Add support for Pd (Pure Data) on macOS: new Homebrew input manifest and
installer script, outputs and apps entry, frontend icon and image, and a
version transformer.
- Add ee/maintained-apps/inputs/homebrew/pd.json and install script
scripts/pd-install.sh that unzip the Homebrew archive, mount the
embedded DMG, copy the .app, and handle quitting/relaunching the app.
- Add ee/maintained-apps/outputs/pd/darwin.json with version, installer,
hashes, and embedded install/uninstall script refs; add app entry to
ee/maintained-apps/outputs/apps.json.
- Register Pd in Homebrew external refs mapping and add
PdVersionTransformer to convert Homebrew version strings like "0.56-3"
to the dotted macOS bundle_short_version form "0.56.3" so
version_compare and patch detection work correctly.
- Add frontend icon component and PNG asset, and update the icon index
to include Pd.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Pure Data (Pd) now supported on macOS with automated installation,
uninstallation, and relaunch functionality.
* Pd icon added to the software page interface for visual
identification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add a new winget maintained-app entry for SQL Server Management Studio
(SSMS) 22. Includes input JSON (Microsoft.SQLServerManagementStudio.22)
and two PowerShell scripts: an installer wrapper that runs the Visual
Studio bootstrapper (vs_SSMS.exe) with --quiet --norestart --wait, and
an uninstaller that looks up the ARP entry for SSMS 22.x and invokes the
Visual Studio Installer uninstall verb with silent switches. Also update
outputs: add the app to apps.json and add version metadata (installer
URL, sha256, and embedded script refs) in
outputs/sql-server-management-studio/windows.json.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* SQL Server Management Studio 22 is now supported for installation and
management on Windows platforms, providing database developers and
administrators with essential tools for development and administration
* **Improvements**
* Extended Windows script execution timeout to support installation of
large and complex applications with substantial installation payloads
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
Also fixed the currently failing check on main.
Final zizmor PR
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security & Infrastructure**
* Enhanced credential handling in automated workflows by disabling
unnecessary credential persistence
* Strengthened security scanning configuration to enforce additional
checks on GitHub Actions workflows while maintaining a curated allowlist
for compatibility
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46567
Loadtest feedback: reducing the number of `UPDATE
mdm_windows_enrollments e SET e.has_pending_commands` writes.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed Windows MDM enrolled devices to correctly track pending
commands. Acknowledged commands are now properly removed from the
pending list, and the system accurately reflects command status after
device acknowledgment. Command cleanup for processed requests is now
more efficient.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46637
- Updated the wording and flow of the guide
- Included links to new configuration profiles in the solutions folder
- Added alternative option for enrolling in to cloud management
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a Windows configuration profile to enable enrolling Google
Chrome into enterprise management.
* Included a template with a placeholder enrollment token for
administrators to replace when configuring device management.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## New Features
* CapCut application now supported with macOS integration, including
installation, uninstallation, and version management capabilities.
* CapCut application icon added to the software library interface.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#46869
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Host vitals labels based on identity-provider group membership now
correctly apply to both global and team-scoped hosts, preventing
cross-team leakage.
* **Tests**
* Added and updated tests to validate IdP-group-backed vitals label
membership across global and per-team hosts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Pure refactor, no behavior change. First step for #45635 (Windows
batched in-memory reconciler).
- New server/mdm/reconcile package holds the include/exclude label
handlers and the team+label applicability dispatcher. The Apple platform
gate stays in the Apple wrapper since platform eligibility is
platform-specific.
- New platform-neutral fleet types (MDMProfileLabelRef,
MDMProfileIncludeMode, MDMLabeledEntity); the Apple names are now type
aliases so existing code and tests are unchanged.
- BulkGetHostLabelMemberships moves from apple_mdm_batched.go to a
neutral file; it was already platform-agnostic.
- The existing Apple label-scenario tests keep covering the shared logic
through the delegating wrappers; the shared package also gets its own
handler/dispatcher tests.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45635
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Moved MDM profile include/exclude label logic into a shared,
platform-neutral reconciliation flow for consistent behavior across
platforms.
* Consolidated Apple MDM label handling to reuse the shared
reconciliation primitives and improved host label membership lookup
behavior.
* **Tests**
* Added and reorganized unit tests covering MDM label-based profile
reconciliation, include/exclude rules, and Apple-specific wrapper
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Extracts the osquery status, result, and audit JSON logger setup out of
`runServeCmd` and into a new `cmd/fleet/logging.go`. Same pattern as the
prior extractions on this issue (#44929, #45343, #45583, #46166, #46421,
#46517, #46742, #46830). Continues trimming `runServeCmd` toward the
`serve.go` coverage goal on #33370 — this is the largest single slice so
far (~100 lines out).
Three functions come out of the inline block:
- `initOsqueryLogging` — builds the status and result loggers, plus the
audit logger when enabled. Mutates the shared `logging.Config` per
logger in the same sequence as before, so the constructed loggers are
identical.
- `buildLoggingConfig` — maps `config.FleetConfig` into the common
`logging.Config` shared by all three loggers.
- `shouldEnableAuditLog` — the premium-and-enabled gate for the audit
logger, pulled out so the decision is its own testable unit.
Behavior is preserved — `runServeCmd` calls this in the same place with
the same arguments, the per-logger config mutation order is unchanged,
and the full `cmd/fleet` suite passes against MySQL + Redis.
`initOsqueryLogging` returns early after `initFatal` so it's safe when
the caller's `initFatal` doesn't terminate (the case in tests), and it
guards a nil license up front since the audit gate dereferences it
(matching the nil-guard precedent from #46742/#46830).
On test scope: `TestShouldEnableAuditLog` covers all four combinations
of license tier and the config flag — audit logging is a premium
feature, so the gate is the meaningful decision here.
`TestBuildLoggingConfigMapsConfig` is a light check that the config
mapping is wired through. I didn't add a full `initOsqueryLogging`
happy-path unit test: `logging.NewJSONLogger` constructs real log sinks,
so that path is exercised by booting the server rather than by standing
up logger backends in a unit test.
**Related issue:** Refs #33370
# Checklist for submitter
- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Audit logging support is now available for premium license holders.
* **Refactor**
* Improved logging initialization and configuration management.
* **Tests**
* Added test coverage for audit logging enablement and configuration
mapping.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for three new macOS applications—BlueJ,
Burp Suite Community Edition, and LastPass—to the maintained apps
system. For each app, it introduces input definitions, output metadata,
and versioned install/uninstall scripts, enabling automated management
and inventory tracking for these apps on macOS.
**New macOS app support:**
* Added BlueJ:
- Introduced input definition (`bluej.json`) and output metadata
(`bluej/darwin.json`) with version, installer URL, and install/uninstall
scripts for BlueJ on macOS.
[[1]](diffhunk://#diff-722b9528fb3be4468c7992392cf001960853cafbae8b5140629a249a82dda943R1-R8)
[[2]](diffhunk://#diff-bb31a08cf30698a5c90ca13291bf7ca42214067807c28c34792140885a08213cR1-R22)
- Updated `apps.json` to include BlueJ for the `darwin` platform with a
description.
* Added Burp Suite Community Edition:
- Added input definition (`burp-suite.json`) and output metadata
(`burp-suite/darwin.json`) with version, installer URL, and
install/uninstall scripts for Burp Suite Community Edition on macOS.
[[1]](diffhunk://#diff-531fac23f77bd78bb99d6a3ffb9adac799d0506ea6e2ee95cbad214323e1790fR1-R8)
[[2]](diffhunk://#diff-0e6ed40888accd3caaf87216e64bce80ac0b884ecc7b7998f42ef28bcf9ad87fR1-R22)
- Updated `apps.json` to include Burp Suite Community Edition for the
`darwin` platform with a description.
* Added LastPass:
- Added input definition (`lastpass.json`) and output metadata
(`lastpass/darwin.json`) with version, installer URL, and
install/uninstall scripts for LastPass on macOS.
[[1]](diffhunk://#diff-4e017dbc26ca7fadc4365ae49dc1017e7646bebef7547643f71ede34af0bd1aaR1-R8)
[[2]](diffhunk://#diff-5ce50d7b8be0cbca9aa3fc2b15eef2159044b446cd77a1ca583c2e31e7ac8815R1-R22)
- Updated `apps.json` to include LastPass for the `darwin` platform with
a description.
Add Winget input manifest and PowerShell install/uninstall scripts for
Beekeeper Studio, and register the app in outputs. Files added:
ee/maintained-apps/inputs/winget/beekeeper-studio.json, install and
uninstall scripts under inputs/winget/scripts, and
ee/maintained-apps/outputs/beekeeper-studio/windows.json (version 5.8.1
with installer URL and SHA256). Also update
ee/maintained-apps/outputs/apps.json to include the Windows entry.
Installer script runs the NSIS installer silently with /S and /allusers
for machine-scope installs; the uninstaller searches ARP registry
entries, parses the uninstall string, and enforces /S and /allusers to
ensure a machine-scoped uninstall.
This pull request updates the uninstall scripts to treat additional MSI
exit codes that indicate a successful uninstall (but may require a
reboot) as success, rather than failure. This improves the robustness of
the uninstall process by not incorrectly flagging these scenarios as
errors.
**Improvements to exit code handling in uninstall scripts:**
* Added support for treating MSI exit codes `3010`
(ERROR_SUCCESS_REBOOT_REQUIRED) and `1641`
(ERROR_SUCCESS_REBOOT_INITIATED) as success, in addition to `0`, in both
`uninstall_msi.ps1` and `uninstall_msi_with_upgrade_code.ps1`. This is
achieved by introducing a `$successCodes` array and updating the exit
code checks to use it.
[[1]](diffhunk://#diff-09e225a2a28fbf997ddf571274119a20d9210539e5bdd49749beb2226e6de5aaR15-R20)
[[2]](diffhunk://#diff-c24faec992d742fed7d16c8621f140f7048ecb2cc88bd135fcf02cbd8653f77bR5-R8)
[[3]](diffhunk://#diff-c24faec992d742fed7d16c8621f140f7048ecb2cc88bd135fcf02cbd8653f77bL17-R21)
**Test updates:**
* Updated the golden test data for `uninstall_msi.ps1` to reflect the
new logic for handling successful exit codes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved MSI uninstall handling to recognize additional success
conditions, including scenarios requiring system restart, enhancing the
reliability of software removal operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add maintained-app metadata for Microsoft Remote Help on darwin: new
Homebrew input
(ee/maintained-apps/inputs/homebrew/microsoft-remote-help.json),
register the darwin variant in ee/maintained-apps/outputs/apps.json, and
add detailed release data in
ee/maintained-apps/outputs/microsoft-remote-help/darwin.json. The darwin
output includes version 1.0.2601221, installer URL, SHA256,
installer/uninstaller script refs and existence/patched queries to
detect installation state.
Register IBM Notifier in maintained apps and add frontend assets. Adds a
homebrew input (ibm-notifier.json), a new apps output entry, and darwin
metadata (version 3.2.3) including installer URL, sha256, and
install/uninstall script refs. Also adds a frontend SVG icon component,
the PNG app icon asset, and registers "ibm notifier" in the icon map.
Default category set to "Developer tools."
Add DFU Blaster Pro to maintained apps: input metadata (homebrew) and
outputs including an apps.json entry and a darwin-specific output with
version 4.2, installer URL, sha256, and install/uninstall script refs.
Include install/uninstall scripts that handle DMG installation, app
quit/relaunch, and cleanup of receipts/services. Also add a frontend
SVG/PNG icon (DfuBlasterPro component and 60x60@2x PNG) and update the
icons index to export the new icon. Default category set to Utilities.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Kitty for macOS to version 0.47.2
* Updated Stats for macOS to version 3.0.1
* **Bug Fixes**
* Improved Slack for Windows uninstall process to ensure reliable
package removal
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added support for Google Antigravity IDE with complete installation
and uninstallation capabilities on both macOS and Windows platforms
* Application is now discoverable and installable through the software
management interface
* Added visual icon representation for the application
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Add winget inputs, install/uninstall scripts, and outputs for PostgreSQL
15, 16 and 17. Each version includes a JSON input manifest,
install/uninstall PowerShell scripts (EnterpriseDB/BitRock installer
with --mode unattended and --unattendedmodeui none), and generated
outputs (per-version windows.json refs and apps.json entries). Also add
frontend SVG icon components and 2x PNG assets for each version to
display in the UI.
Add support for PostgreSQL 18 on Windows: new winget input manifest and
per-machine installer/uninstaller PowerShell scripts; outputs metadata
for version 18.4-1 (installer URL, sha256, and script refs) and app
registration in apps.json. Also add frontend icon component and 60x60
image asset, and update icons index to include the new icon. This
enables silent install/uninstall via the EnterpriseDB (BitRock)
installer and exposes the app in the software listing.
## Problem
The Slack Windows (winget/MSIX) uninstall script selected provisioned
packages with:
```powershell
$packageFamilyName = $PACKAGE_ID
Get-AppxProvisionedPackage -Online | Where-Object { $_.PackageFamilyName -eq $packageFamilyName }
```
Two bugs compound here:
1. **`Get-AppxProvisionedPackage` objects have no `PackageFamilyName`
property** (that's on `Get-AppxPackage` results), so
`$_.PackageFamilyName` is `$null` for every provisioned package.
2. **The FMA validator never substitutes `$PACKAGE_ID`** — it runs the
raw ref script with no substitution — so `$packageFamilyName` is also
`$null`.
The filter reduces to `$null -eq $null` → **true for every package**, so
the script tries to remove *all* provisioned packages on the machine and
fails on protected ones like `Microsoft.DesktopAppInstaller` (exit code
1603). This is the same failure mode just fixed for Affinity.
## Fix
Rewrite `slack_uninstall.ps1` to match Slack by literal identity —
across `DisplayName`/`PackageName` for provisioned packages and
null-guarded `Name`/`PackageFamilyName`/`Publisher` for installed
packages — following the working `claude_uninstall.ps1` pattern. No
longer depends on `$PACKAGE_ID` substitution or a property the
provisioned object lacks, so it works in both the validator and
production.
Regenerated the output manifest ref: `ae79ce28` → `1be2e38e` (content
hash verified against the source script).
## Note on MS Teams
`msteams_uninstall.ps1` is **not** affected — it matches a literal
`DisplayName` (`"MSTeams"`), a real property on provisioned packages,
rather than `PackageFamilyName`/`$PACKAGE_ID`. No change needed.
## Testing
- [ ] FMA validator run on a Windows host with Slack installed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Slack uninstallation reliability by enhancing package
detection logic to handle various package identification methods instead
of exact ID matching.
* Enhanced uninstall process with more robust error handling, timeout
protection (5-minute limit), and verbose progress logging for better
visibility during removal operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for several new Windows applications to
the maintained apps catalog, along with robust PowerShell install and
uninstall scripts for each. The main focus is on enabling automated,
silent deployment and removal of these apps using Winget, with careful
handling of installer quirks and registry lookups to ensure reliability
in enterprise environments.
**New application support:**
* Added `Citrix Workspace`, `Evernote`, `ExpressVPN`, `Front`, `Hyper`,
`Jabra Direct`, `Microsoft Teams`, `OneDrive`, `Opera`, `Podman
Desktop`, and `REAPER` to the `ee/maintained-apps/inputs/winget` catalog
with appropriate metadata for each app.
[[1]](diffhunk://#diff-3ba331a553f359a02dd3d824d3edab85292e2d1d9c1a6a739e313a9b63d5a88fR1-R13)
[[2]](diffhunk://#diff-917d3e25bae801c48ae70f70bf43e8540d962046bb773dbeed633eb52323e084R1-R12)
[[3]](diffhunk://#diff-b8f4026fc2a89254c0bdeb905120761ee78c6a76101deaf3dadd814ce3cafa94R1-R12)
[[4]](diffhunk://#diff-72a2bcc2c2b9fadcf09505f8caefb681e79679ee99fb068a84698c783e81f17dR1-R12)
[[5]](diffhunk://#diff-5bdb4220ac0cc23ff96963f975a55ef081493ee797545e0a1f65f9f4c50ef982R1-R12)
[[6]](diffhunk://#diff-941487a1c1f2ba4d2da50e47f47bbab46478f2bb7c7e009fdd21bf2b68090413R1-R12)
[[7]](diffhunk://#diff-9b5681ffd0b55fd89ce4f69e07668fa23df9582a921bf2000d9d2230429e16c9R1-R12)
[[8]](diffhunk://#diff-b69363f34d224c471ec183bf7a2d6bab13d776c8905e499cac0e39f31868fd19R1-R12)
[[9]](diffhunk://#diff-c8b49c5881565261369d37c862e055087cc65819900f961841c7dc76a83a879dR1-R13)
[[10]](diffhunk://#diff-88ceb0a6b8de6484bfcb3f0d19264e307d3166a34f992eba11fcc9d60facb052R1-R13)
[[11]](diffhunk://#diff-2557d37d79e9889f60f30557f28efb327e02bf33d4b255deefa912f855111412R1-R14)
**Install script implementations:**
* Added PowerShell install scripts for each new app, ensuring silent,
machine- or user-scoped installs as appropriate, with correct handling
of installer arguments and exit codes (including treating
reboot-required codes as success for Citrix Workspace and ExpressVPN).
[[1]](diffhunk://#diff-ccd33aec25bdbda547e3c4c9b4bcc32d923dcacfe6ebda1a80256d3388bb9003R1-R41)
[[2]](diffhunk://#diff-2b0d909e843c3c8265f67dd0e69843c4b59cea7d33741c5be8662ad464f39832R1-R34)
[[3]](diffhunk://#diff-fa9d859aa98e8240b9882363a62dc7c69a61186d186cf07c8065a8e11547a3c7R1-R37)
[[4]](diffhunk://#diff-9baf7c34c008963410a30fec1e6949023d03d3c400ec0166c029dd5eebcfaefeR1-R27)
**Uninstall script implementations:**
* Added PowerShell uninstall scripts for each new app, using registry
lookups to locate the correct uninstaller and applying silent uninstall
arguments. Scripts handle argument parsing defensively and ensure
correct removal in both per-user and per-machine contexts.
[[1]](diffhunk://#diff-ab38143c2c6f191c4f57aff0adb35e8c7a67cd95522da13da25febc8f65cc73eR1-R92)
[[2]](diffhunk://#diff-4657653f749298d4ae84fb467023108a273c8e621c8cc711d5821fbeacfa03cdR1-R91)
[[3]](diffhunk://#diff-1280127be173a1bdce9e7f18343fa6aae26fc3d15e1935e196669131deb484bdR1-R89)
These additions significantly expand the catalog's Windows app coverage
and improve reliability and automation for enterprise deployments.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Google Antigravity is now available for macOS via DMG installer.
* Supports automatic install and uninstall, preserving app state and
relaunching if needed.
* App appears in the software library with a dedicated icon for easier
discovery.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
This pull request adds support for several new Windows applications to
the maintained apps list by introducing new configuration JSON files for
each app under the `ee/maintained-apps/inputs/winget/` directory. Each
file defines metadata and installation details for a specific
application, including installer type, architecture, scope, categories,
and optional install/uninstall scripts. This update expands the range of
applications that can be managed and deployed.
**New application definitions:**
*Communication and Collaboration:*
- Added `Amazon Chime` (`amazon-chime.json`), `Front` (`front.json`),
and `Microsoft Teams` (`microsoft-teams.json`) with configuration for
installation, uninstallation, and categorization under "Communication".
[[1]](diffhunk://#diff-296db54aa9d8cea8e1302cc76e43abfd7565ab011bb3d1318a0d46c12b4b35f7R1-R12)
[[2]](diffhunk://#diff-72a2bcc2c2b9fadcf09505f8caefb681e79679ee99fb068a84698c783e81f17dR1-R12)
[[3]](diffhunk://#diff-9b5681ffd0b55fd89ce4f69e07668fa23df9582a921bf2000d9d2230429e16c9R1-R12)
*Productivity and Utilities:*
- Added `AnyDesk`, `Citrix Workspace`, `DeepL`, `Egnyte`, `Elgato
Control Center`, `Elgato Stream Deck`, `Evernote`, `ExpressVPN`,
`Hyper`, `Jabra Direct`, `Keeper Password Manager`, `LibreOffice`, and
`MindManager` with appropriate installer details, categories, and
scripts where applicable.
[[1]](diffhunk://#diff-9a7ba8c0afb32ab31c2950a4a95847fa1293411416302cd6698dc2bcb519fbfdR1-R12)
[[2]](diffhunk://#diff-3ba331a553f359a02dd3d824d3edab85292e2d1d9c1a6a739e313a9b63d5a88fR1-R13)
[[3]](diffhunk://#diff-03fc24bba02df2bcfb57acabaffd8d3afac94bafbda450c4336a67f85bc4429eR1-R12)
[[4]](diffhunk://#diff-ab44cad18bc633e446e1acd1714034464a92721e175cd0bd835fdb8eb4a7e0c8R1-R10)
[[5]](diffhunk://#diff-e5b9495ea0a996194b5c04a9327b33220a7b24e0e9abff2153c98ec949018bc0R1-R10)
[[6]](diffhunk://#diff-53b6cdd6d7032bffc8307f93a03eae3f1e82b57fa03316ad10b5b1af02b6c103R1-R10)
[[7]](diffhunk://#diff-917d3e25bae801c48ae70f70bf43e8540d962046bb773dbeed633eb52323e084R1-R12)
[[8]](diffhunk://#diff-b8f4026fc2a89254c0bdeb905120761ee78c6a76101deaf3dadd814ce3cafa94R1-R12)
[[9]](diffhunk://#diff-5bdb4220ac0cc23ff96963f975a55ef081493ee797545e0a1f65f9f4c50ef982R1-R12)
[[10]](diffhunk://#diff-941487a1c1f2ba4d2da50e47f47bbab46478f2bb7c7e009fdd21bf2b68090413R1-R12)
[[11]](diffhunk://#diff-605ef361eebaf639aaa110d3599f53f84c5cd3fc2cbcb5960bb741385b59e5eaR1-R12)
[[12]](diffhunk://#diff-fde7bf26f42621dd7f096bbb626af339e27312c0ca380ca2ef4a9f68ab1278ddR1-R11)
[[13]](diffhunk://#diff-c293d2eda9fea8cc74547aefd99e078d181f29b04b4289ee88bbf91b09432ae1R1-R13)
*Developer Tools:*
- Added `Arduino IDE` and `iMazing Profile Editor` with installer
metadata and categorized as "Developer tools".
[[1]](diffhunk://#diff-eaf314e8b4d4156a5f428809d9dd6484d5585bfc7382658fc93744750347773fR1-R10)
[[2]](diffhunk://#diff-649ae93e725621f9ee7d5fcddb3e81a2338eb3017ffae40a5dd915f42b75c8cfR1-R12)
*Browsers and Utilities:*
- Added `Arc` (browser) and `iMazing` (utility) with installation
details and script paths.
[[1]](diffhunk://#diff-bc27e68e5949eb7e4fd3c1d54f9f89b86cb6aed0e908f6687a4549dc81b65f49R1-R12)
[[2]](diffhunk://#diff-7c778f4e3418f1b5ad0094b2c5d366d3690ae480ef3910f1833fba1197d71d9bR1-R12)
This pull request adds support for the Comet browser (an AI-integrated
browser from Perplexity) to the maintained apps catalog for both macOS
and Windows. It introduces metadata, installation, and uninstallation
scripts, as well as versioned definitions for both platforms.
**New application support: Comet browser**
*Metadata and catalog integration:*
- Added `comet.json` metadata files for Homebrew (macOS) and Winget
(Windows) in the `inputs` directory, defining identifiers, installer
types, and categories.
[[1]](diffhunk://#diff-60e2346d602b7538ba08314f7adfdde98ca8e802dd3706c65bb75273fe7bbbd4R1-R8)
[[2]](diffhunk://#diff-ecdccc5ed1a1f1e6f2b66439941fcd74419b2706c1df155cb4bc1940abd6bfa7R1-R13)
- Updated `apps.json` to include Comet for both `darwin` (macOS) and
`windows` platforms with descriptive text.
*macOS support:*
- Added `outputs/comet/darwin.json` with versioned app definition,
install/uninstall queries, download URL, and references to
install/uninstall scripts.
*Windows support:*
- Added `outputs/comet/windows.json` with versioned app definition,
install/uninstall queries, download URL, SHA256, and references to
install/uninstall scripts.
- Added PowerShell scripts for silent installation (`comet_install.ps1`)
and uninstallation (`comet_uninstall.ps1`) of Comet, handling
machine-wide deployment and proper exit codes.
[[1]](diffhunk://#diff-5b9c60857fd2a49958f05124e8744394683297127503578e9b4eaf227470f1f7R1-R31)
[[2]](diffhunk://#diff-3433e05da3c0601490c7d90084264d4a793d0feef4211569b4aff884f85116dbR1-R101)
Add TablePlus Windows packaging: input manifest, PowerShell
install/uninstall scripts, and outputs. The install script runs the Inno
Setup installer silently with /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
/ALLUSERS; the uninstall script locates the Inno Setup uninstaller via
registry and runs it with silent args. apps.json was updated to include
TablePlus and a new outputs/tableplus/windows.json was added with
version 7.1.2, installer URL, sha256, and script references.
## Summary
Adds **WinRAR 7.22.0** as a Fleet-maintained app (Windows / winget
`RARLab.WinRAR`).
## Details
- **Installer type**: `exe` (WinRAR self-extracting installer), machine
scope → custom install/uninstall scripts (the ingester only
auto-generates for machine-scope MSI).
- **Silent install**: `-s1` — from the winget manifest's documented
`InstallerSwitches.Silent`.
- **Silent uninstall**: `uninstall.exe /S` located via the registry
`UninstallString`, parsed with the defensive 3-shape matcher.
- **Identity**: `unique_identifier: "WinRAR"` + `fuzzy_match_name: true`
→ exists query `name LIKE 'WinRAR %' AND publisher = 'win.rar GmbH'`.
Fuzzy match is required because WinRAR's registry DisplayName embeds the
version (`WinRAR 7.22.0 (64-bit)`). Registry Publisher matches the
winget locale Publisher, so no `program_publisher` override.
- **SHA**: matches the manifest's en-x64 installer; version `7.22.0`
reconciles with osquery's DisplayVersion.
- **Icon**: generated component, website PNG, and `index.ts` map entry
(`winrar`).
## Notes / risks
- Installer URL (`https://www.rarlab.com/rar/winrar-x64-722.exe`) is
version-pinned, so the SHA is stable until the FMA auto-update bumps it.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added WinRAR application support, including version 7.22.0 with
automated installation and uninstallation capabilities.
* Added custom WinRAR icon for improved visibility on the software page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add Zen Browser support: new PowerShell install and uninstall scripts
(silent NSIS installer with /S and /PreventRebootRequired; uninstaller
detects registry entries and runs uninstall string). Add winget input
manifest ee/maintained-apps/inputs/winget/zen-browser.json referencing
those scripts. Update outputs: add a apps.json entry for Zen Browser and
create ee/maintained-apps/outputs/zen-browser/windows.json containing
version 1.20b metadata, installer URL, sha256, and script refs.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated installer metadata for 13 apps (new versions, updated download
links and checksums) across Windows and macOS.
* Added a Windows uninstall script for TextExpander and registered it in
the package manifest to improve uninstall behavior and exit-code
handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Introduce a new content-style skill under .claude/skills/content-style
with a SKILL.md and three reference docs (content-types.md,
positioning.md, style-rules.md) to capture Fleet's voice, format rules,
and messaging guidance for authoring and reviewing public-facing
content. Also add .kilo/kilo.jsonc to register the .claude/skills path
so Kilo Code loads the skill automatically.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated project configuration to support automated skill management
infrastructure.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46467?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Introduce Groove OmniDialer to the maintained apps dataset and UI. Adds
a homebrew input (dmg) and an apps.json entry, plus a darwin-specific
output with version 26.603.1017, installer URL, sha256, and embedded
install/uninstall script refs. Also adds a frontend SVG icon component,
registers it in the icons index, and includes the app PNG asset.
Install/uninstall scripts handle quitting/relaunching the app and
cleaning user data.
Add ClickShare to maintained apps and frontend. Creates a Homebrew input
(ee/maintained-apps/inputs/homebrew/clickshare.json), adds an apps.json
entry, and adds an outputs file for darwin with version 4.50.0
(installer URL, sha256, and install/uninstall script refs). Also adds a
React SVG icon component, registers it in the icon map, and includes the
60x60@2x PNG asset for the app. Default category set to Communication.
Register Microsoft 365 Copilot: add a Homebrew input (unique_identifier
com.microsoft.m365copilot), add an apps.json entry, and add
darwin-specific output with version 1.2605.2501 (installer URL, sha256,
install/uninstall script refs). Also add a React SVG icon component,
update the icons index map, and include the app icon image asset.
Introduce Power Monitor (corp.sap.PowerMonitor) for Darwin: add Homebrew
input, register app in ee outputs/apps.json, and add detailed
ee/maintained-apps/outputs/power-monitor/darwin.json with version 1.3.3,
installer URL, sha256 and install/uninstall script refs. Also add
frontend assets — a React SVG icon component, register it in the icon
map, and include a 60x60@2x PNG app icon. This enables listing,
installation, and clean uninstallation of the Power Monitor app.
Introduce support for Cinc Workstation across the app catalog and UI.
Adds a winget input (ee/maintained-apps/inputs/winget/cinc.json), a new
apps catalog entry (ee/maintained-apps/outputs/apps.json), and a
Windows-specific output with versioned metadata
(ee/maintained-apps/outputs/cinc/windows.json) including installer URL,
SHA256, and install/uninstall script refs for version 23.5.1040. Also
adds a React SVG icon component, maps the app name to the icon
(frontend/pages/SoftwarePage/components/icons/*), and includes the 60x60
PNG asset for the app icon.
Rename Windsurf to Devin Desktop across EE manifests and frontend
assets. Bump darwin version to 3.0.28 and update installer URL, SHA256,
and install/uninstall script refs and contents
(ee/maintained-apps/inputs/homebrew/* and ee/maintained-apps/outputs/*).
Update ee/maintained-apps/outputs/apps.json to list Devin Desktop and
remove the old Windsurf entry. Add a new React SVG icon component and
register it in the icons index, and add the corresponding PNG asset
(frontend/pages/SoftwarePage/components/icons/DevinDesktop.tsx,
frontend/pages/SoftwarePage/components/icons/index.ts,
website/assets/images/*).
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Claude Windows to version 1.11187.4
* Updated Ollama Windows to version 0.30.6
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Claude Desktop (macOS) to version 1.11187.4
* Updated Cursor (macOS) to version 3.7.12
* Updated Figma Desktop (macOS) to version 126.4.13
* Updated Fork (Windows) to version 2.20.0
* Updated Ollama (macOS) to version 0.30.6
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected redirect links for Apple Business Manager documentation
resources, ensuring users are directed to the appropriate help content
within the Fleet UI.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for PowerShell as a managed Windows app,
including its metadata, versioning, install/uninstall scripts, and
validation logic in the CI workflow. It also ensures that any
pre-installed PowerShell 7 is removed from the test environment before
validation. The most important changes are:
**PowerShell app definition and metadata:**
* Added a new entry for PowerShell in
`ee/maintained-apps/inputs/winget/powershell.json` and included its
metadata in `ee/maintained-apps/outputs/apps.json`, enabling PowerShell
to be managed as a Windows app.
[[1]](diffhunk://#diff-7e4899a379d327948f55b7e6ba4c9893501713edd16020b128b68343569fcbfbR1-R10)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1985-R1991)
* Created `ee/maintained-apps/outputs/powershell/windows.json`
containing version information, SQL queries for existence and patch
status, installer/uninstaller scripts, and download URL for PowerShell
7.6.2.0.
**CI workflow enhancements for PowerShell:**
* Updated `.github/workflows/test-fma-windows-pr-only.yml` to detect
changes involving PowerShell, set the appropriate output flags, and
conditionally execute PowerShell-specific steps.
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR102)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR116)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR155-R162)
* Added a workflow step to remove any pre-installed PowerShell 7 from
the GitHub Actions runner, ensuring a clean environment for validation.
* Ensured that validation and related steps use Windows PowerShell 5.1
(not pwsh) after uninstalling PowerShell 7, to avoid shell availability
issues.
These changes collectively enable PowerShell to be validated, installed,
and uninstalled as part of the managed apps ecosystem and ensure
reliable, repeatable CI validation.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added PowerShell as a supported application with full Windows
integration, including installation and uninstall management
capabilities.
* Enhanced deployment scripts to support flexible input handling for app
configurations.
* Added PowerShell icon to the frontend UI for visual identification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/46872
Changes:
- Updated the `productCategories` value of the testimonial from Adam
Pippert to show it on the /software-management page.
- Updated the order of testimonials on the homepage,
/software-management, /device-management, and /linux-management
Allen Houchins
