<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated webhook sender classification to reflect the current list of
recognized bot and maintainer accounts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** NA
## What & why
The FMA validator (`cmd/maintained-apps/validate`) downloads each app's
installer with a hardcoded 2-minute context timeout. Large installers
can't finish in that window — e.g. Android Studio (Windows) is ~1.39 GB,
which needs ~12.4 MB/s sustained to complete in 2 minutes. When the
runner is slower, the download aborts with `context deadline exceeded`,
failing validation with a misleading error that looks URL-related.
This bumps the validator timeout from 2 to 5 minutes. (For reference,
the production download path already uses `InstallerTimeout = 15 *
time.Minute`.)
# Checklist for submitter
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Increased the installer download timeout to five minutes, improving
reliability for slower downloads.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45320
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Summary
`filterExtensionsForHost` (called on every Orbit config fetch, ~30s per
host) had an N+1 query pattern: it called `HostMemberOfAllLabels` once
per extension in a loop, issuing a separate DB query for each.
This PR replaces the N queries with a single batch query via a new
`HostMembershipForLabels` datastore method that returns which labels
(from a given list) the host belongs to. Extension filtering then
happens in-memory.
### Changes
- **New datastore method** `HostMembershipForLabels(ctx, hostID,
labelNames) -> map[string]bool` -- single `SELECT l.name FROM labels l
JOIN label_membership` query
- **Updated `filterExtensionsForHost`** in `server/service/orbit.go` --
collects all unique label names across extensions, calls the new method
once, filters in-memory
- **No API, UI, CLI, agent, or schema changes** -- purely server-side
internal optimization. Full backward compatibility: old agents work with
new servers and vice versa (no protocol change).
## Benchmark
Ran a local end-to-end benchmark against the live `POST
/api/fleet/orbit/config` endpoint to measure the real-world impact.
**Setup:**
- MacBook (Fleet server + Docker MySQL 8.0 + Redis, all localhost)
- 50 enrolled Orbit hosts (darwin), 5 label-scoped extensions, all hosts
members of all 5 labels
- 500 requests at concurrency 10, cycling through all 50 orbit_node_keys
- Built Fleet binary from `main` (before) and this PR branch (after),
same database and test data
**Results:**
| Metric | Before (main) | After (this PR) | Improvement |
|--------|:---:|:---:|:---:|
| Avg latency | 25.33 ms | 17.46 ms | **-31%, 1.45x faster** |
| P50 latency | 24.55 ms | 16.52 ms | **-33%, 1.49x faster** |
| P95 latency | 34.42 ms | 27.53 ms | **-20%, 1.25x faster** |
| Throughput | 390.6 req/s | 564.2 req/s | **+44%** |
### Extrapolation to 100,000 hosts
At 100k hosts with a 30-second check-in interval (3,333 req/s steady
state):
| Metric | Before | After |
|--------|--------|-------|
| Server host capacity (measured MacBook) | 11,718 | 16,926 (+44%) |
| Label-check DB queries/sec | **16,665** (5/req) | **3,333** (1/req) |
| **DB queries eliminated** | | **13,332/sec (80% reduction)** |
The improvement scales linearly with extension count:
| Extensions | DB queries eliminated/sec | Reduction |
|:---:|---:|:---:|
| 5 | 13,332 | 80% |
| 10 | 29,997 | 90% |
| 15 | 46,662 | 93% |
| 20 | 63,327 | 95% |
> **Note:** These are conservative localhost numbers. In production,
where each DB round-trip includes real network latency, the per-request
latency improvement would be more pronounced because each eliminated
query saves a network hop.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
### Automated
- New `testHostMembershipForLabels` MySQL integration test covering:
empty input, full membership, partial membership, nonexistent labels,
nonexistent host, host with no memberships
- Existing `testHostMemberOfAllLabels` unchanged and unaffected
### Manual QA
1. Fleet Premium instance with 2+ Orbit-enrolled hosts
2. Configure 3+ osquery extensions with different label scoping
3. Verify each host receives only the extensions whose label
requirements it meets
4. Verify extensions with no label scoping are included for all hosts
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Performance**
* Improved Orbit configuration loading by batching host label membership
checks into a single query for extension label filtering.
* **Behavior**
* Extension availability and filtering behavior remains the same, with
more efficient processing when multiple extensions use labels.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#48448.
These should help with reviewing the XAR and BOM implementations:
- https://claude.ai/code/artifact/60a78c1d-2fc9-45da-9471-1517fe77adb4.
- https://claude.ai/code/artifact/1c759a32-02f7-4a41-8611-04d7358367d7.
The darwin only tests (bom_darwin_test.go) have been executed on my
workstation.
Goal is to make sure to run the tests on macOS Github runners in
https://github.com/fleetdm/fleet/issues/33371.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* macOS package builds now use an internal, built-in implementation
instead of external packaging tools.
* `.pkg` installer creation no longer depends on Docker for macOS
packaging.
* **Bug Fixes**
* Improved packaging reliability by reducing platform-specific build
steps.
* Packaging test coverage was streamlined to better match the supported
build environment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Link to a working profile instead of telling the user how to create
one. It's easier
- ~~This is assuming the configuration profile works. @kc9wwh is
currently testing the profile and running into issues...~~
- UPDATE: We confirmed the profile works
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for contacts associated with the “Event - 2026-07 PSU
MacAdmins” source.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A — part of the ongoing Windows Fleet-maintained
apps (FMA) parity workstream (letter G).
## What this does
Adds **19** Windows Fleet-maintained apps for the letter-G batch. Each
app has a winget-sourced input, generated output manifest, and (where a
cleanly-licensed ≥256px icon was found) a catalog icon.
**MSI (clean, upgrade-code uninstall):**
- Gadwin PrintScreen, Gadwin PrintScreen Pro, Gadwin ScreenRecorder —
free + the two paid editions are distinct products (separate
ProductCodes/UpgradeCodes), so each matches by exact ARP name to avoid
cross-matching
- GitHub CLI, Go, gsudo, grepWin
- GeoGebra Classic — the machine MSI; the winget manifest's top-level
`Scope: user` forced `installer_scope: user` in the input + custom
machine-MSI install/uninstall scripts
- Google Ads Editor — dual user/machine WiX MSI; custom install forces
`ALLUSERS=1`
**MSI (custom uninstall):**
- GoodSync — `ignore_hash` (non-versioned "latest" URL drifts from the
manifest version/SHA, Chrome/TeamViewer pattern); process-stopping
uninstall for its tray app + sync service
**NSIS / exe (custom install + uninstall):**
- Google Web Designer, Gpg4win (x86-only; versioned ARP name → fuzzy
match), GoAnywhere OpenPGP Studio (install4j `-q`), GoldenDict-ng
(maintained fork; name-only exists query), Graphviz
- Streamlabs Desktop — electron-builder `/S /allusers` +
process-stopping uninstall (versioned ARP name → fuzzy match)
**WiX burn / electron (custom install + uninstall):**
- Garmin BaseCamp, Garmin Express (`ignore_hash` — rolling URL +
self-updating app), Galaxy Modeler (`/S /allusers`)
## Dropped from this batch (recorded in the workstream tracker)
- **Genesys Cloud Background Assistant** — WiX burn bootstrapper with a
hard `VCRedist 2015+ x86` dependency Fleet won't resolve, x86-only,
non-standard burn uninstall.
- **GoldenDict.GoldenDict** — stale original, superseded by the
actively-maintained `xiaoyifang.GoldenDict-ng` fork (shipped instead).
- **GeoGebra GraphingCalculator + Geometry** — user-scope-only exe
installers (no machine option); shipped GeoGebra Classic (MSI) instead.
- **Garden Gnome Package Viewer** — `ggnome.com` download URLs sit
behind a Cloudflare `cf-mitigated: challenge` and return 403 to all
automated requests (even with the Chrome UA), so Fleet's downloader
can't fetch it.
## Notes
- **Gadwin ScreenRecorder** and **Garmin Express** ship without a custom
catalog icon — no cleanly-licensed ≥256px source was found (they fall
back to the generic icon).
- Verification (winget manifest identity, installer type/scope/arch,
ProductCode/UpgradeCode, silent switches, URL stability) was done per
the `new-fma` skill against the winget-pkgs manifests and, where needed,
the real installers.
## Testing
- [ ] FMA CI validator (install → detect → uninstall) on the
SYSTEM-context Windows runner — pending.
- Generated outputs verified locally: all 19 produce valid manifests;
MSI apps carry the correct UpgradeCode-based uninstall; exists/patched
queries reviewed for name + publisher correctness.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added maintained Windows software catalog entries for 13 applications
(Gadwin PrintScreen/Pro/ScreenRecorder, Galaxy Modeler, Garmin BaseCamp,
GeoGebra Classic, Go, GoAnywhere OpenPGP Studio, GoldenDict-ng, Google
Ads Editor, Google Web Designer, Graphviz, grepWin).
* Enabled silent install/upgrade detection and automated uninstall
behavior for the newly supported apps.
* Added app icons and expanded software-name keyword matching for
improved identification in the catalog.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Changes
Adds a new "Generate a customer quote" section to the Go-To-Market
operations handbook page. This documents the workflow for generating
quote PDFs with custom terms in Salesforce:
1. Navigate to the approved quote record.
2. Populate the **Terms** field with the full general terms plus any
custom language.
3. Generate the PDF using the "Promises or custom terms" template.
4. Review and submit to Zay Hanlon for approval before sending to the
customer.
This section follows the existing "Create a quote" section and provides
the next step in the quoting workflow.
---
Built for [Sam
Pfluger](https://fleetdm.slack.com/archives/C08BTMFTUCR/p1784074821847739?thread_ts=1784057153.990589&cid=C08BTMFTUCR)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
Update the x86 Windows Zoom Workplace label query to use a LIKE pattern
match instead of an exact match. This allows detection of different Zoom
Workplace versions and variants beyond just 'Zoom Workplace (X64)'.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Update `it-and-security/default.yml` to include
`windows_entra_client_ids` with `$DOGFOOD_ENTRA_CLIENT_ID` alongside the
existing Entra tenant ID setting. This ensures default Windows Entra
configuration includes both required identifiers for migration/auth
setup.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Configuration**
* Added support for supplying the Entra client ID in the Windows Entra
integration configuration.
* Updated the deployment workflow to pass the configured client ID
through automatically.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for the latest installers across a broad range of macOS
and Windows applications.
* Updated application catalog entries with current release versions,
download locations, and verification checksums.
* **Bug Fixes**
* Improved upgrade detection so outdated installations are correctly
identified.
* Updated installation and removal behavior where required for newer
application releases.
* **Maintenance**
* Refreshed metadata for applications including Blender, Chrome Remote
Desktop, Docker Desktop, Firefox, GitHub Desktop, Notion, Postman, and
many others.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Changes:
- updated the route for /gitops-workshop to include the query string
when users are redirected to the /workshops page.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the legacy GitOps Workshop link to redirect permanently to the
workshops page.
* Preserved query parameters during the redirect for a more consistent
navigation experience.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49149
Adds **Mozilla VPN** as a Fleet-maintained app for both macOS (Homebrew
cask `mozilla-vpn`) and Windows (winget `Mozilla.VPN`), version 2.38.0.
Identity fields verified against the real installers (not catalog
metadata):
| | macOS | Windows |
|---|---|---|
| `unique_identifier` | `org.mozilla.macos.FirefoxVPN`
(CFBundleIdentifier from pkg PackageInfo) | `Mozilla VPN` (MSI
`ProductName`) |
| Publisher | — | `Mozilla Corporation` (MSI `Manufacturer` = winget
locale, no override needed) |
| Format/type | `pkg` | `msi` (winget `wix`, machine scope,
`ALLUSERS=1`) |
- Install/uninstall scripts auto-generated (machine-scope MSI + cask
artifacts/zap) — no custom scripts.
- Generated SHAs match the manifests (macOS `2803d4b4…`, Windows
`11a270b3…`).
- No bootstrapper (`ARPSYSTEMCOMPONENT` absent); pinned installer URLs;
no risk flags.
- On Windows, osquery reports `programs.version` as `2.38.0.0` vs the
FMA's `2.38.0`; `version_compare` treats a fresh install as ≥ target, so
the patch policy reports patched correctly.
- New app icon generated (`MozillaVpn.tsx`, website PNG, `index.ts` map
key `"mozilla vpn"` shared by both platforms).
# Checklist for submitter
- [ ] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43097
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved error messages for certificate authority operations when the
server private key is not configured.
* Added a direct “Learn more” reference to help resolve the
configuration issue.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated update of MIN_OSQUERY_VERSION_OPTIONS with any new osquery
release. (Note: This automatic update is the solution to issue #21431)
Co-authored-by: RachelElysia <RachelElysia@users.noreply.github.com>
This is needed to keep tools up to date with latest go.mod. Goal is for
these tools to have separate go.mod to reduce tool dependency on
production/main `go.mod`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Expanded automated validation to cover both tool modules, including
builds, dependency tidiness checks, and applicable tests.
* Added a `make tidy-tool-modules` command to tidy supported tool
dependencies automatically.
* Added validation for tool changes and root Go module updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#49007
## Testing
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved reliability when updating host-to-user mappings by ensuring
related mapping changes are completed as one transaction.
* Simplified certificate handling during mapping updates to provide more
consistent results.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** NA
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Article
New article: "How Fleet completes your Microsoft stack across every OS,
not just Apple"
(`articles/how-fleet-completes-your-microsoft-stack.md`).
Converted from a Google Doc draft into Fleet's article format: key
takeaways after the dek, post-takeaways CTA button to the Entra
conditional access guide, closing CTA to `/try-fleet` and `/contact`,
and a style sweep per the writing guide.
Version claims (Entra conditional access: macOS in 4.70.0, Windows in
4.84.0) verified against the changelog.
**Needs verification before publishing** (claims about Microsoft's
products):
- Intune's macOS compliance policy is a fixed six-item checklist, with
custom compliance policies unavailable for Apple platforms
- No documented CVE tracking for Apple devices in Microsoft's endpoint
management stack
## Testing
- [ ] QA'd all new/changed functionality manually (preview article
rendering on the website)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42721
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated iOS/iPadOS enrollment labeling to clarify the fully managed
company-owned option.
* Added enrollment guidance explaining that users must download the
profile in their browser and install it to enroll in Fleet.
* **Tests**
* Expanded coverage to verify the updated enrollment option and
instructions on iOS/iPadOS and Android.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Android MDM device policy logging during profile
reconciliation and verification, including host and profile counts.
* Added clearer warnings when policy updates are skipped while returning
an invalid policy version, preventing missing policy metadata from going
unnoticed.
* Enhanced verification diagnostics with more detail on
pending/failed/non-compliant profiles and warnings when expected policy
request details cannot be matched.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Resolves#38806
Add an IT-admin naming convention for macOS/iOS/iPadOS hosts. An admin
sets a name template (e.g. "iPad $FLEET_VAR_HOST_HARDWARE_SERIAL") under
Controls > OS settings > Host names for a fleet or for "No team"; Fleet
resolves it per host, delivers it via an Apple `Settings`/`DeviceName`
MDM command, renames its own record on ACK, then verifies the name via
osquery (macOS) or a DeviceInformation refetch (iOS/iPadOS). Clearing
the template stops enforcement without renaming any host. Fleet Premium
only, mirroring disk encryption.
Fixing an update of the main go.mod breaking the tool.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated internal tooling dependencies to support improved
compatibility and functionality.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This `resent_certificate` activity is generated from the edit user flow
in fleet server.
**Related issue:** Resolves#49007
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Device-to-identity-provider mapping changes can now generate
certificate resend activities when applicable.
* Certificate resend activities can now be marked as automated versus
manual.
* **Improvements**
* Certificate resend details are produced when SCIM host-user mappings
are added, updated, or removed.
* If creating the associated resend activities fails, the mapping change
still proceeds; errors are handled non-blockingly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #43667
# Summary
Renames the unreleased GitOps field `setup_experience_platforms` to
singular `setup_experience_platform`, accepting a comma-separated string
of `darwin`/`linux` (rejecting the `macos` alias) to match the
query/policy/label `platform` convention.
# Checklist for submitter
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Updated software setup-experience platform configuration to use a
single comma-separated `setup_experience_platform` value.
* Platform values are normalized for casing and whitespace,
deduplicated, and validated against supported platforms.
* macOS setup selections now use the canonical `darwin` value; the
`macos` alias is rejected.
* GitOps-generated configurations now use the updated field name and
platform format.
* **Bug Fixes**
* Improved validation messages for invalid setup-experience platform
values.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A — part of the Windows Fleet-maintained apps
catalog expansion (letter F batch; follows #48872, #48881, #48950,
#48969, #49086, #49186).
Adds eight new Windows Fleet-maintained apps:
| App | winget package | Installer | Notes |
|-----|----------------|-----------|-------|
| Foxit PDF Editor | `Foxit.PhantomPDF` | WiX bootstrapper EXE, machine,
x64 | Covers both "Foxit PDF Editor" and "…Pro" from the inventory (one
package). Runs an updater service → process-stopping uninstall. ARP key
lives in the WOW6432Node hive. |
| Foxit PDF Reader | `Foxit.FoxitReader` | WiX bootstrapper EXE,
machine, x64 | Distinct DisplayName from the Editor (verified via
msiinfo). Updater service → process-stopping uninstall. |
| FreeCAD | `FreeCAD.FreeCAD` | NSIS (MultiUser), machine, x64 |
`/AllUsers /S`; versioned ARP name ("FreeCAD 1.1.1") → `FreeCAD%` fuzzy.
|
| FastPictureViewer Professional |
`AxelRietschin.FastPictureViewer.Professional` | MSI, machine, x64 |
Versioned ARP name → fuzzy. Unversioned URL → `ignore_hash`. Declares
VCRedist deps (near-ubiquitous; noted). |
| FastStone Capture | `FastStone.Capture` | NSIS, machine, x86 | `/S`;
versioned ARP name → fuzzy. Paid trialware, but silent
install/detect/uninstall are clean. |
| FastStone Image Viewer | `FastStone.Viewer` | NSIS, machine, x86 |
`/S`; versioned ARP name → fuzzy. |
| FlexWhere for Desktop | `Dutchview.Flexwhere` | MSI, machine, x64 |
Auto-start tray app → process-stopping uninstall (stop process, then
msiexec /x via UpgradeCode). |
| Fortify | `PeculiarVentures.Fortify` | WiX MSI, machine, x64 (en-US) |
Smart-card/cert bridge; auto-start tray → process-stopping uninstall.
Per-arch+locale ProductCode, so `installer_locale: en-US`. |
Considered but **not** added (recorded in the workstream tracker):
- **FactSet Workstation** (`FactSet.FactSetWorkstation`): MSI defaults
to per-user (ALLUSERS=2 + MSIINSTALLPERUSER=1) with no machine-scope
override, AND a `SpawnFDSWorkstation` custom action launches the app at
install (headless-hang risk in a SYSTEM session). Niche licensed
terminal.
- **Filius** (`StefanFreischlad.Filius`): winget manifest is de-DE only
(no en-US locale); the ingester hard-codes the en-US locale fetch (same
limitation that deferred Araxis Merge).
- **FlashFXP** (`OpenSight.FlashFXP`): abandoned (frozen at 2017), the
vendor site returns HTTP 500, only a 16×16 icon is available, and its
InstallAware uninstall needs a fragile cached-setup `/s` injection.
- **Front** (`FrontApp.Front`): per-user-only electron-builder installer
(`Front-user-*.exe` → `%LocalAppData%`, HKCU); no machine/all-users
artifact in winget.
- **Autodesk Fusion** (`Autodesk.Fusion`): the winget "installer" is
`Fusion Client Downloader.exe`, a per-user streaming/web bootstrapper
that downloads at runtime, hangs headless, and needs interactive
Autodesk sign-in.
Identities verified per app (msiinfo Property tables; NSIS header
decompilation; winget AppsAndFeaturesEntries; uninstall-database
corroboration). Apps that run a service or auto-start tray (both Foxit
products, FlexWhere, Fortify) get process-stopping uninstalls up front
to avoid the MSI-rollback failure class. SHAs verified against manifests
for pinned URLs; `ignore_hash` only for FastPictureViewer's
actively-maintained latest-pointer URL. Icons via
`tools/software/icons/generate-icons.sh` (all ≥256px except
FastPictureViewer/Fortify at 256/180).
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [ ] QA'd all new/changed functionality manually (relying on the FMA CI
validator for Windows install/uninstall validation)
**Related issue:** Closes#48943
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Summary
Adds unit test coverage for external library upgrades that had no
automated tests:
- **DOMPurify** (`ClickableUrls_xss.tests.tsx`): 5 XSS sanitization
tests (script injection, javascript: in href, event handlers, iframe,
URL preservation)
- **react-markdown + remark-gfm** (`FleetMarkdown.tests.tsx`): 9
rendering tests (plain text, bold/italic, links, lists, GFM tables,
strikethrough, code blocks, inline code)
- **sonner** (`ToastNotification.tests.tsx`): 9 notify API tests
(success/error creation, empty-message fallback, custom id, dismiss,
batch, HTTP status label, axios response unwrap)
These gaps were identified through a comprehensive audit of all ~353
direct dependencies across Go and frontend. The Go backend has excellent
coverage (669+ test files). The frontend now has 333+ test files
covering all runtime libraries except 2 that are untestable at unit
level (systray GUI, sockjs WebSocket).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added coverage confirming potentially unsafe HTML and links are
sanitized before rendering, including protection against script,
`javascript:` URLs, and injected content.
* Added tests validating Markdown rendering for plain text, links,
fenced code blocks, and inline code.
* Added coverage for toast notifications, including success/error flows,
batching, dismissal, fallback messaging, ID handling, and mapping
response details.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44624
Switching to the "Unassigned" fleet with an automation filter already
set kept the filter's value in the URL, but the filter dropdown's option
list silently collapsed to only "All automations" and "Webhooks or
tickets" — the same restricted set used for "All fleets" — because the
"Unassigned" fleet's team ID (0) is falsy and was treated the same as
the undefined team ID used for "All fleets". This made the filter appear
to disappear from the UI.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
#### Before (issue's video)
https://github.com/user-attachments/assets/a2bca626-5700-4174-beb2-94aadf847a6c
#### After
https://github.com/user-attachments/assets/a5912056-02ef-4827-8110-29ad4d629fa8
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed the automations filter on the Policies page so it remains
visible when viewing the Unassigned fleet.
* Preserved the selected automation filter when switching views.
* Updated available options for Unassigned fleets by excluding Calendar
while retaining supported automation types.
* Improved the empty-state experience when no policies match the
selected filters.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated DuckDuckGo for macOS to version 1.198.0.
- Updated Electrum for macOS to version 4.8.0.
- Updated GOG GALAXY for Windows to version 2.1.6.29.
- Updated Notepad.exe for macOS to version 1.5.1.
- Updated Remote Desktop Manager for macOS to version 2026.2.3.1.
- Refreshed download links and verification checksums for each release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Snitcher/Radar tracking to website pages for improved visitor
insights.
* **Style**
* Cleaned up spacing and formatting in analytics and error-monitoring
configuration sections.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#49007
# Checklist for submitter
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* SCIM user create/reactivation, replace, patch, and delete flows now
automatically record certificate resend activities when applicable.
* Certificate resend activities are generated alongside SCIM
persistence, tied to the resulting “resent certificates”.
* **Bug Fixes**
* Improved reliability and synchronization of certificate resend
activity recording during SCIM and Google Workspace reconciliation.
* Failures to record individual resend activities no longer block the
underlying SCIM operation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** #21847
## Summary
`GetClientConfig` is called by every host every ~60 seconds. It rebuilds
the full pack config (all scheduled query SQL text) from DB and
JSON-marshals it on every request. For all hosts in the same team, the
result is identical, yet we run 3-5 DB queries + `json.Marshal` of ~50KB
per request.
This PR adds an in-memory cache for the marshaled pack config JSON,
keyed by `(teamID, queryReportsDisabled)` with a 1-minute TTL. The cache
is invalidated when queries or AppConfig are modified.
### What changed
- Extracted pack config building from `GetClientConfig` into a new
`getPackConfig` method
- Added `packConfigCache` field to Service struct using `go-cache`
(1-minute TTL, 5-minute cleanup)
- On cache hit (no legacy packs): returns cached `json.RawMessage`
immediately, skipping all DB queries and JSON marshaling
- On cache miss: builds pack config from DB, marshals, caches, and
returns
- Cache is flushed on any query mutation (`NewQuery`, `ModifyQuery`,
`DeleteQuery`, `DeleteQueries`, `ApplyQuerySpecs`, `DeleteQueryByID`)
and on `ModifyAppConfig`
### Expected impact at 100K hosts
| Metric | Before | After |
|--------|--------|-------|
| Pack config marshals/second | ~1,667 | ~1 per minute per team |
| DB queries for scheduled queries/second | ~5,000 | ~5 per minute per
team |
| CPU from JSON encoding | Dominant in pprof | Negligible |
### Known limitation
`ListScheduledQueriesForAgents` supports label-scoped query filtering
per host. The cache is keyed by team (not host), so when label-scoped
scheduled queries exist, all hosts in a team receive the same query set
from the cache regardless of their label memberships. This is an
acceptable trade-off because:
- Label-scoped scheduled queries are uncommon in most deployments
- The cache TTL is 1 minute, so divergence is temporary
- Running an extra query on a host is not harmful (just unnecessary
work)
- This can be refined in a follow-up to filter label-scoped queries from
the cached result
## Testing
### Unit tests (9 tests, all pass)
| Test | What it verifies |
|------|-----------------|
| `TestPackConfigCacheHit` | Second `GetClientConfig` call triggers zero
DB calls for scheduled queries |
| `TestPackConfigCacheInvalidationOnQueryCreate` | After
`InvalidatePackConfigCache()`, new query appears in config |
| `TestPackConfigCacheInvalidationOnQueryModify` | After invalidation,
updated SQL is reflected in config |
| `TestPackConfigCacheInvalidationOnQueryDelete` | After invalidation
with empty query list, packs key is absent |
| `TestPackConfigCacheInvalidationOnApplyQuerySpecs` | After
invalidation simulating GitOps apply, new specs appear |
| `TestPackConfigCacheTTLExpiration` | After 50ms TTL expires, fresh DB
read occurs and new query appears |
| `TestPackConfigCacheTeamIsolation` | Global, team-1, team-2 hosts get
correctly isolated cached configs |
| `TestPackConfigCacheLegacyPacksBypass` | Host with legacy pack
triggers DB calls on every request (no caching) |
| `TestPackConfigCachePerformance` | 1000 cached calls: 0 DB calls. 1000
uncached: 1000 DB calls. ~1.4x speedup with mock (real DB would be much
larger) |
```
=== RUN TestPackConfigCacheHit --- PASS (0.01s)
=== RUN TestPackConfigCacheInvalidationOnQueryCreate --- PASS (0.01s)
=== RUN TestPackConfigCacheInvalidationOnQueryModify --- PASS (0.01s)
=== RUN TestPackConfigCacheInvalidationOnQueryDelete --- PASS (0.01s)
=== RUN TestPackConfigCacheInvalidationOnApplyQuerySpecs --- PASS (0.01s)
=== RUN TestPackConfigCacheTTLExpiration --- PASS (0.11s)
=== RUN TestPackConfigCacheTeamIsolation --- PASS (0.01s)
=== RUN TestPackConfigCacheLegacyPacksBypass --- PASS (0.01s)
=== RUN TestPackConfigCachePerformance --- PASS (0.02s)
Performance: cached=2.37ms, uncached=3.42ms, speedup=1.4x
```
Note: The 1.4x speedup is with mock datastore (no real DB/network). With
real MySQL over network, the speedup would be orders of magnitude larger
since cached calls skip 3-5 DB round-trips + ~50KB JSON marshal
entirely.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
- [x] Confirmed that the fix is not expected to adversely impact load
test results
## QA: Load test verification
To validate the real-world impact, QA should run a load test before and
after this change and compare:
1. Capture a CPU pprof profile **before** the change under load (e.g.,
10K+ simulated hosts, 50+ scheduled queries)
2. Deploy the change and capture a **second** pprof profile under the
same load
3. Compare the flamegraphs -- the `encoding/json.Marshal` and
`GetClientConfig` CPU time should drop significantly
4. Monitor Fleet container CPU utilization -- expect a measurable
reduction in steady-state CPU
See #21847 for the original pprof showing `encoding/json` dominating CPU
at scale.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved host config response performance by caching pack
configuration data.
* Query changes now automatically refresh cached host config so updates
appear promptly.
* **Bug Fixes**
* Host configs now stay accurate after creating, updating, deleting, or
applying queries.
* Cached data is isolated correctly and falls back to fresh data when
legacy packs are present.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Resolves#47626.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Fixed Fleet re-enrollment on Linux for end-user authentication SSO
when the re-enrollment email differs from the original enrollment email.
- Re-enrollment now remaps the device to the correct SSO account, with
no SSO callback/login errors, and does not reuse the prior account UUID.
- **Tests**
- Added a regression test covering re-enrollment with the same device
host UUID but a different IdP user/email, validating email updates and
account UUID change.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Isabell Reedy