripts, and updates the
aggregated app catalog to include Steam for both platforms.
**Steam app integration:**
- Added metadata and configuration files for Steam on macOS and Windows,
including installation details, unique identifiers, and categorization.
[[1]](diffhunk://#diff-c281dce9b3fb0c07ee0240f023b10f04f90d714ede790faa62a0e6f140db35b2R1-R8)
[[2]](diffhunk://#diff-2f3d984248d056735d116afea075ebb59e8e209b4a35ecc35bc82c21f760ed7aR1-R12)
- Updated the main `apps.json` catalog to include Steam entries for both
platforms, complete with descriptions and platform-specific slugs.
**Installer and uninstaller scripts:**
- Added a PowerShell installation script for Windows that installs Steam
silently using the `/S` flag.
- Added a PowerShell uninstallation script for Windows that locates the
Steam uninstaller and removes it silently, handling both 32-bit and
64-bit registry locations.
- Added macOS shell scripts (referenced in the output) for installing
and uninstalling Steam, including logic to quit running processes and
clean up associated files.
**App version outputs:**
- Created output files for both `steam/darwin.json` and
`steam/windows.json`, specifying version information, detection queries,
installer URLs, script references, and default categories.
[[1]](diffhunk://#diff-12ddb40a8998c18e5806cefa53ded63d64144a101d2cab1dfbbe78093e8cddeaR1-R21)
[[2]](diffhunk://#diff-6a83a89e114cb2281eb5ee80b6f574a374304c1baa60b927c7e1096044814a55R1-R21)
I removed the feature image since it adds little value and pushes the
content further down the page.
Articles and guides do not require a feature image. Social sharing
thumbnails can be optionally defined in the metadata, but are not
required. The default thumbnail will be used if the article image is not
defined in the metadata.
I removed the feature image since it adds little value and pushes the
content further down the page.
Articles and guides do not require a feature image. Social sharing
thumbnails can be optionally defined in the metadata, but are not
required. The default thumbnail will be used if the article image is not
defined in the metadata.
This pull request updates the configuration for the Google Chrome
maintained app on Windows to bypass hash checking for the installer.
This change ensures that installations will proceed even if the
installer hash changes, which can help avoid issues with frequent
upstream updates.
Configuration changes for hash checking:
* Added `"ignore_hash": true` to the `winget/google-chrome.json` input
file to instruct the system to skip hash verification during
installation.
* Set `"sha256": "no_check"` in the `outputs/google-chrome/windows.json`
output file to explicitly indicate that the installer hash should not be
checked.
This pull request updates the Google Chrome package definition for
Windows to use the latest available version.
- Dependency update:
* Updated the `version` field for Google Chrome from `143.0.7499.110` to
`143.0.7499.147` in `windows.json`, and updated the corresponding
`sha256` checksum to match the new installer.
**Related issue:** Resolves#36689
<img width="1840" height="1196" alt="Screenshot 2025-12-15 at 5 08
02 PM"
src="https://github.com/user-attachments/assets/4f491c80-403f-4188-8cab-552e997c6e9c"
/>
<img width="1840" height="1196" alt="Screenshot 2025-12-15 at 5 09
18 PM"
src="https://github.com/user-attachments/assets/b6e4d9ad-40c1-45c3-8b77-e14d17a2bc7e"
/>
<img width="1840" height="1196" alt="Screenshot 2025-12-15 at 5 09
22 PM"
src="https://github.com/user-attachments/assets/661beee2-3ee2-4269-ab0b-ca070c1a40b8"
/>
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added comprehensive Android certificate management in OS Settings with
create, list, and delete operations
* Integrated certificate management with premium tier gating and MDM
enablement checks
* Supports team-scoped certificates with pagination controls
* Includes validation for certificate names and certificate authority
selection
* **Refactor**
* Generalized heading component to support multiple entity types beyond
configuration profiles
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37271
# Details
This PR addresses a gap where Windows or Linux hosts enrolling via
end-user authentication were not linked to existing SCIM user data.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
Tested on a Linux VM using Okta, verified that after enrolling it
populated SCIM attributes for the user:
<img width="858" height="299" alt="image"
src="https://github.com/user-attachments/assets/dc3bf70e-62cb-40a6-aebe-fef3db6d8f53"
/>
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
This pull request updates the Santa software package to a newer version
in the configuration file.
- Updated the Santa package URL in
`it-and-security/lib/macos/software/santa.yml` to point to version
`2025.11` instead of `2025.6`.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37189
- [x] QA'd all new/changed functionality manually
This pull request adds support for the CrashPlan backup and recovery
software to the maintained apps ecosystem for both macOS (Homebrew) and
Windows (Winget). It introduces new metadata, installation and
uninstallation scripts, and integrates CrashPlan into the application's
UI, including a dedicated icon.
**CrashPlan app support:**
- Added CrashPlan metadata for Homebrew (`crashplan.json`) and Winget
(`crashplan.json`), specifying identifiers, installer details, and
default categories.
[[1]](diffhunk://#diff-65666812266569e4f2198de5e97a2a0a2e02974e5b134dac13e9bd9fecc3109bR1-R8)
[[2]](diffhunk://#diff-c8f7deea2ce492ea0903ba3fcfdcf7a6df342b935c284dca8564f449f1247f39R1-R10)
- Included CrashPlan in the aggregated app listings (`apps.json`) for
both macOS and Windows platforms, with descriptions.
**Installer and uninstaller scripts:**
- Added versioned output and installation/uninstallation scripts for
CrashPlan on macOS (`crashplan/darwin.json`) and Windows
(`crashplan/windows.json`), including download URLs, SHA256 hashes, and
detection queries.
[[1]](diffhunk://#diff-13c8cfd39d6d7d8faabce6b6d7f6566275a4c7d09c37ca9cc9726e09c89cc60bR1-R21)
[[2]](diffhunk://#diff-5f7d9507b93b3c61d2035dd964d399e666e308be0cf46be8c358702c57b6927bR1-R22)
**UI integration:**
- Introduced a new CrashPlan SVG icon component (`CrashPlan.tsx`) and
mapped it in the software icon index for use in the UI.
[[1]](diffhunk://#diff-508f123066743b5b4f4de19a92f3aa6c1055e8cda2a5a9e8f57c99aed29df681R1-R14)
[[2]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR7)
[[3]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR282)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35007
# Details
This PR implements a new `StreamHosts` service method and utilizes this
method in `listHostsEndpoint`. The purpose of this method is to allow
the "list hosts" endpoint to stream a JSON response down one host at a
time (more or less), so that the entire JSON payload doesn't have to sit
in memory all at once. The response can be very large when software and
users are populated using the optional `populate_software` and
`populate_users` querystring options.
**Notes:**
* The `ListHosts` database method currently returns the entire result
set at once. The assumption with this iteration is that it was
populating the extra data in each host that was pushing the response to
untenable sizes. If we're still seeing OOM issues after this PR, we can
refactor to also use an iterator to stream rows from the database.
* The `listHostsEndpoint` method calls `StreamHosts` to get a host
iterator, but also creates its own iterator to supply to the response,
because we (sometimes) need to populate `Labels` on each host response
object. The `StreamHosts` method only returns `Host`s not
`HostResponse`s, hence the need for the wrapper.
* A new response type `StreamHostsResponse` was created because other
methods utilize the existing `ListHostsResponse`. We could keep just
`ListHostsResponse` and toggle how it responds based on whether an
iterator is provided, but keeping the types separate is simpler to
reason about and test.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [ ] Added/updated automated tests
- [X] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Hosts listing API now streams results incrementally for faster initial
responses and better performance on large inventories or complex
queries.
* Host details (optional labels, software and MDM info) are
progressively enriched and delivered as available, allowing partial
results while remaining data loads.
* Streaming provides clearer partial-error reporting so partial results
can be returned even when some enrichments fail.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request makes a minor update to the product maturity
assessment documentation. The macOS platform maturity indicator has been
changed from the duck emoji (🦆) to the chick emoji (🐥) for all listed
quarters.
- Updated the macOS maturity status in the product maturity table from 🦆
to 🐥 for all quarters in
`handbook/company/product-maturity-assessment.md`.
This pull request enhances the icon mapping logic for software names in
the `SoftwarePage` component, specifically ensuring that the Microsoft
Company Portal app is correctly associated with its icon, even when
referenced by its package name.
**Icon mapping improvements:**
* Added `"microsoft.companyportal"` to the `SOFTWARE_NAME_TO_ICON_MAP`
so that this package name is mapped to the `IntuneCompanyPortal` icon.
* Updated the `matchStrictNameSourceToIcon` function to explicitly
return the `IntuneCompanyPortal` icon when the software name is exactly
`"microsoft.companyportal"`.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35515Resolves#35494
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
---------
Co-authored-by: Jahziel Villasana-Espinoza <jahziel@fleetdm.com>
When Windows OS update settings (deadline_days and grace_period_days)
are configured via GitOps YAML, the configuration is saved but the
Windows Update CSP profiles are never deployed to enrolled devices.
Root cause: The GitOps code path (editTeamFromSpec) was missing the
deployment trigger that exists in the UI path (ModifyTeam).
This fix adds the missing deployment logic following the same pattern
used by macOS/iOS/iPadOS updates:
1. Track when Windows updates are edited (mdmWindowsUpdatesEdited flag)
2. After SaveTeam(), trigger CSP deployment via
mdmWindowsEnableOSUpdates() or mdmWindowsDisableOSUpdates() based on
whether deadline is set
The fix ensures GitOps and UI paths behave consistently for Windows OS
update management.
Fixes: Windows Update CSP deployment via GitOps
Related: ee/server/service/teams.go lines 379-408 (UI implementation)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37137
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
This pull request adds a new icon component import to the icon index
file. The change is minor and simply makes the `CompanyPortal` icon
available for use in the application.
This pull request adds support for managing 7-Zip as a maintained
Windows application. The changes include configuration for installation
and uninstallation, workflow updates to handle 7-Zip specifically in CI,
and a new icon for the frontend. These updates ensure that 7-Zip can be
detected, installed, uninstalled, and visually represented in the
software management system.
**Windows workflow and detection updates:**
- Updated `.github/workflows/test-fma-windows-pr-only.yml` to detect
changes related to 7-Zip, set a `has_7zip` output variable, and add a
step to remove pre-installed 7-Zip versions before proceeding with
further app verification. This prevents conflicts with pre-existing
installations during CI runs.
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR91)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR102)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR117-R124)
[[4]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR164-R227)
**7-Zip application configuration:**
- Added `ee/maintained-apps/inputs/winget/7-zip.json` to define 7-Zip as
a maintained app with metadata such as slug, package identifier,
installer type, and categories.
- Added `ee/maintained-apps/outputs/7-zip/windows.json` with version
info, installation and uninstallation scripts, SHA256, and upgrade code
for 7-Zip, enabling automated install/uninstall flows.
- Updated `ee/maintained-apps/outputs/apps.json` to include 7-Zip in the
list of available apps, with a description and unique identifier for
display and selection.
**Frontend icon support:**
- Added a new React SVG icon component for 7-Zip at
`frontend/pages/SoftwarePage/components/icons/7Zip.tsx`.
- Registered the 7-Zip icon in the icon index and mapped it in
`SOFTWARE_NAME_TO_ICON_MAP` to display the icon for 7-Zip in the UI.
[[1]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR7)
[[2]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR224)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#32920
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
This pull request makes a minor update to the icon imports on the
Software Page by removing the unused `CompanyPortal` import from the
`icons/index.ts` file.
This pull request adds support for two new macOS applications, Calibre
and Dash, to the maintained apps system. The changes include the
necessary metadata, installation and uninstallation scripts, and icon
assets, as well as updates to the main app listing.
**New Application Support**
* Added input metadata for Calibre in `homebrew/calibre.json`, including
identifiers, installer format, and categories.
* Added input metadata for Dash in `homebrew/dash.json`, including
identifiers, installer format, and categories.
**App Catalog Updates**
* Updated `outputs/apps.json` to include Calibre with a description and
identifiers.
* Updated `outputs/apps.json` to include Dash with a description and
identifiers.
**Installer and Uninstaller Scripts**
* Added versioned output and install/uninstall scripts for Calibre in
`outputs/calibre/darwin.json`.
* Added versioned output and install/uninstall scripts for Dash in
`outputs/dash/darwin.json`.
**Frontend Icon Assets**
* Added a new React SVG icon component for Calibre in `Calibre.tsx`.
This pull request adds support for the AppCleaner application to the
maintained apps system, including its metadata, installation, and
uninstallation scripts. The changes define how AppCleaner should be
recognized, installed, and uninstalled on macOS, and make it available
in the maintained apps catalog.
**AppCleaner integration:**
* Added a new input definition for AppCleaner in `appcleaner.json`,
specifying its metadata such as name, unique identifier, installer
format, and default category.
* Added a new output definition for AppCleaner in
`appcleaner/darwin.json`, including version information, SQL query for
existence, installer URL, SHA256 checksum, and detailed install and
uninstall scripts.
* Updated `apps.json` to include AppCleaner in the list of maintained
applications, making it available for discovery and installation via the
maintained apps system.
