<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46390
Migration to add a non nullable team_id column. I chose this approach so
that server code doesn't have to deal with a potentially null team id
for categories. It first adds team_id=0 to all the existing categories,
then duplicates that for every fleet so that default categories can be
edited and deleted by admins.
It also renames the default categories to include the emojis in their
name, which required updating some test expectations, and also mapping
default names to the new ones for Fleet maintained apps. If we don't do
that, FMA's manifests would have to all be updated right after 4.87
releases and every user would have to migrate immediately. This would
also break existing gitops files if the names aren't mapped. The
alternative would be to keep the names unchanged, and add custom logic
in various places to insert the emojis in the backend and frontend.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves # None - Regenerating a cert to fix tests
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Replaced SCEP test CA certificates and associated encrypted
private-key test fixtures used by automated tests.
* **Chores**
* CI workflow path filters updated so changes to test data now trigger
test runs.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46475?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#44892
Claude also added tests, since this wasn't covered before, but I've kept
them in a separate commit in case they're not needed.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved spec parsing to correctly accept resources declared as either
team or fleet, handling nested spec keys consistently and preserving
backward-compatible behavior.
* **Tests**
* Added and updated tests and fixtures to validate parsing across both
team/fleet variants and to assert specific conflict/reporting behavior
when both keys are present.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44894?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Scott Gress <scott@fleetdm.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45281
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. Will be added in the backend work PR
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added backend tracking to consolidate Apple and Windows software
update settings into a single, consistent store with uniqueness and
cascade-delete safeguards.
* Backfilled existing qualifying Apple and Windows update configurations
into the new tracking store.
* **Tests**
* Added tests validating correct population, constraint enforcement, and
cascade-delete behavior.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46433?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
Follow up work as discovery made on the Apple reconciler changes.
One more follow up PR will come with a clean up of all old and unused
code.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Updated integration tests to use batched reconciliation workflows
instead of direct database manipulation.
* Improved test determinism by explicitly awaiting async
profile-schedule triggers before state assertions.
* Enhanced test failure diagnostics with more detailed profile
comparison messages.
* **Chores**
* Marked internal reconciliation methods for future deletion with TODO
annotations.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46321?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45285https://github.com/user-attachments/assets/c9a15135-cd90-40ef-b6a0-4d87ffd2b5f7
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. Added in backend task.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added configuration options for managing end-user local account types
(Admin, Standard, or None) on macOS devices.
* Added new end-user authentication settings section with the ability to
lock end-user information when Apple MDM is configured.
* **Bug Fixes**
* Fixed checkbox state representation to properly reflect disabled
values.
* **Style**
* Adjusted spacing and layout in setup experience components.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46195?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for Joplin application installation and management on
macOS via Homebrew.
* Added support for Joplin application installation and management on
Windows via Winget.
* Integrated Joplin icon into the application interface for visual
identification.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46424?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Extracts the OTEL trace, metric, and log provider setup out of
`runServeCmd` and into `initOTELProviders` in a new `cmd/fleet/otel.go`.
Same pattern as the prior extractions on this issue (#44929, #45343,
#45583, #46166). Side effects (`otel.SetTracerProvider`,
`otel.SetMeterProvider`) are preserved inside the extracted function, so
runtime behavior is identical.
Three unit tests in `cmd/fleet/otel_test.go`:
- OTEL disabled (the common production path) returns `(nil, nil, nil)`
and never calls `initFatal`.
- OTEL enabled without log export returns non-nil trace and meter
providers; logger provider stays nil.
- Log export enabled returns all three providers non-nil.
One honest note on coverage: the four `initFatal` sites inside the
function are paranoid wrapping for OTEL SDK constructors that don't dial
at construction time, so the error paths are hard to drive in tests
without mocking the SDK. The tests above exercise the success paths and
the disabled gate, which is the bulk of the realistic flow.
This continues the path toward `serve.go` >60% coverage per the
discussion on #33370 — `serve.go` is now ~100 lines shorter and the OTEL
phase is testable as a unit. Remaining slices per the broader plan: MDM
Apple init, datastore init, Redis init.
**Related issue:** Refs #33370
# Checklist for submitter
- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Centralized OpenTelemetry provider initialization into a single setup
path, simplifying startup and shutdown behavior and making observability
configuration clearer.
* **Tests**
* Added unit tests covering disabled/enabled telemetry paths and
optional log export, plus cleanup logic to ensure providers are shut
down correctly.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46421?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
We allow this already with "Preview payload" under Settings >
Integrations > MDM > End user migration workflow.
**Related issue:** Resolves#44719
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Closes#46153
This PR is big, but I found it worth it to include in the same PR to
keep the mental change context in one place.
This PR moves away from our previous version of a big SQL computing the
desired state and label membership with big union branches. It does so
by switching the model up completely, first:
- We batch read hosts (current hardcoded is 5k), and we always iterate
5k hosts and then decide if they have changes, so that means a tick
(30s) could read 5k hosts that DOES NOT require changes, but that is
computed in code after, rather than relying on a big SQL to do it
(twice).
- We then for those hosts, bulk fetch label memberships, their related
team profiles and current rows. This performs much better as we can
lookup everything we need by primary key or super fast indexed columns,
simple fetch all these calls.
- Then once gathered the information we move to the code to determine if
the operation is install, remove, NO-OP (Desired state calculation),
then we check the label membership to further determine it's final
action.
- We then move to what we did before, which is queue the correct command
etc.
It comes with some slight caveats, which is we now load a lot more data
into memory (but before we could spike worse), so when loadtesting we
watched CPU/Memory utilization, which never seemed to spike as the
datasets are kept as small as possible.
_Cleanup will come in a follow-up PR where we remove all the old code._
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Performance**
* Optimized Apple profile and DDM (Declarations) reconciliation engine
with batched processing for significantly improved performance in
environments with large numbers of Apple-enrolled hosts.
* Implemented cursor-based pagination for more efficient reconciliation
across large fleets.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45573?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude <noreply@anthropic.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45286
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Create local admin account = true
Primary account type = none
End user auth required = true
= No primary account setup screen shown - jumps straight to
username/password login which I can login to with the password shown in
the UI.
Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’`
only returns `_fleetadmin`
**Note: EACAS is not available on this mac (or this user?)** - however
it’s still possible to Wipe via MDM commands.
Create local admin account = true
Primary account type = standard
End user auth required = true
= Primary account setup screen shown (also works with IDP info being
locked and populated).
Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’`
returns `_fleetadmin` and my end user (IDP info locked in this case)
Opening Settings -> Users & Groups -> Shows my primary account as
“Standard”
**Note: Benefit of the user can’t do EACAS** (Prompted: “Admin user
required”)
__fleetadmin also can’t do EACAS_
Create local admin account = false
Primary Account type = N/A (but admin)
End user auth required = true
= Shown primary account setup screen with IDP info populated and locked
Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’`
only returns my primary user
Opening Settings -> Users & groups -> shows my primary account as
“Admin"
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* macOS setup now supports end-user account types: `admin`, `standard`,
or `none`.
* Setup flows and device commands respect the selected primary account
type (e.g., create regular user or skip creation).
* **Validation**
* Configuration now enforces that a local admin account exists/enabled
when required by the chosen end-user account type.
* **Tests**
* Added coverage for `standard` and `none` validation and command
behavior.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46179?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Update display names for consistency/branding: change "pgAdmin4" to
"pgAdmin 4" in ee/maintained-apps/inputs/homebrew/pgadmin4.json and
ee/maintained-apps/outputs/apps.json, and change "SourceTree" to
"Sourcetree" in ee/maintained-apps/outputs/apps.json. These edits align
app names with official branding and ensure consistent naming across
input and output manifests.
This pull request adds support for several new applications to the
maintained apps catalog, including their metadata, installation, and
uninstallation scripts for Windows and macOS. The changes ensure these
apps can be managed and deployed via the system, with appropriate
detection queries and categorization.
**New application support:**
* Added support for **Azul Zulu JDK 25** and **Azul Zulu JRE 25** on
Windows, including metadata, detection queries, and
installer/uninstaller scripts.
[[1]](diffhunk://#diff-e73703dde6f54dcc3362e12c0134707b6eb766427950dc1b6201b456646c2441R1-R11)
[[2]](diffhunk://#diff-f067c62ed110f736685711c61f01ff5d326530e602236b2ff4464cb12b320efbR1-R11)
[[3]](diffhunk://#diff-03d5e12f29ca434396eb8d95529351cdc1e37e937a0234d5d0f799ce32d99270R1-R22)
[[4]](diffhunk://#diff-69d0bc65a28bab22f22868659439314badb0f1d8576512b7a04184db0d5f04d2R1-R22)
[[5]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R256-R269)
* Added support for **Tableau Desktop** on Windows, including metadata,
install/uninstall PowerShell scripts for handling the WiX Burn bundle,
and catalog entries.
[[1]](diffhunk://#diff-da26f57894495ab515b6f07452f5bdf475e038e32dcd9235e2c461a2c50fe4c6R1-R13)
[[2]](diffhunk://#diff-ae3d9cdef4ee9b23a394bdd72ac9c1669d09f5e8cd63716c746ee862f3f1ab2eR1-R22)
[[3]](diffhunk://#diff-23116d8521375f8c07d973cb4a8424664511622be2f8054ff883762325a9fccaR1-R35)
[[4]](diffhunk://#diff-52b261b49349ced82dcec614b525537af74fb76b2b80d5b86bf47997dcc602a5R1-R94)
[[5]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R2090-R2096)
* Added support for **TeamViewer Host** on both Windows and macOS,
including metadata, install/uninstall scripts for Windows, and catalog
entries.
[[1]](diffhunk://#diff-cc1d69139e4cfc23694e1a7c911484b847730d6c989e3ef6e0a868ebb446f088R1-R13)
[[2]](diffhunk://#diff-957c90f066b977cb7909a37633955b9cd003bf6cb54d5571513509470a8da023R1-R8)
[[3]](diffhunk://#diff-6f0503390a74ce160c8cf97e8a21f6be441d96e8d7a7725b7fcd977020275208R1-R26)
[[4]](diffhunk://#diff-26c9cfc3f13dbdb9ad1e12ac786d8a8937bd88521a05c4024ee027edcf4338cbR1-R91)
[[5]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R2125-R2138)
* Added support for **VNC Server** on macOS, including metadata and
catalog entry.
[[1]](diffhunk://#diff-a5aa18a7d0dd174295ce8a65738eb9d499a3b22a810a9a566cdedfefea3eecb6R1-R8)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R2328-R2334)
**Supporting scripts and catalog updates:**
* Implemented robust PowerShell scripts for silent installation and
uninstallation of **Tableau Desktop** and **TeamViewer Host** on
Windows, handling edge cases such as process termination and registry
parsing.
[[1]](diffhunk://#diff-23116d8521375f8c07d973cb4a8424664511622be2f8054ff883762325a9fccaR1-R35)
[[2]](diffhunk://#diff-52b261b49349ced82dcec614b525537af74fb76b2b80d5b86bf47997dcc602a5R1-R94)
[[3]](diffhunk://#diff-6f0503390a74ce160c8cf97e8a21f6be441d96e8d7a7725b7fcd977020275208R1-R26)
[[4]](diffhunk://#diff-26c9cfc3f13dbdb9ad1e12ac786d8a8937bd88521a05c4024ee027edcf4338cbR1-R91)
* Updated `apps.json` outputs to include the new applications with
descriptions and platform information.
[[1]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R256-R269)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R2090-R2096)
[[3]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R2125-R2138)
[[4]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R2328-R2334)
This pull request introduces support for several new Windows
applications in the maintained apps catalog by adding their Winget
manifest JSON files and corresponding install/uninstall PowerShell
scripts. The main focus is on developer tools (DBeaver variants, Fork,
DB Browser for SQLite) and productivity software (Notion Calendar), with
scripts tailored to each application's installer type and uninstallation
method.
**New Application Manifests and Scripts:**
*Developer Tools:*
- Added manifests and install/uninstall scripts for `DBeaverEE`,
`DBeaverLite`, and `DBeaverUltimate`, handling silent installs and
registry-based uninstalls for NSIS installers.
[[1]](diffhunk://#diff-eaf4a46578aab1439f63fd34568a31a8af80686564126b42d35b58aa7f2c62e3R1-R13)
[[2]](diffhunk://#diff-e7f92237e92e146682aa31bba2adcb94960064cccbcba0aa4824d30fdb1db809R1-R13)
[[3]](diffhunk://#diff-c4cbef61403a529f50d498830989eb0eb45a0469d4c6a74731ba3404ec9a20b4R1-R13)
[[4]](diffhunk://#diff-7935ee0b5330d4aeaf7b86d764ec34df77d70906e4d15539b344a4ad26e2ce3dR1-R27)
[[5]](diffhunk://#diff-2f030daf30f518d6e45834242eff2f74ba59bcb11e7a266c37d227ccadaf2a5eR1-R75)
[[6]](diffhunk://#diff-76b88cbae2c5985490eb0fe76f3203db20fb0bf1b0de618923b23038112c1468R1-R27)
[[7]](diffhunk://#diff-1405c92b884320fb2c48b8c45d435a974db35b7eeceb1e9886a4adcb56416502R1-R75)
[[8]](diffhunk://#diff-e2284ea6c00f43ae37ac61c30a4787e77b7051df0fb91ae876662fbc6642e8f7R1-R27)
[[9]](diffhunk://#diff-ff8ec9020bc37f1350b45454e2e813aae39db842f30518d6ca0c31e67c4300e6R1-R75)
- Added manifest and install/uninstall scripts for `Fork`, supporting
silent Squirrel-based user installs and registry-based uninstalls.
[[1]](diffhunk://#diff-6e3b6ab0a68025636437cae06486a8037b30c8d67c6d64da78f5c2b5fcbad036R1-R12)
[[2]](diffhunk://#diff-58cf478f6b085152e55505765e959f3e2f251087edacb241ec8317a775934d95R1-R27)
[[3]](diffhunk://#diff-8affe7197066170c48e2badc36cedd32f0fa0229afbc2fd49fa844eadb84e25cR1-R69)
- Added manifest for `DB Browser for SQLite` with basic package
metadata.
*Productivity:*
- Added manifest and install/uninstall scripts for `Notion Calendar`,
supporting silent NSIS installs and registry-based user uninstalls.
[[1]](diffhunk://#diff-ec8fec2849c5d87cf4c21b1ba8f4aefd025cd9528590595c9d635699f85a5aecR1-R12)
[[2]](diffhunk://#diff-1d1b021f465f1417abc47475dabae2098f2b460cb9b46a649ef820517427440cR1-R27)
[[3]](diffhunk://#diff-54998d5d631d60bcb24503ba509beb0a3b760939476ecc12019b8960a877a9a4R1-R75)
*Other Installers:*
- Added install script for `Wacom Tablet Driver`, handling silent
InstallShield installs and special exit codes for reboot requirements.
Changes:
- Replaced the dropdown comparison switcher with tabs on the homepage
desktop comparison table.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Replaced the dropdown selector with a horizontal tabs interface in the
"Moving to Fleet?" comparison table, enabling users to easily switch
between vendor options. The tabs feature a visual indicator for the
active selection. Added responsive styling that adapts seamlessly to
smaller screen sizes, maintaining readability and usability across all
devices.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46407?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves https://github.com/fleetdm/confidential/issues/16119
- Re-orders and removes rows
- Replaces platform icons for easier-to-scan checkmarks
- Adds additional context in tooltips
I decided against adding tabs. They added visual weight without enough
benefit. The dropdown is clear enough on its own, and it's already the
second-most-clicked button on the page.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated product comparison tables (desktop and mobile) with reordered
rows and clearer layout
* Added distinct "Complete device inventory" and "Cloud or self-host"
entries with competitor-specific outcomes
* Renamed and clarified features: "Software updates"; "Configuration,
scripting, and diagnostics"; "Single API"; "Infrastructure as code"
* Revised competitor status displays and tooltip copy, including
standardized timing labels and outcome mappings
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46319?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#43456
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Android MDM profiles now include content checksums; devices are
re-synced only when profile content changes, reducing unnecessary
deliveries.
* **Migrations**
* Database schema updated to add and backfill checksum fields for
Android configuration and host profiles.
* **Tests**
* Added and updated tests to validate checksum generation, backfill, and
behavior in profile delivery scenarios.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46276?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41683
Updated frontend for Android commands along with additional changes in
the backend. Did full QA testing with test plan.
# Checklist for submitter
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Android MDM: added Clear passcode action, Unenroll behavior, and
refined BYO vs COBO action visibility and confirmations.
* Optimistic pending states and Android-specific success/error messages
in Lock/Wipe/Clear flows; modals require confirmations for Android.
* **Bug Fixes**
* More robust clearing of stale Android device actions during
re-enrollment and Pub/Sub flows to keep UI state accurate.
* **Tests**
* Expanded Android MDM tests for action visibility, pending states, and
end-to-end state transitions.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46174?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Jonathan Katz
