<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated code ownership assignments for documentation resources.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- **Device management page**: Changed secondary CTA from "Join a
workshop" → "View pricing" (href updated to `/pricing`) in both hero and
bottom CTA sections.
- **Software management page**: Changed secondary CTA from "Try it
yourself" → "View pricing" (href updated to `/pricing`) in both hero and
bottom CTA sections.
- **Visibility & reporting page**: Changed secondary CTA from "Try it
yourself" → "View pricing" (href updated to `/pricing`) in both hero and
bottom CTA sections.
- **Homepage**: Changed secondary CTA text from "Join a workshop" → "Get
certified" (href to `/gitops-workshop` kept unchanged).
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1781997818506979?thread_ts=1780459268.285059&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Related to #47981
## What this does (dogfood GitOps unblock — step 1 of 2, workstations)
Follow-up to #47984. The mobile fleets are fixed (their stale rows were
purged and categories re-added), but GitOps still fails on the
**workstations** fleet with the same `software_categories` duplicate-key
error:
```
Error 1062 (23000): Duplicate entry '<team>-?️ Productivity' for key 'software_categories.idx_software_categories_team_id_name'
```
**Root cause (same as #47981):** the `software_categories.(team_id,
name)` unique index uses `utf8mb4_unicode_ci`, which treats the
variation selector `U+FE0F` as ignorable. A stale stored category row
(e.g. `🖥 Productivity` without the selector, from an earlier build) is
*equal* to today's canonical `🖥️ Productivity` per the index but
*distinct* to Go's `strings.EqualFold`, so the existence check misses it
and the insert collides.
**This PR (step 1):** removes the `categories:` blocks from
`workstations.yml`. With nothing to insert, the software batch applies
cleanly, and Fleet's `deleteUnusedSelfServiceCategories` cleanup then
purges the stale rows for that team. Software still installs; it's just
uncategorized until step 2.
**Step 2 (follow-up):** once this is applied, revert this PR to re-add
the categories. The team will have no stale rows by then, so canonical
categories get created fresh and software is categorized again.
This is the **last** fleet that needed it — `servers.yml`,
`testing-and-qa.yml`, and `unassigned.yml` define no categories. The
permanent fix (idempotent category insert) is tracked under #47981.
### Scope of the change
- Only `categories:` blocks removed: **109 lines deleted, 0 added.**
- All 109 package references and the 1 app store app are preserved; the
two commented-out `# categories:` examples are left untouched; file
remains valid YAML.
# Checklist for submitter
- [x] Changes file: N/A — dogfood GitOps config only, no product code or
user-visible product change.
## Testing
- [x] Verified `workstations.yml` remains valid YAML with all software
items intact (only `categories:` blocks removed).
- [ ] Confirm a GitOps dry run passes before merge.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Streamlined software package and application configurations by
removing unused metadata fields from multiple application entries across
packages and fleet-maintained apps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Related to #47981
## What this does (dogfood GitOps unblock — step 1 of 2)
The GitOps run for the mobile-device fleets fails while applying app
store apps:
```
applying app store apps for fleet: "📱🏢 Employee-issued mobile devices":
Validation Failed: Error 1062 (23000): Duplicate entry '303-?️ Productivity'
for key 'software_categories.idx_software_categories_team_id_name'
```
**Root cause:** the category names in the YAML are correct (plain
`"Productivity"`, etc., which translate server-side to the canonical
emoji names). The conflict is a **stale stored category row** for the
team. The `software_categories.(team_id, name)` unique index uses
`utf8mb4_unicode_ci`, which treats the Unicode variation selector
`U+FE0F` as ignorable. An earlier build stored Productivity as `🖥
Productivity` (no selector); today's code produces the canonical `🖥️
Productivity` (with selector). Those are *equal* to the index but
*distinct* to Go's `strings.EqualFold`, so the existence check misses
the stale row and the insert collides. This only affects the two
variation-selector categories — `🖥️ Productivity` and `🛠️ Utilities` —
which is why the failure is on Productivity.
**This PR (step 1):** temporarily removes the `categories:` blocks from
`company-owned-mobile-devices.yml` and `personal-mobile-devices.yml`.
With no categories to insert, the app store batch applies cleanly, and
Fleet's `deleteUnusedSelfServiceCategories` cleanup then purges the
stale rows for those teams. Apps still install; they're just
uncategorized until step 2.
**Step 2 (follow-up):** once this is applied, revert this PR to re-add
the categories. The teams will have no stale rows by then, so the
canonical categories get created fresh and the apps are categorized
correctly.
The permanent fix (makes the category insert idempotent so any stored
byte form is tolerated) is tracked separately under #47981.
> Note: `workstations.yml` uses the same categories and may need the
same treatment if that fleet also has a stale row — not included here
since only the mobile fleets are confirmed failing.
# Checklist for submitter
- [x] Changes file: N/A — dogfood GitOps config only, no product code or
user-visible product change.
- [x] Input data is properly validated: N/A — removing config, no new
inputs.
## Testing
- [x] Verified both files remain valid YAML and all 24 app store apps
per fleet are preserved (only `categories:` blocks removed;
comments/formatting intact).
- [ ] Confirm a GitOps dry run passes before merge.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Simplified app catalog entries for iOS and iPadOS devices by removing
category metadata while preserving all app functionality and settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Removed platform specification for Linux hosts in external storage
restrictions.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed platform-specific scoping from external storage restrictions
label configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add device IDs to manual labels to exempt specific machines from
read-only external/removable storage restrictions. The macs label now
includes host "1339" and the windows label includes host "1230",
allowing these devices to receive read-write external/removable storage
profiles.
Add a macOS Disk management declaration profile that sets
ExternalStorage to ReadOnly, and create a manual label "Macs excluded
from external storage restrictions" for opt-outs. Register the new label
in default.yml and reference the new Disk management settings.json in
the workstations fleet controls, excluding hosts in the manual label so
they retain read-write external storage.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
**New Features**
- Enforces external storage devices as read-only on macOS, Windows, and
Linux systems
- Introduces new host labels allowing administrators to selectively
exempt specific devices from external storage restrictions
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** #47725 moved the script but didn't update the
workflow
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
N/A - CI-only change, no user-visible impact.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] QA'd all new/changed functionality manually
**How this was tested:**
1. Confirmed `uninstall-fleetd-windows.ps1` does not exist at the old
path (`it-and-security/lib/windows/scripts/`) on `main` -- reproduces
the `CommandNotFoundException`.
2. Confirmed the file exists at the new path
(`docs/solutions/windows/scripts/`).
3. Ran sparse-checkout simulations locally: old path yields no script
file, new path successfully pulls it.
4. Compared old vs new script -- the new version adds an MDM
unenrollment step that is a no-op in E2E (no MDM enrolled), so behavior
is equivalent.
5. Triggered the full E2E agent workflow on this PR branch to verify all
32 Windows jobs pass the "Uninstall Orbit" step.
## Root cause
PR #47725 ("Fix unenroll Windows instructions", merged June 19) moved
`uninstall-fleetd-windows.ps1` from
`it-and-security/lib/windows/scripts/` to
`docs/solutions/windows/scripts/` as part of merging the "turn off MDM"
and "uninstall fleetd" scripts into one. However,
`.github/workflows/e2e-agent.yml` was not updated to reflect the new
path.
This broke all 32 Windows E2E jobs (windows-2025 and windows-11-arm, all
channel/update combinations) at the "Uninstall Orbit" step. The nightly
run has been failing for 2 consecutive cycles (June 20 and 21),
exhausting all 4 retry attempts each time.
## Fix
Update the sparse-checkout path and PowerShell run command in
`e2e-agent.yml` to the new location.
## Note: inconsistent uninstall script locations
After #47725, the uninstall scripts are now in different directories per
OS:
| OS | Uninstall script location |
|---|---|
| macOS | `it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh`
|
| Linux | `it-and-security/lib/linux/scripts/uninstall-fleetd-linux.sh`
|
| Windows |
`docs/solutions/windows/scripts/uninstall-fleetd-windows.ps1` |
macOS and Linux remain in `it-and-security/lib/` (Fleet's dogfooding
GitOps config). Windows was moved to `docs/solutions/` (user-facing
documentation). This inconsistency may warrant a follow-up to decide on
a canonical location.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated installer metadata, version references, checksums, and
deployment scripts for 40+ maintained applications across Windows and
macOS platforms. Includes updates to Android Studio, Firefox, Visual
Studio Code, Node.js, Microsoft Office suite, Joplin, Cursor, Cyberduck,
Ollama, Warp, and others, ensuring system compatibility with their
latest available releases and proper installation procedures.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Changes:
- Removed the gradient background at the bottom of the /partners page
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated the visual appearance of the partners page banner.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
Cloudflare WARP was renamed to Cloudflare One, and this test used it's
name in the fleet_maintained_apps table
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
N/A but needed for CI check
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Updated Windows WARP integration tests to use current product naming
conventions when querying fleet-maintained applications, ensuring test
accuracy across both verification and setup phases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#47839
The software title details page (`GET
/api/v1/fleet/software/titles/{id}`) could take minutes to load and
return a 500 or 502 when an installer, VPP app, or in-house app was
scoped to many hosts.
The cause was the status summary query. To find each host's most recent
pending activity, it joined `upcoming_activities` to itself, and an `OR`
in the join condition stopped MySQL from using an index. The query got
much slower as the pending backlog grew.
This rewrites the query in all three summary functions
(`GetSummaryHostSoftwareInstalls`, `GetSummaryHostVPPAppInstalls`,
`GetSummaryHostInHouseAppInstalls`) to use a `ROW_NUMBER()` window
function. It filters to the installer or app first, then picks each
host's most recent activity, which removes the self-join. It also fixes
a related bug where the old `OR` condition could drop a host from the
counts.
Verified live against a 6,000-host backlog. The page went from ~12.7s to
~1.1s with identical status counts.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or
`ee/fleetd-chrome/changes`. See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-chan
ges.md#changes-files) for more information.
- [x] `SELECT *` is avoided and SQL injection is prevented (named
placeholders used for all values in the modified statements).
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Before (reproduction):
[before.webm](https://github.com/user-attachments/assets/f03154d5-6062-42e3-81d3-ce33b0809145)
## After (fix):
[after.webm](https://github.com/user-attachments/assets/b6d1ce53-7778-4023-84b7-56c49d846649)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed software title details pages timing out for installers, VPP
apps, and in-house apps when hosts have large backlogs of pending
activities.
* Improved pending software install status selection to prevent hosts
from being dropped or counted inconsistently when multiple upcoming
activities exist.
* **Tests**
* Added regression coverage for upcoming-per-host counting without
dropouts when multiple queued activity entries share the same host and
app context.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated application version metadata and checksums for Arc
(1.111.0.274), BatFi (3.1.0), GoodSync (12.11.4), Granola (7.345.5), and
Readest (0.11.10).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** For #44746
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [x] Changing the filters in the UI causes the related API params to be
set
- [x] Changing the software filters causes the "filtered" tooltip to
show up and include info about software filters
- [x] Changing the host filters causes the "filtered" tooltip to show up
and include info about host filters
- [x] Changing both host and software filters causes the "filtered"
tooltip to show up and include info about both filters
- [x] CVE search works and utilizes infinite scroll
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added software category filtering options to vulnerability charts.
* Added EPSS range filtering with validation to refine results.
* Added known exploit toggle and CVE exclusion capabilities.
* Improved filter status display with tabbed interface.
* **Tests**
* Added comprehensive test coverage for software filtering and
validation logic.
* **Style**
* Enhanced filter UI styling and interactivity.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Update branding from "Cloudflare WARP" to "Cloudflare One" across
maintained app data. Changed name fields in Homebrew and Winget input
JSON, updated outputs/apps.json entries and descriptions, and updated
the frontend NameToIdentifierMap key to "Cloudflare One" (keeps existing
slug/identifier unchanged).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47731
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated product references from Cloudflare WARP to Cloudflare One
across platform metadata and catalogs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#43310
Read-only policy and report detail pages rendered their displayed fields
(name, description, resolution, platforms, query) from the editing
context (`PolicyContext`/`QueryContext`), which only updates in
react-query's `onSuccess`. On a cached revisit, `isLoading` is `false`
(no spinner) and the freshly-loaded entity is available immediately, but
the context still held the previously-viewed entity's values for a frame
— briefly showing the wrong policy/report.
This change makes both detail pages render directly from the fresh
`useQuery` result (`storedPolicy`/`storedQuery`) and drops their
coupling to the editing context, matching the existing
`HostDetailsPage`/`SoftwareTitleDetailsPage` pattern. `QueryDetailsPage`
(Reports) had the identical latent bug and is fixed here too.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
New regression tests (`PolicyDetailsPage.tests.tsx`,
`QueryDetailsPage.tests.tsx`) seed the context with stale values and
assert the page renders the freshly-loaded entity instead. Verified live
against a running Fleet instance with Playwright: navigating between
cached detail pages no longer flashes the previous entity's content.
[6f7d6d22134dc1fd968f8473c552ee49.webm](https://github.com/user-attachments/assets/c8ef5f3f-278c-4e13-adc1-689b3eff4e59)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Resolved an issue where policy and query details pages could briefly
display previously viewed policy/report information when switching
between items.
* **Tests**
* Added regression coverage to ensure the UI renders freshly loaded
policy/query name, description, and query/report details, and does not
show stale values.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Add Winget input manifest and PowerShell install/uninstall scripts for
Groove OmniDialer. The install script runs the NSIS installer with /S
/currentuser for per-user silent installs; the uninstall script locates
the registered uninstall entry, parses the UninstallString, ensures /S
is present, and runs the uninstaller. Update outputs: add the app entry
to outputs/apps.json and add a versioned windows.json with installer
URL, sha256, and script refs.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46879
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Ollama Windows to version 0.30.8
* Updated Superhuman macOS to version 1041.0.13
* Updated Visual Studio Code macOS to version 1.125.1
* Updated WhatsApp macOS to version 26.24.21
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
- @noahtalerman: For Windows, I think we want to squeeze turning off MDM
and uninstalling fleetd into one script.
- Why? Because Fleet automatically turns on Windows MDM, two scripts
means Fleet could beat the IT admin and turn MDM back on before they
uninstall fleetd.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Windows fleetd uninstall now proactively detects and disables MDM
enrollment before removal to help ensure a cleaner device unenrollment.
* **Bug Fixes**
* Improved uninstall error reporting by surfacing the underlying failure
message and exiting with a clear non-zero code.
* **Chores**
* Updated fleet testing and workstation configurations: removed the
Windows uninstall/MDM-related steps from QA and workstation controls,
and added new Windows security/setup scripts plus additional
cross-platform post-install and extension installation tasks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Steven Palmesano <3100993+spalmesano0@users.noreply.github.com>
Adds a simple .sh script that can trigger a refetch locally from a host
if required.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the Linux script used to trigger Fleet refetch operations. It
now runs with stricter Bash safety, validates and trims the system
identifier before sending the request, and reports clear success/failure
status while returning the appropriate nonzero exit code on errors.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- @noahtalerman: Landed on this terminology: "Fleet Desktop menu bar
icon" and "Fleet Desktop app"
- We were already calling Fleet Desktop a menu bar icon so I think this
is the smallest change
Run the Postman installer as the logged-in user via a scheduled task
(copies installer to PUBLIC, starts task, waits for Running/Completion,
then removes task), propagate exit codes, and clean up the installer on
completion. Revamp the uninstaller to search both HKLM and HKCU
uninstall hives, parse the UninstallString (quoted and unquoted), stop
running Postman processes, preserve existing uninstall args while
ensuring --silent is included, and return proper exit codes. Update
windows.json refs to point to the new install/uninstall script versions
and embed the updated scripts.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47906
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
**Related issue:** Resolves#45327
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
* Fixed macOS detail query failures when application bundles declare
executable paths that don't exist on the system. Previously, missing
executables would cause queries to fail entirely. The system now handles
these gracefully by setting the SHA256 field to an empty value,
improving reliability of system queries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47605
# Details
The queries in GenerateHostStatusStatistics (which feeds the
host_summary API) were incorrectly filtering out hosts that had been
removed from ABM from the denominator (i.e. "total hosts") count, while
keeping them in the per-platform counts. This PR fixes the query so that
the sum of the platforms matches the total.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
**Before**
<img width="499" height="420" alt="image"
src="https://github.com/user-attachments/assets/9b8d22bc-1dac-49e6-9d2f-8ce9ffda5f17"
/>
**After**
<img width="501" height="420" alt="image"
src="https://github.com/user-attachments/assets/fe3705b7-9a90-4d9c-a9dc-b04b2905f3fb"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue causing incorrect platform percentage breakdowns in the
"Hosts enrolled" dashboard chart.
* Corrected host status calculations to ensure accurate total and
per-platform host counts by properly handling device enrollment
assignment records.
* **Tests**
* Added regression tests to validate the correct handling of device
enrollment records in host status calculations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#38670
Adds the backend and frontend for the Policy status page — a historical, per-host view of policy automation outcomes — plus a way to reset a policy's results.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45639
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
A bit hard to replicate these ones, but they're text changes only.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved error message clarity for macOS setup assistant and bootstrap
package workflows, including more precise identification of the failed
operation (such as verifying or uploading) and better details for
script-reading failures.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Isabell Reedy