<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48720
Subtask of https://github.com/fleetdm/fleet/issues/43488
This PR only adds the Windows config, and doesn't mess with macOS
configs.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added managed local account settings for Windows to app and team
configuration, including GitOps support.
* Exposed an explicit enabled/disabled toggle in configuration output
and Fleet controls.
* Added licensing and Windows MDM prerequisites for enabling the
setting.
* **Bug Fixes**
* Managed local account enable/disable actions are now correctly
persisted and declaratively applied.
* Activity feed messages now display platform-specific (macOS vs
Windows) wording.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
My workstation has Docker Desktop 4.84.0 (latest as of today) and was
incorrectly failing the "macOS - Docker Desktop up to date" patch
policy.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved Docker Desktop patch-status detection on macOS by excluding
application paths containing `.back` anywhere in the path, avoiding
incorrect patching of nested/backup bundles.
- **Improvements**
- Enhanced Docker Desktop install and uninstall cleanup to remove stale
`Docker.app.back` artifacts and related staged in-progress update copies
(including cleanup during upgrade timing).
- **Tests**
- Updated macOS Docker Desktop ingestion/patched check expectations to
match the new `.back` path filtering behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A
Pins the macOS Fleet-maintained app for Yubikey Manager at its current
output version, `1.2.5`, by setting `"frozen": true` on the Homebrew
input.
- `ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json` —
added `"frozen": true`
The flag is read by the ingester into the manifest
([`homebrew/ingester.go`](https://github.com/fleetdm/fleet/blob/main/ee/maintained-apps/ingesters/homebrew/ingester.go))
and then consumed in two places:
-
[`cmd/maintained-apps/main.go`](https://github.com/fleetdm/fleet/blob/main/cmd/maintained-apps/main.go)
skips overwriting `outputs/yubico-yubikey-manager/darwin.json` when the
output file already exists, so the published version, installer URL,
SHA256, and patch-policy query stop moving.
-
[`cmd/maintained-apps/validate/main.go`](https://github.com/fleetdm/fleet/blob/main/cmd/maintained-apps/validate/main.go)
skips the app entirely during validation.
`frozen` is tagged `json:"-"` on the manifest struct, so it does not
appear in the output JSON — that file is intentionally left untouched by
this PR.
The Windows FMA (`inputs/winget/yubico-yubikey-manager.json`) is
deliberately **not** frozen and continues to update.
## Note for reviewers
While preparing this change I found that the `yubico-yubikey-manager`
cask has been **removed from homebrew-cask**:
```
https://formulae.brew.sh/api/cask/yubico-yubikey-manager.json → 404
```
The full cask list now contains only `pallotron-yubiswitch`,
`yubico-authenticator`, and `yubihsm2-sdk`, and the token is not present
in `inputs/homebrew/custom-tap/` either. This matches upstream: Yubico
discontinued `yubikey-manager-qt` (the 1.2.5 installer this FMA pins) in
favor of Yubico Authenticator.
**Freezing does not resolve that 404.** The ingester fetches cask
metadata *before* the frozen flag is applied, so the scheduled "Update
Fleet-maintained apps" workflow is still expected to fail for this app
with:
```
panic: ingesting homebrew app: app not found in brew API
```
Fully resolving that would mean removing the macOS FMA, the way #50050
did for Nocturnal (input, output, `apps.json` entry, frontend icon +
mapping, website PNG). This PR is scoped to the freeze only, per the
request; the removal can be a follow-up if that is the direction we
want.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually — confirmed the edited
input still parses as JSON, and traced the `frozen` flag through the
ingester into both the output-write skip and the validation skip. No
automated tests were added; this is a single data-file flag with no new
code paths.
---------
Co-authored-by: Kitzy <kitzy@kitzy.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
**Related issue:** N/A — Windows Fleet-maintained app (FMA) coverage for
apps found deployed in a customer's ManageEngine SDP environment but
missing from Fleet.
## What this does
Adds **6** Windows Fleet-maintained apps — the subset of a larger batch
that passes the FMA validator cleanly. Each has a winget-sourced input,
a generated output manifest, and a catalog icon. Detection identity was
verified against each app's real registry DisplayName; apps whose
DisplayName carries a version suffix use fuzzy name matching, the rest
match exactly.
**MSI (clean, auto upgrade-code uninstall):**
- **Git Extensions** — versioned ARP name (`Git Extensions 7.2.0.92`) →
fuzzy match
- **TightVNC**, **Yarn**, **SonicWall NetExtender** (WiX), **Zoom
Outlook Plugin** — clean ARP names → exact match
**EXE — NSIS (custom `/S` install + registry-lookup uninstall):**
- **Spyder** — versioned ARP name (`Spyder 6`) → fuzzy match
## Notes
- **Detection verification.** Every app's `unique_identifier` (registry
DisplayName / osquery `programs.name`) and publisher were verified per
the `new-fma` skill against winget `AppsAndFeaturesEntries`, MSI
Property tables (`msiinfo`), and vendor installer scripts — not assumed.
Git Extensions' MSI `ProductName` is `Git Extensions 7.2.0.92` and
Spyder's ARP entry is `Spyder 6`, so both need `fuzzy_match_name`; the
four exact-match apps were confirmed clean (e.g. TightVNC registers as
`TightVNC`, not a versioned string).
- **Validated on a real Windows host.** All six pass the FMA CI
validator (install → detect → uninstall) on the SYSTEM-context Windows
runner.
- **Icons.** Git Extensions, SonicWall NetExtender, TightVNC, Yarn, and
Zoom Outlook Plugin ship new catalog icons + website assets; Spyder
reuses the existing `Spyder` icon.
## Testing
- [x] FMA CI validator (install → detect → uninstall) on the
SYSTEM-context Windows runner.
- Generated outputs verified locally: all 6 produce valid manifests; MSI
apps carry the correct UpgradeCode-based uninstall; exists/patched
queries reviewed for name + publisher correctness; `go test
./ee/maintained-apps/...` passes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added maintained Windows catalog entries for Git Extensions, SonicWall
NetExtender, Spyder, TightVNC, Yarn, and Zoom Outlook Plugin, including
silent install, version upgrade detection, and maintenance-ready
uninstall flows.
* Added new software icons for these apps and expanded icon matching so
they display correctly in the catalog.
* **Bug Fixes**
* Improved Spyder Windows uninstall targeting and command/argument
handling for more reliable removals.
* **Documentation**
* Refreshed Spyder supported version details to 6.1.5.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
**Related issue:** N/A — fixes the failing scheduled "Update
Fleet-maintained apps" workflow
The `nocturnal` cask was removed from homebrew-cask on 2026-07-28
([Homebrew/homebrew-cask@517db75](https://github.com/Homebrew/homebrew-cask/commit/517db75b78))
after being deprecated on 2024-07-27 and disabled on 2025-07-27, both
`because: :unmaintained` (upstream repo's last push was in 2018). The
brew API now returns 404 for it, so the maintained-apps ingester panics:
```
panic: ingesting homebrew app: app not found in brew API
```
This removes Nocturnal as a Fleet-maintained app, following the same
pattern as #46541 (Messenger) and #47420 (Dell Display Manager):
- `ee/maintained-apps/inputs/homebrew/nocturnal.json` — Homebrew input
- `ee/maintained-apps/outputs/nocturnal/darwin.json` — macOS output data
- `ee/maintained-apps/outputs/apps.json` — Nocturnal entry
- `frontend/pages/SoftwarePage/components/icons/Nocturnal.tsx` and its
import/mapping in `index.ts`
- `website/assets/images/app-icon-nocturnal-60x60@2x.png`
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually (verified `apps.json`
still parses, no remaining `nocturnal` references, ESLint passes on the
icons index)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Removed Apps**
- Removed Nocturnal from the maintained application catalog.
- Removed its installation and uninstallation support.
- Removed the Nocturnal icon from software listings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the Windows Discord package to version 1.0.9250.
* Updated the installer download reference and verification checksum.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Refreshed maintained application packages to their latest releases
across macOS and Windows.
* Updated ActiveDock, AWS CLI, BetterZip, Cursor, Docker Desktop,
DuckDuckGo, EagleFiler, Figma, Firefox, Garmin Express, Hive, iMazing,
Kiro CLI, Loom, LuLu, Microsoft Edge, Nessus Agent, Notepad, Ollama,
PyCharm, Reqable, Spokenly, SQL Server Management Studio, Telegram, and
Zed.
* Updated download links and verification checksums to match the new
installers.
* Improved uninstall or installation behavior for select applications,
including Figma, iMazing, and Ollama.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for the latest releases of Air Explorer, Appium
Inspector, BetterZip, GeoGebra Classic, Google Drive, Grammarly,
Melodics, NordLayer, Opencode, Screen Studio, VoiceInk, WhatsApp,
RealVNC Server, Firefox Nightly, and Zed.
* **Bug Fixes**
* Refreshed download links and integrity checks for updated application
packages.
* Improved uninstall cleanup for Elgato Control Center, Kiro, Marked,
Mellel, PureVPN, Reqable, and Rize.
* Improved Zed removal by closing the app before deleting its files.
* Updated SourceTree package metadata to the latest available installer.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#47700
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually. **_Not able to do for
all code paths yet_**
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added `token_invalid` for Apple Business Manager tokens, automatically
tracked based on Apple responses.
* Enhanced host DEP assignment API responses with a structured
`dep_device_error` field to classify why device details couldn’t be
retrieved.
* **Bug Fixes**
* Improved error handling for DEP device lookup, distinguishing
invalid/rejected tokens, expired terms, not-found devices, server/API
errors, and unavailable/unspecified failures.
* Added regression and unit test coverage for ABM token invalidation and
DEP device error classification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49511 and #46837 as a whole
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for Fleet built-in variables in host scripts, software
installer scripts, setup-experience scripts, and maintained-app
installer scripts.
* Variables are resolved per host at execution time; saved content
remains unexpanded.
* **Bug Fixes**
* Requests now validate Fleet variables up-front, with clear
script-specific error messages for unsupported variables.
* Added improved messaging when variable resolution fails during
execution.
* Enforced Fleet Premium licensing for script/installer flows that use
Fleet variables.
* **Documentation**
* Documented supported variables and Premium requirements, including
usage examples.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Mellel for macOS to version 6.7.1.
* Updated OnlySwitch for macOS to version 2.7.2.
* Updated Reqable to version 3.2.15 on macOS and Windows.
* Updated Visual Studio Code for Windows to version 1.130.0.
* Refreshed installer links and verification data for each release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated AnyDesk for macOS to version 9.7.3.
- Updated Elgato Control Center for macOS to version 1.9.
- Updated Firefox Nightly on macOS and Windows to newer builds.
- Updated Marked, Notepad, PureVPN, Rize, Syncovery, and Zettlr for
macOS.
- Updated Zettlr for Windows to version 4.7.0.
- Refreshed download links and verification checksums for applicable
installers.
- Updated installed-version detection so devices correctly recognize the
latest releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated macOS and Windows installation metadata for Kiro, including
version 1.0.228 installers and checksums.
* Updated macOS installation metadata for Notepad to version 1.5.8.
* Updated Firefox Nightly macOS installer metadata to a newer build.
* **Bug Fixes**
* Improved uninstall cleanup for Antigravity IDE, DevKnife, Dot,
IsThereNet, Jellyfin, QLMarkdown, and RetroArch by correcting cleanup
targets and Trash handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated the Franz macOS app to version 6.5.2.
* Updated the Ollama Windows app to version 0.32.4.
* Refreshed download links and verification checksums for both
applications.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added the latest available releases for numerous maintained apps
across macOS and Windows, including ClickUp, OBS Studio, WeChat, Ollama,
Arc, GoLand, and others.
* Updated download packages and verification data so installations use
the correct release artifacts.
* **Bug Fixes**
* Improved upgrade detection for updated app versions.
* Refined cleanup behavior for CapCut and Pastebot during
uninstallation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** N/A — part of the ongoing Windows Fleet-maintained
apps (FMA) parity workstream (letter I).
## What this does
Adds **17** Windows Fleet-maintained apps for the letter-I batch.
apps.json descriptions follow the house `"<Name> is a …"` convention.
**IBM Semeru Runtime Open Edition (Java) — 8 apps** (MSI, machine, x64):
JDK 8/11/17/21 and JRE 8/11/17/21. Per-major detection follows the
Eclipse Temurin pattern — `name LIKE 'IBM Semeru Runtime Open Edition
(JDK|JRE)%' AND publisher = 'Semeru' AND version LIKE '<major>.%'` — so
majors and JDK/JRE never cross-match. All 8 share the IBM Semeru logo.
**Other apps (9):**
- **IronPython 3** — MSI; fuzzy `IronPython 3%` (excludes the EOL v2)
- **ImageGlass** — dual-scope MSI, custom `ALLUSERS=1` install
- **install4j** — install4j installer (bundled JRE), `-q`
- **IrfanView** — custom installer `/silent /allusers=1`; versioned+arch
name → fuzzy `IrfanView%`
- **iMazing HEIC Converter**, **IsoBuster**, **ImpExpPro** — Inno Setup
(`/VERYSILENT`)
- **Infix PDF Editor** — Inno, x86
- **Ibis Calculeren voor Bouw** — InstallShield wrapper; uninstall via
the MSI UpgradeCode (`uninstall_type: msi`)
## Dropped from this batch (recorded in the workstream tracker)
- **IBM Aspera Connect** — MSI installs per-user by default
(`ALLUSERS=2`/`MSIINSTALLPERUSER=1`, no machine switch in the manifest)
+ a rolling `/latest/` URL that 404s on the next release.
- **IcedTea-Web** (Azul and AdoptOpenJDK) — both declare a hard,
unbundled JRE dependency; it's a JNLP launcher that's dead-on-arrival
without Java the FMA won't install (AdoptOpenJDK variant is also
archived).
- **IronPython 2** — EOL (Python 2). **install4j 9** — legacy 2022
build. **IrfanView PlugIns** — add-on that drops DLLs with no
independent ARP entry (undetectable) and depends on the base app.
- **Intermedia Unite** and its **Teams Desktop Plugin** — both use
non-versioned "latest" URLs (winget-bot auto-updated; the pinned SHA
rots each release); the plugin also depends on Teams + Unite.
## Notes
- **Ibis Calculeren voor Bouw**, **ImpExpPro**, and **Infix PDF Editor**
ship without a catalog icon — no clean ≥256px first-party logo exists
for these niche apps (they fall back to the generic icon).
- **Ibis** carries some risk: its DisplayName couldn't be verified
offline (compressed InstallShield payload) and its installer URL is
non-versioned — flagging for the validator; will drop if
detection/version fails.
- **IsoBuster** uses a non-versioned URL that currently matches the
pinned 5.8, so no `ignore_hash`; winget re-ingestion tracks future
drift.
- Verification (installer type/scope/arch, ProductCode/UpgradeCode,
dependencies, silent switches, URL stability, en-US locale) was done per
the `new-fma` skill against the winget-pkgs manifests, with several
DisplayNames confirmed via `innoextract`/`msitools`.
## Testing
- [ ] FMA CI validator (install → detect → uninstall) on the
SYSTEM-context Windows runner — pending.
- Generated outputs verified locally: all 17 produce valid manifests;
per-major Semeru queries and MSI UpgradeCode uninstalls confirmed; all
apps.json descriptions present and convention-compliant.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated managed app installers and metadata to the latest available
versions for AWS CLI, Brave Browser, ChatGPT, Fellow, Granola, Microsoft
Edge, OpenCode Desktop, and Visual Studio Code.
* Refreshed download links and integrity checksums to match the new
installer packages.
* Updated version detection to recognize the latest releases across
Windows and macOS.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Chef Workstation for Windows to version 25.14.2.1.
* Updated Firefox Nightly for Windows to build 155.2607.2409.0.
* Updated Prisma Access Browser for Windows to version 150.49.8.187.
* Refreshed installer download links and verification checksums for each
application.
* Updated version detection so the latest releases are correctly
recognized as installed and current.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated LibreOffice’s Windows download source for version 26.2.4.2.
* Updated Miro to version 0.11.164.
* Updated Mullvad Browser to version 15.0.19.
* Updated Proxyman to version 6.14.0, including improved removal
cleanup.
* Updated Reqable to version 3.2.14.
* Updated Vivaldi to version 8.1.4087.58.
* Refreshed installer links, checksums, and version detection for each
updated application.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
## Issue
Closes#47290
Also implements the "Cap free-text `maxLength` to the backend column
length" pattern established in [#49041 (patterns.md
thread)](https://github.com/fleetdm/fleet/pull/49041/files#r3572648691).
## Description
Fleet name inputs had no `maxLength` cap and no service-layer length
check, so a name >255 chars failed with a raw MySQL `Data too long`
error, and several UI surfaces didn't handle long names gracefully. This
PR fixes all four manifestations called out in the bug, plus a related
label-overflow case on the host details page, and hardens adjacent name
inputs across the app.
**Frontend fixes for #47290:**
- Create/Rename fleet name inputs now cap at 255 characters (matches
`teams.name varchar(255)`).
- Fleets table Name column uses `LinkCell` with `tooltipTruncate` +
`className="w400"` so long names truncate with an ellipsis and full-name
tooltip instead of overflowing across the Hosts/Users columns.
- Fleet-detail page header (`.team-details__team-header`): h1 gets
`overflow: hidden; text-overflow: ellipsis; white-space: nowrap;`,
`__team-details` gets `min-width: 0; flex: 1`, and `.action-buttons`
gets `flex-shrink: 0` + `white-space: nowrap` on buttons so *Manage
enroll secrets / Rename / Delete* no longer wrap to a second line when
the fleet name is long.
- Manage enroll secrets modal body — `__description` gets
`overflow-wrap: anywhere; min-width: 0` so a long `<b>{fleet name}</b>`
wraps within the modal instead of spilling out the right edge.
**Backend fixes for #47290:**
- New `fleet.MaxTeamNameLength = 255` constant.
- `NewTeam`, `ModifyTeam`, and `ApplyTeamSpecs` now return
`fleet.NewInvalidArgumentError("name", "may not exceed 255 characters")`
instead of surfacing a raw `Data too long` MySQL error. Covers UI, API,
and GitOps entry points.
**Broader consistency pass (per [#49041
thread](https://github.com/fleetdm/fleet/pull/49041/files#r3572648691)):**
- New shared `MAX_ENTITY_CHAR_LENGTH = 255` constant in
`frontend/utilities/constants.tsx`.
- Refactored 8 existing files that had ad-hoc `NAME_MAX_LENGTH = 255` /
`MAX_LABEL_NAME_LENGTH = 255` locals to use it.
- Slotted it into 16 additional `InputField` name/description inputs
that were missing a cap (API user, custom variable, certificate, label
name + description, pack name + description, and all 5 CA forms —
CustomEST, CustomSCEP, Smallstep, Digicert, Hydrant).
- Pruned dead FE length validators that can no longer fire now that the
DOM cap enforces the limit (certificate modal, custom variable modal,
both label helpers, both category modals). Unusual/shorter caps (e.g.
`varchar(64)`, custom business rules) still keep their inline validators
— silent truncation is only appropriate for the common 255-char norm.
**Bonus:** fixed the long-label overflow on the host details Labels card
by capping the pill button `max-width` at 300px.
## Screenrecording
https://github.com/user-attachments/assets/b917b72e-7437-4d0c-a1a1-c49b4b1c28bahttps://github.com/user-attachments/assets/3a3efbb2-09d8-4f47-9fd4-f158b3453b9ehttps://github.com/user-attachments/assets/73e5e022-dc93-4381-82b3-be9549d050e6
Latest - max width 300px long label:
<img width="1106" height="262" alt="Screenshot 2026-07-23 at 11 29
24 AM"
src="https://github.com/user-attachments/assets/741fddbd-f78d-4578-a025-bddf64a81c25"
/>
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Test coverage:
- `CreateFleetModal.tests.tsx`, `RenameFleetModal.tests.tsx` — new case
per file asserting the name input's `maxLength === 255`.
- `AddCertificateModal.tests.tsx`, `Variables.tests.tsx` — the existing
"shows too-long error when pasting 256 chars" tests are now unreachable
via the DOM cap; converted to `maxLength === 255` assertions.
- `ee/server/service/teams_test.go` — `TestNewTeamNameValidation`,
`TestModifyTeamNameValidation`, and `TestApplyTeamSpecsNameValidation`
each get two new cases (accepts at the limit, rejects one over with the
expected error message).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Limited fleet, team, and other user-entered names and descriptions to
255 characters.
* Replaced database errors for oversized names with clear validation
messages.
* Prevented long fleet and label names from overflowing tables, headers,
modals, and host details.
* Improved modal and dropdown layouts for long text.
* **Tests**
* Added coverage for character limits, boundary values, and multibyte
names.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated the Firefox Nightly macOS installer to the latest build and
refreshed its verification details.
* Updated the LibreOffice macOS installer to version 26.2.5, including
its download link and verification details.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Refreshed maintained application releases across Windows and macOS,
including BrowserStackLocal, Bruno, Canva, ChatGPT, Claude, CLion,
Cursor, Draw.io, Dropbox, GOG GALAXY, GoLand, Google Chrome, Kitty,
Downie, and Splice.
- Updated installer download links and integrity checksums where
applicable.
- Improved release detection so systems recognize the latest versions
and apply updates correctly.
- Updated Dropbox’s uninstall handling for its new installer release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated macOS and Windows release metadata for Insomnia to version
13.1.0.
* Updated macOS releases for Kiro (1.0.212), Melodics (5.0.871),
Microsoft Edge (150.0.4078.96), and Wispr Flow (1.6.224).
* Updated Firefox Nightly’s minimum eligible patched build.
* **Bug Fixes**
* Updated installer download links and checksums to match the latest
application releases, improving installation and update reliability
across supported platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the maintained Kiro for Windows package to version 1.0.212.
* Refreshed the installer reference and verification details for the new
release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated AWS CLI for Windows to version 2.36.7.
- Updated BetterTouchTool for macOS to version 6.663.
- Updated Box Drive for macOS to version 2.53.219.
- Updated Google Chrome for Windows to version 150.0.7871.187.
- Updated Telegram Desktop’s download source for version 7.0.5.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated maintained app installers to the latest versions for Beeper,
ChatGPT, FreeCAD, Kiro CLI, Ollama, Pastebot2, Remote Desktop Manager,
Superhuman, and Thunderbird.
* Refreshed download links, compatibility checks, and verification data
for each update.
* Improved Ollama and Pastebot2 macOS uninstall cleanup behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added frozen status to Pritunl package configurations, preventing
automatic version changes.
* **Updates**
* Refreshed maintained application packages across Windows and macOS,
including Firefox, Bitwarden, Postman, Arc, Granola, PhpStorm, WebStorm,
Bruno, and others.
* Updated download links and integrity checks to match the latest
available installers.
* Improved version detection so upgrades are recognized correctly for
each refreshed release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added/updated managed release definitions for many applications on
both macOS and Windows.
* Updated the Mozilla VPN installer script to better handle MSI installs
in automation.
* Marked Typora for frozen behavior in winget to prevent unintended
updates.
* **Bug Fixes**
* Refreshed download links and integrity checksums across updated app
versions.
* Improved version detection for newly released builds.
* **Improvements**
* Enhanced uninstall behavior for select apps (additional
cleanup/services and improved media handling for ONLYOFFICE macOS).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49736
Adds **Airtable** (`Formagrid.Airtable`) as a Fleet-maintained app for
Windows, grouped with the existing macOS Airtable FMA under the shared
name `Airtable`.
## What changed
- `ee/maintained-apps/inputs/winget/airtable.json` — winget input
(`neutral` arch, `exe`, `user` scope).
- `ee/maintained-apps/inputs/winget/scripts/airtable_install.ps1` —
install script.
- `ee/maintained-apps/inputs/winget/scripts/airtable_uninstall.ps1` —
uninstall script.
- `ee/maintained-apps/outputs/airtable/windows.json` — generated output.
- `ee/maintained-apps/outputs/apps.json` — catalog entry + description.
## Reviewer notes
- **Identity verified against the real installer, not the catalog.**
Downloaded `AirtableSetup1.4.5.exe` (SHA256 matched the winget manifest
exactly) and extracted the embedded Squirrel nuspec:
`<title>Airtable</title>` → registry DisplayName `Airtable`
(`unique_identifier`); `<authors>Airtable</authors>` → registry
Publisher `Airtable`. Publisher matches the winget locale, so no
`program_publisher` override is needed. exists query: `... WHERE name =
'Airtable' AND publisher = 'Airtable'`.
- **Per-user Squirrel installer.** Manifest is `InstallerType: exe`,
`Scope: user`, `Silent: --silent` (Squirrel signature). Run directly as
Local System it would install into the SYSTEM profile and lock its own
`.exe`, so the install uses the **Figma/Postman scheduled-task pattern**
— it runs `--silent` in the logged-on user's session. Uninstall does a
defensive HKLM+HKCU registry lookup and runs Squirrel's `Update.exe
--silent`.
- `installer_arch: neutral` matches the manifest (Dynalist precedent).
The binary is x86; it runs on x64 and ARM64 via emulation and routes to
`windows-latest`.
- Installer URL is version-pinned (`AirtableSetup1.4.5.exe`), not a
"latest" redirect, so the pinned SHA won't silently drift.
- Icon already exists (frontend `airtable` key + website PNG). No shared
Go code changed; no validator rebuild needed.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually (winget manifest +
installer identity verified; output regenerated via `go run
cmd/maintained-apps/main.go --slug="airtable/windows"`; `apps.json`
valid JSON, additions-only diff)
<!-- FMA-only content change: no changes/ entry, DB migration, config
setting, or fleetd change. -->
**Related issue:** Resolves#49737
Adds **Podman Desktop** (`RedHat.Podman-Desktop`, v1.28.3) as a Windows
Fleet-maintained app. It pairs with the existing `podman-desktop/darwin`
FMA under the same catalog name, so the two group together in the FMA
library and share the existing icon.
## What changed
- `ee/maintained-apps/inputs/winget/podman-desktop.json` — input
manifest (x64, machine scope, `exe`/NSIS)
- `ee/maintained-apps/inputs/winget/scripts/podman-desktop_install.ps1`
/ `_uninstall.ps1` — custom install/uninstall scripts
- `ee/maintained-apps/outputs/podman-desktop/windows.json` — generated
output
- `ee/maintained-apps/outputs/apps.json` — new Windows catalog entry;
also reworded the existing macOS description to the standard "`<App>` is
a(n)…" format for consistency
## Identity verification (verified, not guessed)
Podman Desktop ships as an **electron-builder NSIS** installer, and the
winget metadata does **not** match what osquery sees on a host. I
decompressed the NSIS header and traced electron-builder's source to
confirm the registry identity:
- **DisplayName** = `Podman Desktop 1.28.3` → `unique_identifier:
"Podman Desktop"` with `fuzzy_match_name` (matches the version-suffixed
name).
- **Publisher** = `Podman Desktop` — derived from the package's
`author.name` (`COMPANY_NAME` → registry `Publisher`), **not** the
winget locale's `RedHat`. Using "RedHat" would have made the exists
query silently never match on real hosts.
- **SHA256** matches the winget manifest exactly; version `1.28.3`
equals the registry `DisplayVersion`, so the patch policy reconciles
cleanly.
Silent install uses `/S /ALLUSERS`; uninstall does a registry lookup
with the defensive three-shape UninstallString parser and mirrors `/S
/ALLUSERS`, following the proven `another-redis-desktop-manager`
electron-builder machine-scope pattern.
## Reviewer notes
- **x64 only.** The winget manifest also has an arm64 installer, but the
repo has no arm64 FMA inputs yet (x64 is the established convention). A
separate arm64 slug can be added later.
- Installer URL is a **pinned GitHub release** asset (not a "latest"
redirect), so the SHA is stable until the FMA auto-updater bumps the
version.
- No shared Go code changed — only FMA input/output data.
## Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Generated the output via `go run cmd/maintained-apps/main.go
--slug="podman-desktop/windows" --debug`; verified exists/patched
queries, pinned SHA matches the winget manifest, and `apps.json` is
valid JSON.
- [ ] QA'd install/uninstall on a Windows host (will be exercised by the
FMA validator).
**Related issue:** Resolves#49738
Adds **Box Tools** as a Fleet-maintained app for **Windows** (winget
`Box.BoxTools`) and **macOS** (Homebrew cask `box-tools`).
## Windows details (verified against the real installer)
- Installer: `BoxToolsInstaller-AdminInstall.msi` (machine-wide admin
MSI, `ALLUSERS=1`), x64.
- MSI Property table verified with msitools: `ProductName` = `Box
Tools`, `Manufacturer` = `Box`, `ProductVersion` = `4.32.0.1324` — all
match the winget manifest, so `unique_identifier: "Box Tools"` and the
generated exists query (`name = 'Box Tools' AND publisher = 'Box'`)
match what osquery reports from the registry. No `program_publisher`
override needed.
- The winget manifest has no `Scope`, so `installer_scope: "machine"` is
set in the input (confirmed by `ALLUSERS=1`).
- ProductCode/UpgradeCode match the manifest; standard auto-generated
machine-MSI install + upgrade-code uninstall scripts.
- Downloaded SHA256 matches the manifest SHA (`9f5958...c5066`).
- No sibling-name collision with the existing Box Drive FMA (its
DisplayName is `Box`; matching is exact).
## macOS details
Box Tools on macOS is **per-user only**: the cask installs the app
bundles to `~/Library/Application Support/Box/Box Edit/`, Box's admin
`.pkg` forbids the local system domain (`enable_localSystem="false"`),
and [Box's large-scale deployment
docs](https://support.box.com/hc/en-us/articles/360043695834-Large-Scale-Deployments-Box-Tools)
instruct running the installer as the console user (multi-user Macs are
not a supported configuration).
Because the install location is outside osquery's `apps` directory scan
paths, detection relies on osquery's LaunchServices enumeration
(`_LSCopyAllApplicationURLs` in `genApps`), which surfaces the bundles
regardless of location — verified against a live install where all four
Box Tools bundles are LaunchServices-registered at the per-user path and
appear in the `apps` table.
- `unique_identifier: com.Box.Box-Edit` (verified `CFBundleIdentifier`
of `Box Edit.app` in the DMG).
- **Custom install script** (the cask's app artifacts are all
`target:`-style, which the script generator skips, so the auto-generated
script would be a no-op): resolves the console user (falling back to
`lastUserName` when run while logged out), quits the Box apps, copies
the four app bundles from the DMG's `Install Box
Tools.app/Contents/Resources/` into the user's `~/Library/Application
Support/Box/Box Edit/` (replicating the cask/pkg payload exactly),
chowns them, and registers them with LaunchServices in both root and
user contexts so inventory and box.com pick them up without a first
manual launch.
- **Custom uninstall script**: quits/kills the Box Tools processes and
removes `Box Edit` from every local user's home. The parent `Box`
directory is shared with Box Drive, so it is only removed if left empty.
- The cask uses `sha256 :no_check` (rolling `currentrelease` URL) — the
established FMA convention for such casks (same as Google Chrome/VS Code
darwin); the server pins the hash of what it downloads at add time.
- Cask version is `4.32` while `CFBundleShortVersionString` is `4.32.0`;
the validator's prefix matching and the patched query's
`version_compare` both treat these as consistent.
## Shared caveat
⚠️ Both installer URLs are rolling `currentrelease` links. On Windows
the pinned SHA will drift when Box ships a new build until the FMA
auto-update ingests the new manifest; macOS uses `no_check` per the
cask.
## Icon
Generated from the official 512×512 Box Tools icon shipped inside the
vendor DMG via `tools/software/icons/generate-icons.sh` (frontend
`BoxTools.tsx` + map entry, website `app-icon-box-tools-60x60@2x.png`).
Both platforms share the icon via the common `name`/slug.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Verified installer identity fields (MSI Property table, Info.plist
bundle identifiers/versions) with msitools/PlistBuddy against the live
installers; Windows output SHA matches the winget manifest.
- [x] Verified on a live macOS install that the per-user Box Tools
bundles are LaunchServices-registered and visible to osquery's `apps`
table.
- [ ] FMA validation CI (Windows + macOS runners) to confirm
install/uninstall/detection.
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Box Tools support for both Windows and macOS.
* Added Box Tools install, upgrade, and uninstall handling for the
maintained app catalog.
* Published Box Tools metadata to the software catalog (including
platform-specific entries and version targeting).
* Added a Box Tools icon to the software interface for improved name
matching.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A — part of the ongoing Windows Fleet-maintained
apps (FMA) parity workstream (letter H).
## What this does
Adds **5** Windows Fleet-maintained apps for the letter-H batch, each
with a winget-sourced input, generated output manifest, and a
first-party catalog icon.
- **HashTools** — Inno Setup, machine, x64. File-checksum utility
(Binary Fortress). Has an evergreen WebView2 dependency (present on
virtually all fleets; core hashing works without it).
- **HeidiSQL** — Inno Setup, machine, x64. Custom install passes
`/ALLUSERS` for machine scope (the ingester doesn't forward manifest
`Custom` switches).
- **HWMonitor** — Inno Setup, machine, x86. ARP DisplayName is `CPUID
HWMonitor`; installs a kernel driver removed by its uninstaller.
- **HP Prime Virtual Calculator** — WiX burn bundle, machine, x64. Uses
a name-only exists query (the ARP publisher is MORAVIA Consulting, not
the manifest's "HP").
- **Huddle** — InstallShield exe (`/exenoui /quiet`), machine, x86.
Uninstall via the MSI UpgradeCode (`uninstall_type: msi`); `ignore_hash`
for the non-versioned installer URL.
## Dropped from this batch (recorded in the workstream tracker)
- **HandBrake** — the GUI declares an unbundled
`Microsoft.DotNet.DesktopRuntime.10` dependency (won't run without it);
the CLI is a portable zip with no Add/Remove Programs entry to detect.
- **HiPIN** (`KPN.HIPIN`) — unbundled VCRedist + WebView2 dependencies,
a non-versioned "latest" URL, and no ARP DisplayName/ProductCode. The
`binbat.whipinto` candidate is an unrelated WebRTC tool (mismatch).
## Notes
- **Huddle** uses a non-versioned `HuddleSetup.exe` URL — if the vendor
ships past 4.8.0.0, osquery version detection may drift (same pattern
that failed GoodSync in letter G). Flagging for the validator; will drop
if it can't match.
- Verification (winget manifest identity, installer type/scope/arch,
ProductCode/UpgradeCode, silent switches, dependencies, URL stability)
was done per the `new-fma` skill against the winget-pkgs manifests.
## Testing
- [ ] FMA CI validator (install → detect → uninstall) on the
SYSTEM-context Windows runner — pending.
- Generated outputs verified locally: all 5 produce valid manifests;
exists/patched queries reviewed; Huddle's MSI UpgradeCode uninstall
auto-generated correctly.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49756
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Custom SCEP proxy challenges can again include characters such as
underscores.
* Apple device enrollment works again with these challenges.
* Removed the overly strict printable-character validation from the
Custom SCEP configuration form.
* The Challenge field now only enforces the required-value rule and no
longer shows printable-character validation errors.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49367
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added “Release from Apple Business” for eligible Apple hosts,
including per-device success/failure reporting and activity logging.
* Added a new API endpoint to trigger the action and return results for
each selected host with clear error details.
* Introduced authorization rules for global admins and team admins to
release only within allowed scope.
* **Bug Fixes**
* Improved validation and error handling: rejects oversized selections,
reports unknown/ineligible hosts and DEP-related failures per device,
and treats assignment-cleanup failures as non-blocking.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for the latest releases of numerous desktop applications
across macOS and Windows, including Amazon Corretto, Claude, Kiro,
Postman, Tableau, Thunderbird, and others.
* Updated installer downloads and integrity checks for newly available
versions.
* **Bug Fixes**
* Improved app removal by quitting running applications before cleanup
for select apps.
* Updated uninstall cleanup paths for newer application versions.
* **Maintenance**
* Refreshed version detection and upgrade checks across the maintained
application catalog.
* Updated Telegram’s download source for improved installation
reliability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49489
Custom host vitals were skipped when host name template enforcement
(#38806) shipped, since both features were in development at the same
time. This adds `$FLEET_HOST_VITAL_<id>` support to host name templates,
matching the existing secret-variable pattern (validation, per-host
resolution, resend on value change).
I also introduced a new `IsInvalidReferencedCustomHostVitalsError` call
after Copilot's comment below.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added support for `$FLEET_HOST_VITAL_<id>` in Apple host name
templates.
* Device-name template reconciliation now expands referenced per-host
vital values and updates automatically when those values change.
* **Bug Fixes**
* Prevents deleting custom host vitals that are referenced by host name
templates.
* If a referenced vital has no value for a host, device-name delivery is
marked failed for that host (retryable).
* **Improved Error Handling**
* Refined validation behavior so unknown/malformed vital references
return user-facing invalid-argument errors, while infrastructure errors
propagate unchanged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for the latest releases of numerous managed applications
across macOS and Windows, including ChatGPT, Claude, Cursor, Dropbox,
Microsoft 365 apps, RubyMine, Telegram, and others.
* **Bug Fixes**
* Updated installation downloads and integrity checks to match current
app releases.
* Improved cleanup for Dropbox and updated RubyMine and PyCharm
uninstall handling.
* Refreshed installation steps for applications with updated package
formats.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48653
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved Apple Business Manager configuration handling when updating
team assignments, including creating the assignment entry when it
doesn’t already exist.
- Removing an Apple Business Manager token now also removes its
corresponding assignment details and properly updates configuration
status when no tokens remain.
- Prevented `generate-gitops` from exporting an empty `apple_business`
section when default fleets are configured only via the UI.
- **Tests**
- Expanded coverage for team assignment updates to validate creation of
new configuration entries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated BetterTouchTool for macOS to 6.651.
- Updated BetterZip for macOS to 6.0.
- Updated Downie for macOS to 4.12.11.
- Updated Firefox for macOS to 153.0, Firefox ESR to 140.13.0esr, and
Firefox Nightly to the latest build.
- Updated NordPass for macOS to 7.9.2.
- Updated Miro for Windows to 0.11.162.
- Updated Royal TS for Windows to 7.4.50721.0.
- Updated Typora for Windows to 1.14.7.
- Refreshed installer links and verification data for applicable
applications.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Resolve the matching Fleet user from the persisted SCIM record rather
than the incoming request state when handling deactivation, so
deprovisioning still works when identifiers change in the same request.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated managed app packages to newer releases across macOS and
Windows, including Aptakube, AWS CLI, AWS VPN Client, ChatGPT,
CleanShot, DisplayLink, Firefox Nightly, Granola, Jamovi, Keyboard
Maestro, Microsoft 365 Copilot, NAPS2, Notion, Postman, Reqable, Tor
Browser, Typora, VirtualBox, WebCatalog, Webex, WhatsApp, and Wispr
Flow.
* Refreshed version detection logic and package integrity checks, along
with the associated download links.
* Updated installation behavior where required for DisplayLink,
Microsoft 365 Copilot, and NAPS2.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#49328
Adds Prisma Access Browser (Homebrew cask `prisma-access-browser`) as a
macOS Fleet-maintained app.
## Notes for reviewers
**Naming/slug:** This product already ships as a Windows FMA named
**Prisma Browser** (`prisma-browser/windows`, added in #46409 — "Prisma
Browser" is Palo Alto's current branding for what was Prisma Access
Browser). The FMA library combines platforms into one row by slug token,
so this entry uses `name: "Prisma Browser"` and `slug:
"prisma-browser/darwin"` while keeping `token: "prisma-access-browser"`
for the cask lookup (same token≠slug pattern as the `libreoffice`,
`ollama`, and `zoom` inputs). Both platforms now show as a single
"Prisma Browser" library row and share the existing Prisma icon, so no
icon changes are needed.
**Identity verified against the real installer** (downloaded the full
pkg; SHA256 matches the cask):
- `CFBundleIdentifier` = `com.talon-sec.Work` (from the pkg
Distribution/PackageInfo), so the exists query matches osquery's `apps`
table.
- `CFBundleShortVersionString` = `150.49.5.129`, exactly the cask
version before the comma, so the patched query's `bundle_short_version`
comparison reconciles.
- Installs `Prisma Access Browser.app` machine-wide to `/Applications`
as root; requires macOS 12+. Not a bootstrapper.
**Install script filename:** the cask's pkg artifact
(`PrismaBrowser-universal.pkg`) doesn't match the URL basename, but the
vendor serves that name via `Content-Disposition`, which is what the
server stores (`FilenameFromResponse`) and what orbit names the
downloaded installer on both download paths — so the auto-generated
install script works without a custom script.
**Installer URL** is pinned (version + hash in the path), so no
latest-redirect SHA-drift risk.
# Checklist for submitter
## Testing
- [x] Verified installer identity fields (bundle ID, versions, SHA256)
against the real pkg
- [x] `go test ./ee/maintained-apps/... ./cmd/maintained-apps/...`
passes; generated JSON validated
- [ ] FMA validator run (CI) confirms install/uninstall on a macOS host
**Related issue:** Resolves#49455
Offer `.py` script-only packages on macOS hosts, matching `.sh`.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Python (`.py`) installer packages are now treated as compatible
alongside shell (`.sh`) installers on macOS and Linux.
* Python installers can now appear in software availability,
self-service installation, and setup experience selections.
* Windows behavior remains unchanged (Unix-script installers are
excluded).
* **Bug Fixes**
* Improved cross-platform compatibility matching for Unix-like hosts
when choosing the first eligible installer package.
* **Tests**
* Added and expanded unit/integration coverage for `.py` installer
compatibility across platforms and flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated maintained app packages to newer releases across macOS and
Windows, including Arc, Bruno, Docker Desktop, Firefox Nightly,
Grammarly, Granola, Hive, Podman Desktop, QSpace Pro, Readest, Reqable,
Typora, and Zoom.
* Refreshed installer download links and verification checksums for the
updated releases.
* Corrected the Adobe Creative Cloud Windows installer checksum.
* Improved Grammarly Desktop removal behavior to clean up related
services and application data.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** NA — routine custom-tap cask maintenance
## What
Bump three custom-tap casks to their latest upstream releases and
regenerate the api JSONs (`regenerate.sh`) and FMA output manifests (`go
run cmd/maintained-apps/main.go --slug=<token>/darwin`):
| Cask | Old | New |
|------|-----|-----|
| Druva inSync | 7.6.1 (r110931) | 8.1.3 (r110967) |
| Fleet Desktop | 1.3.2 | 1.3.4 |
| Zoom Rooms | 7.0.5.12655 | 7.1.0.13088 |
XCreds 5.9 (9148) is still the latest upstream release and is unchanged.
## Why / reviewer notes
- **Druva:** the 8.0.0 phased rollout never reached the public CDN (its
`.dmg` 404'd since March); 8.1.3 is the first 8.x build served from
`downloads.druva.com`. Druva 8.x officially supports macOS 14 (Sonoma)+
only, so `depends_on` moves from `:big_sur` to `:sonoma` (informational
— the ingester doesn't read it).
- **`api/xcreds.json` +2 lines with no cask change:** `regenerate.sh`
rebuilds all api JSONs, and current Homebrew now emits
`pinned`/`pinned_version` fields. Expected drift; anyone running the
script gets the same output.
- **Verification done against the downloaded installers:**
- sha256 values computed locally from the actual downloads; the Druva
download's SHA1 matches the checksum published on Druva's download page.
- Installer internals inspected: the Druva dmg still contains `Install
inSync.pkg`, and pkg receipt IDs are unchanged across all three
(`com.druva.inSync.pkg` @ 8.1.3, `com.fleetdm.fleet-desktop` @ 1.3.4,
`us.zoom.pkg.zp` @ 7.1.0.13088), so existing install/uninstall stanzas
remain valid.
- No `changes/` file, consistent with prior cask-bump PRs (#45912,
#48028) and the automated FMA-ingestion PRs.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] `go test ./ee/maintained-apps/...` passes
- [ ] QA'd all new/changed functionality manually (installer metadata,
URLs, and checksums verified as above; not yet deployed through a Fleet
server)
Victor Lyuboslavsky
