<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Changes:
- updated the route for /gitops-workshop to include the query string
when users are redirected to the /workshops page.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the legacy GitOps Workshop link to redirect permanently to the
workshops page.
* Preserved query parameters during the redirect for a more consistent
navigation experience.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49149
Adds **Mozilla VPN** as a Fleet-maintained app for both macOS (Homebrew
cask `mozilla-vpn`) and Windows (winget `Mozilla.VPN`), version 2.38.0.
Identity fields verified against the real installers (not catalog
metadata):
| | macOS | Windows |
|---|---|---|
| `unique_identifier` | `org.mozilla.macos.FirefoxVPN`
(CFBundleIdentifier from pkg PackageInfo) | `Mozilla VPN` (MSI
`ProductName`) |
| Publisher | — | `Mozilla Corporation` (MSI `Manufacturer` = winget
locale, no override needed) |
| Format/type | `pkg` | `msi` (winget `wix`, machine scope,
`ALLUSERS=1`) |
- Install/uninstall scripts auto-generated (machine-scope MSI + cask
artifacts/zap) — no custom scripts.
- Generated SHAs match the manifests (macOS `2803d4b4…`, Windows
`11a270b3…`).
- No bootstrapper (`ARPSYSTEMCOMPONENT` absent); pinned installer URLs;
no risk flags.
- On Windows, osquery reports `programs.version` as `2.38.0.0` vs the
FMA's `2.38.0`; `version_compare` treats a fresh install as ≥ target, so
the patch policy reports patched correctly.
- New app icon generated (`MozillaVpn.tsx`, website PNG, `index.ts` map
key `"mozilla vpn"` shared by both platforms).
# Checklist for submitter
- [ ] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43097
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved error messages for certificate authority operations when the
server private key is not configured.
* Added a direct “Learn more” reference to help resolve the
configuration issue.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated update of MIN_OSQUERY_VERSION_OPTIONS with any new osquery
release. (Note: This automatic update is the solution to issue #21431)
Co-authored-by: RachelElysia <RachelElysia@users.noreply.github.com>
This is needed to keep tools up to date with latest go.mod. Goal is for
these tools to have separate go.mod to reduce tool dependency on
production/main `go.mod`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Expanded automated validation to cover both tool modules, including
builds, dependency tidiness checks, and applicable tests.
* Added a `make tidy-tool-modules` command to tidy supported tool
dependencies automatically.
* Added validation for tool changes and root Go module updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#49007
## Testing
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved reliability when updating host-to-user mappings by ensuring
related mapping changes are completed as one transaction.
* Simplified certificate handling during mapping updates to provide more
consistent results.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** NA
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Article
New article: "How Fleet completes your Microsoft stack across every OS,
not just Apple"
(`articles/how-fleet-completes-your-microsoft-stack.md`).
Converted from a Google Doc draft into Fleet's article format: key
takeaways after the dek, post-takeaways CTA button to the Entra
conditional access guide, closing CTA to `/try-fleet` and `/contact`,
and a style sweep per the writing guide.
Version claims (Entra conditional access: macOS in 4.70.0, Windows in
4.84.0) verified against the changelog.
**Needs verification before publishing** (claims about Microsoft's
products):
- Intune's macOS compliance policy is a fixed six-item checklist, with
custom compliance policies unavailable for Apple platforms
- No documented CVE tracking for Apple devices in Microsoft's endpoint
management stack
## Testing
- [ ] QA'd all new/changed functionality manually (preview article
rendering on the website)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42721
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated iOS/iPadOS enrollment labeling to clarify the fully managed
company-owned option.
* Added enrollment guidance explaining that users must download the
profile in their browser and install it to enroll in Fleet.
* **Tests**
* Expanded coverage to verify the updated enrollment option and
instructions on iOS/iPadOS and Android.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Android MDM device policy logging during profile
reconciliation and verification, including host and profile counts.
* Added clearer warnings when policy updates are skipped while returning
an invalid policy version, preventing missing policy metadata from going
unnoticed.
* Enhanced verification diagnostics with more detail on
pending/failed/non-compliant profiles and warnings when expected policy
request details cannot be matched.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Resolves#38806
Add an IT-admin naming convention for macOS/iOS/iPadOS hosts. An admin
sets a name template (e.g. "iPad $FLEET_VAR_HOST_HARDWARE_SERIAL") under
Controls > OS settings > Host names for a fleet or for "No team"; Fleet
resolves it per host, delivers it via an Apple `Settings`/`DeviceName`
MDM command, renames its own record on ACK, then verifies the name via
osquery (macOS) or a DeviceInformation refetch (iOS/iPadOS). Clearing
the template stops enforcement without renaming any host. Fleet Premium
only, mirroring disk encryption.
Fixing an update of the main go.mod breaking the tool.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated internal tooling dependencies to support improved
compatibility and functionality.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This `resent_certificate` activity is generated from the edit user flow
in fleet server.
**Related issue:** Resolves#49007
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Device-to-identity-provider mapping changes can now generate
certificate resend activities when applicable.
* Certificate resend activities can now be marked as automated versus
manual.
* **Improvements**
* Certificate resend details are produced when SCIM host-user mappings
are added, updated, or removed.
* If creating the associated resend activities fails, the mapping change
still proceeds; errors are handled non-blockingly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #43667
# Summary
Renames the unreleased GitOps field `setup_experience_platforms` to
singular `setup_experience_platform`, accepting a comma-separated string
of `darwin`/`linux` (rejecting the `macos` alias) to match the
query/policy/label `platform` convention.
# Checklist for submitter
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Updated software setup-experience platform configuration to use a
single comma-separated `setup_experience_platform` value.
* Platform values are normalized for casing and whitespace,
deduplicated, and validated against supported platforms.
* macOS setup selections now use the canonical `darwin` value; the
`macos` alias is rejected.
* GitOps-generated configurations now use the updated field name and
platform format.
* **Bug Fixes**
* Improved validation messages for invalid setup-experience platform
values.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A — part of the Windows Fleet-maintained apps
catalog expansion (letter F batch; follows #48872, #48881, #48950,
#48969, #49086, #49186).
Adds eight new Windows Fleet-maintained apps:
| App | winget package | Installer | Notes |
|-----|----------------|-----------|-------|
| Foxit PDF Editor | `Foxit.PhantomPDF` | WiX bootstrapper EXE, machine,
x64 | Covers both "Foxit PDF Editor" and "…Pro" from the inventory (one
package). Runs an updater service → process-stopping uninstall. ARP key
lives in the WOW6432Node hive. |
| Foxit PDF Reader | `Foxit.FoxitReader` | WiX bootstrapper EXE,
machine, x64 | Distinct DisplayName from the Editor (verified via
msiinfo). Updater service → process-stopping uninstall. |
| FreeCAD | `FreeCAD.FreeCAD` | NSIS (MultiUser), machine, x64 |
`/AllUsers /S`; versioned ARP name ("FreeCAD 1.1.1") → `FreeCAD%` fuzzy.
|
| FastPictureViewer Professional |
`AxelRietschin.FastPictureViewer.Professional` | MSI, machine, x64 |
Versioned ARP name → fuzzy. Unversioned URL → `ignore_hash`. Declares
VCRedist deps (near-ubiquitous; noted). |
| FastStone Capture | `FastStone.Capture` | NSIS, machine, x86 | `/S`;
versioned ARP name → fuzzy. Paid trialware, but silent
install/detect/uninstall are clean. |
| FastStone Image Viewer | `FastStone.Viewer` | NSIS, machine, x86 |
`/S`; versioned ARP name → fuzzy. |
| FlexWhere for Desktop | `Dutchview.Flexwhere` | MSI, machine, x64 |
Auto-start tray app → process-stopping uninstall (stop process, then
msiexec /x via UpgradeCode). |
| Fortify | `PeculiarVentures.Fortify` | WiX MSI, machine, x64 (en-US) |
Smart-card/cert bridge; auto-start tray → process-stopping uninstall.
Per-arch+locale ProductCode, so `installer_locale: en-US`. |
Considered but **not** added (recorded in the workstream tracker):
- **FactSet Workstation** (`FactSet.FactSetWorkstation`): MSI defaults
to per-user (ALLUSERS=2 + MSIINSTALLPERUSER=1) with no machine-scope
override, AND a `SpawnFDSWorkstation` custom action launches the app at
install (headless-hang risk in a SYSTEM session). Niche licensed
terminal.
- **Filius** (`StefanFreischlad.Filius`): winget manifest is de-DE only
(no en-US locale); the ingester hard-codes the en-US locale fetch (same
limitation that deferred Araxis Merge).
- **FlashFXP** (`OpenSight.FlashFXP`): abandoned (frozen at 2017), the
vendor site returns HTTP 500, only a 16×16 icon is available, and its
InstallAware uninstall needs a fragile cached-setup `/s` injection.
- **Front** (`FrontApp.Front`): per-user-only electron-builder installer
(`Front-user-*.exe` → `%LocalAppData%`, HKCU); no machine/all-users
artifact in winget.
- **Autodesk Fusion** (`Autodesk.Fusion`): the winget "installer" is
`Fusion Client Downloader.exe`, a per-user streaming/web bootstrapper
that downloads at runtime, hangs headless, and needs interactive
Autodesk sign-in.
Identities verified per app (msiinfo Property tables; NSIS header
decompilation; winget AppsAndFeaturesEntries; uninstall-database
corroboration). Apps that run a service or auto-start tray (both Foxit
products, FlexWhere, Fortify) get process-stopping uninstalls up front
to avoid the MSI-rollback failure class. SHAs verified against manifests
for pinned URLs; `ignore_hash` only for FastPictureViewer's
actively-maintained latest-pointer URL. Icons via
`tools/software/icons/generate-icons.sh` (all ≥256px except
FastPictureViewer/Fortify at 256/180).
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [ ] QA'd all new/changed functionality manually (relying on the FMA CI
validator for Windows install/uninstall validation)
**Related issue:** Closes#48943
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Summary
Adds unit test coverage for external library upgrades that had no
automated tests:
- **DOMPurify** (`ClickableUrls_xss.tests.tsx`): 5 XSS sanitization
tests (script injection, javascript: in href, event handlers, iframe,
URL preservation)
- **react-markdown + remark-gfm** (`FleetMarkdown.tests.tsx`): 9
rendering tests (plain text, bold/italic, links, lists, GFM tables,
strikethrough, code blocks, inline code)
- **sonner** (`ToastNotification.tests.tsx`): 9 notify API tests
(success/error creation, empty-message fallback, custom id, dismiss,
batch, HTTP status label, axios response unwrap)
These gaps were identified through a comprehensive audit of all ~353
direct dependencies across Go and frontend. The Go backend has excellent
coverage (669+ test files). The frontend now has 333+ test files
covering all runtime libraries except 2 that are untestable at unit
level (systray GUI, sockjs WebSocket).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added coverage confirming potentially unsafe HTML and links are
sanitized before rendering, including protection against script,
`javascript:` URLs, and injected content.
* Added tests validating Markdown rendering for plain text, links,
fenced code blocks, and inline code.
* Added coverage for toast notifications, including success/error flows,
batching, dismissal, fallback messaging, ID handling, and mapping
response details.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44624
Switching to the "Unassigned" fleet with an automation filter already
set kept the filter's value in the URL, but the filter dropdown's option
list silently collapsed to only "All automations" and "Webhooks or
tickets" — the same restricted set used for "All fleets" — because the
"Unassigned" fleet's team ID (0) is falsy and was treated the same as
the undefined team ID used for "All fleets". This made the filter appear
to disappear from the UI.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
#### Before (issue's video)
https://github.com/user-attachments/assets/a2bca626-5700-4174-beb2-94aadf847a6c
#### After
https://github.com/user-attachments/assets/a5912056-02ef-4827-8110-29ad4d629fa8
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed the automations filter on the Policies page so it remains
visible when viewing the Unassigned fleet.
* Preserved the selected automation filter when switching views.
* Updated available options for Unassigned fleets by excluding Calendar
while retaining supported automation types.
* Improved the empty-state experience when no policies match the
selected filters.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated DuckDuckGo for macOS to version 1.198.0.
- Updated Electrum for macOS to version 4.8.0.
- Updated GOG GALAXY for Windows to version 2.1.6.29.
- Updated Notepad.exe for macOS to version 1.5.1.
- Updated Remote Desktop Manager for macOS to version 2026.2.3.1.
- Refreshed download links and verification checksums for each release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Snitcher/Radar tracking to website pages for improved visitor
insights.
* **Style**
* Cleaned up spacing and formatting in analytics and error-monitoring
configuration sections.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#49007
# Checklist for submitter
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* SCIM user create/reactivation, replace, patch, and delete flows now
automatically record certificate resend activities when applicable.
* Certificate resend activities are generated alongside SCIM
persistence, tied to the resulting “resent certificates”.
* **Bug Fixes**
* Improved reliability and synchronization of certificate resend
activity recording during SCIM and Google Workspace reconciliation.
* Failures to record individual resend activities no longer block the
underlying SCIM operation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** #21847
## Summary
`GetClientConfig` is called by every host every ~60 seconds. It rebuilds
the full pack config (all scheduled query SQL text) from DB and
JSON-marshals it on every request. For all hosts in the same team, the
result is identical, yet we run 3-5 DB queries + `json.Marshal` of ~50KB
per request.
This PR adds an in-memory cache for the marshaled pack config JSON,
keyed by `(teamID, queryReportsDisabled)` with a 1-minute TTL. The cache
is invalidated when queries or AppConfig are modified.
### What changed
- Extracted pack config building from `GetClientConfig` into a new
`getPackConfig` method
- Added `packConfigCache` field to Service struct using `go-cache`
(1-minute TTL, 5-minute cleanup)
- On cache hit (no legacy packs): returns cached `json.RawMessage`
immediately, skipping all DB queries and JSON marshaling
- On cache miss: builds pack config from DB, marshals, caches, and
returns
- Cache is flushed on any query mutation (`NewQuery`, `ModifyQuery`,
`DeleteQuery`, `DeleteQueries`, `ApplyQuerySpecs`, `DeleteQueryByID`)
and on `ModifyAppConfig`
### Expected impact at 100K hosts
| Metric | Before | After |
|--------|--------|-------|
| Pack config marshals/second | ~1,667 | ~1 per minute per team |
| DB queries for scheduled queries/second | ~5,000 | ~5 per minute per
team |
| CPU from JSON encoding | Dominant in pprof | Negligible |
### Known limitation
`ListScheduledQueriesForAgents` supports label-scoped query filtering
per host. The cache is keyed by team (not host), so when label-scoped
scheduled queries exist, all hosts in a team receive the same query set
from the cache regardless of their label memberships. This is an
acceptable trade-off because:
- Label-scoped scheduled queries are uncommon in most deployments
- The cache TTL is 1 minute, so divergence is temporary
- Running an extra query on a host is not harmful (just unnecessary
work)
- This can be refined in a follow-up to filter label-scoped queries from
the cached result
## Testing
### Unit tests (9 tests, all pass)
| Test | What it verifies |
|------|-----------------|
| `TestPackConfigCacheHit` | Second `GetClientConfig` call triggers zero
DB calls for scheduled queries |
| `TestPackConfigCacheInvalidationOnQueryCreate` | After
`InvalidatePackConfigCache()`, new query appears in config |
| `TestPackConfigCacheInvalidationOnQueryModify` | After invalidation,
updated SQL is reflected in config |
| `TestPackConfigCacheInvalidationOnQueryDelete` | After invalidation
with empty query list, packs key is absent |
| `TestPackConfigCacheInvalidationOnApplyQuerySpecs` | After
invalidation simulating GitOps apply, new specs appear |
| `TestPackConfigCacheTTLExpiration` | After 50ms TTL expires, fresh DB
read occurs and new query appears |
| `TestPackConfigCacheTeamIsolation` | Global, team-1, team-2 hosts get
correctly isolated cached configs |
| `TestPackConfigCacheLegacyPacksBypass` | Host with legacy pack
triggers DB calls on every request (no caching) |
| `TestPackConfigCachePerformance` | 1000 cached calls: 0 DB calls. 1000
uncached: 1000 DB calls. ~1.4x speedup with mock (real DB would be much
larger) |
```
=== RUN TestPackConfigCacheHit --- PASS (0.01s)
=== RUN TestPackConfigCacheInvalidationOnQueryCreate --- PASS (0.01s)
=== RUN TestPackConfigCacheInvalidationOnQueryModify --- PASS (0.01s)
=== RUN TestPackConfigCacheInvalidationOnQueryDelete --- PASS (0.01s)
=== RUN TestPackConfigCacheInvalidationOnApplyQuerySpecs --- PASS (0.01s)
=== RUN TestPackConfigCacheTTLExpiration --- PASS (0.11s)
=== RUN TestPackConfigCacheTeamIsolation --- PASS (0.01s)
=== RUN TestPackConfigCacheLegacyPacksBypass --- PASS (0.01s)
=== RUN TestPackConfigCachePerformance --- PASS (0.02s)
Performance: cached=2.37ms, uncached=3.42ms, speedup=1.4x
```
Note: The 1.4x speedup is with mock datastore (no real DB/network). With
real MySQL over network, the speedup would be orders of magnitude larger
since cached calls skip 3-5 DB round-trips + ~50KB JSON marshal
entirely.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
- [x] Confirmed that the fix is not expected to adversely impact load
test results
## QA: Load test verification
To validate the real-world impact, QA should run a load test before and
after this change and compare:
1. Capture a CPU pprof profile **before** the change under load (e.g.,
10K+ simulated hosts, 50+ scheduled queries)
2. Deploy the change and capture a **second** pprof profile under the
same load
3. Compare the flamegraphs -- the `encoding/json.Marshal` and
`GetClientConfig` CPU time should drop significantly
4. Monitor Fleet container CPU utilization -- expect a measurable
reduction in steady-state CPU
See #21847 for the original pprof showing `encoding/json` dominating CPU
at scale.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved host config response performance by caching pack
configuration data.
* Query changes now automatically refresh cached host config so updates
appear promptly.
* **Bug Fixes**
* Host configs now stay accurate after creating, updating, deleting, or
applying queries.
* Cached data is isolated correctly and falls back to fresh data when
legacy packs are present.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Resolves#47626.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Fixed Fleet re-enrollment on Linux for end-user authentication SSO
when the re-enrollment email differs from the original enrollment email.
- Re-enrollment now remaps the device to the correct SSO account, with
no SSO callback/login errors, and does not reuse the prior account UUID.
- **Tests**
- Added a regression test covering re-enrollment with the same device
host UUID but a different IdP user/email, validating email updates and
account UUID change.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes: https://github.com/fleetdm/fleet/actions/runs/29230539238
New run: https://github.com/fleetdm/fleet/actions/runs/29248404917
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security**
* Added vulnerability assessment records for CVE-2026-5773 and
CVE-2026-6276.
* Documented that the affected libcurl component is not used in the
relevant installer-generation execution path.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
**Related issue:** Resolves#49210
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved reliability when queuing managed configuration resend jobs by
ensuring newly created jobs start with a consistent empty error state.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Moved the clay analytics script tag in the website's `<head>` to the
end of the `<body>` tag
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated production analytics configuration.
* Adjusted the placement of an analytics initialization script to
support more consistent tracking behavior.
* Refined internal analytics labeling without changing the visible
website experience.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48542
## Description
The `QueryClient` was created with `new QueryClient()` and no default
options, so every query inherited React Query's default
`refetchOnWindowFocus: true`. On pages like `/policies` and `/users`,
queries are refetched every time the browser window regains focus. Those
focus refetches re-rendered the table with fresh data, tripping
react-table's `autoResetSelectedRows` and `autoResetPage` (both default
`true`), so the table appeared to "reload," clearing the user's row
selection and jumping back to the first page when they clicked away and
back.
## Screen recording demonstrating the fix
https://github.com/user-attachments/assets/eabf30a5-65d3-420d-a8d3-5a529fa06089
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Prevented users and policies tables from unexpectedly reloading when
switching back to the browser window.
* Preserved table state such as selected rows and current pagination
instead of resetting to the first page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Removed an analytics script tag from the website's header
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed the Snitcher verification and tracking integration.
* Updated analytics-related labeling to reflect the revised tracking
setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35328
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved link hover and `:focus-visible` underline/outline behavior
for more consistent accessibility across tables, buttons, and modals.
* Fixed script name hover underline clipping in the run script modal.
* **Style**
* Refreshed `CustomLink` styling with an emphasized variant and improved
underline behavior, plus updated related link/table/button styling for a
unified look.
* Updated “Connect Fleet” info-banner messaging and CTAs for calendar
and conditional access automations; refreshed “No scripts available”
empty state.
* **Tests**
* Updated modal tests to match revised link text and accessible names.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A — part of the Windows Fleet-maintained apps
catalog expansion (letter E batch; follows #48872, #48881, #48950,
#48969, #49086).
Adds eleven new Windows Fleet-maintained apps:
| App | winget package | Installer | Notes |
|-----|----------------|-----------|-------|
| Eclipse Temurin JDK 8 | `EclipseAdoptium.Temurin.8.JDK` | MSI (WiX),
machine, x64 | Per-major pin. |
| Eclipse Temurin JDK 11 | `EclipseAdoptium.Temurin.11.JDK` | MSI (WiX),
machine, x64 | Per-major pin. |
| Eclipse Temurin JDK 17 | `EclipseAdoptium.Temurin.17.JDK` | MSI (WiX),
machine, x64 | Per-major pin. |
| Eclipse Temurin JDK 21 | `EclipseAdoptium.Temurin.21.JDK` | MSI (WiX),
machine, x64 | Per-major pin. |
| Eclipse Temurin JRE 8 | `EclipseAdoptium.Temurin.8.JRE` | MSI (WiX),
machine, x64 | Per-major pin. |
| Eclipse Temurin JRE 11 | `EclipseAdoptium.Temurin.11.JRE` | MSI (WiX),
machine, x64 | Per-major pin. |
| Eclipse Temurin JRE 17 | `EclipseAdoptium.Temurin.17.JRE` | MSI (WiX),
machine, x64 | Per-major pin. |
| Eclipse Temurin JRE 21 | `EclipseAdoptium.Temurin.21.JRE` | MSI (WiX),
machine, x64 | Per-major pin. |
| exacqVision Client | `ExacqTechnologies.exacqVisionClient` | MSI,
machine, x64 | Clean MSI; ARP name `exacqVision Client (x64)`. |
| Egnyte WebEdit | `Egnyte.EgnyteWebEdit` | MSI, machine, x86 | Distinct
product from the existing Egnyte Desktop FMA (separate
ProductCode/UpgradeCode/ARP name). |
| Elevate UC | `Serverdata.ElevateUC` | MSI, machine, x64 | Intermedia
UC client. Unversioned latest-pointer URL with ~monthly cadence →
`ignore_hash`. |
**Eclipse Temurin (8 apps).** All are clean machine-scope WiX MSIs from
Eclipse Adoptium. The ARP DisplayName embeds the full patch version —
`Eclipse Temurin JDK with Hotspot 17.0.19+10 (x64)` — and JDK/JRE of the
same major share a version prefix, so each major is pinned with an
`exists_query` that combines the JDK-vs-JRE name prefix, the publisher,
and a major version filter, e.g.:
```
SELECT 1 FROM programs WHERE name LIKE 'Eclipse Temurin JDK%' AND publisher = 'Eclipse Adoptium' AND version LIKE '17.%';
```
The `JDK`/`JRE` token in the name prefix keeps a JDK install from
matching the JRE FMA and vice-versa; the `version LIKE '<major>.%'`
keeps each major distinct. This mirrors the existing Amazon Corretto
per-major FMAs. Identities (DisplayName, publisher `Eclipse Adoptium`,
4-part ProductVersion) were verified via `msiinfo` on the real x64 MSIs.
Considered but **not** added (recorded in the workstream tracker):
- **ESET Endpoint Antivirus** (`ESET.EndpointAntivirus`) and **ESET
Endpoint Security** (`ESET.EndpointSecurity`): the install succeeds
headless without a license, but uninstall is Self-Defense (HIPS)
protected — it requires a reboot to complete and is widely documented to
fail unattended (needing the ESET Uninstaller Tool in Safe Mode), so a
reliable silent SYSTEM-context removal can't be guaranteed. They're also
managed enterprise agents meant for central ESET PROTECT deployment
(standalone installs land unactivated and disable Windows Defender).
Still to verify (not in this PR): EndNote, Enpass, Evernote, and
UltraISO — their verification pass was interrupted and will be handled
separately.
Identities verified via `msiinfo` Property tables. SHAs verified against
manifests for pinned URLs; `ignore_hash` used only for Elevate UC's
actively-maintained latest-pointer URL. Icons via
`tools/software/icons/generate-icons.sh`.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [ ] QA'd all new/changed functionality manually (relying on the FMA CI
validator for Windows install/uninstall validation)
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated maintained app releases for Claude, Electrum, GOG Galaxy, IBM
Notifier, MacWhisper, Tuple, Typeface, WebCatalog, and WhatsApp.
* Added the latest Windows and macOS installer versions, download links,
and verified checksums.
* Updated GOG Galaxy’s macOS installation reference for the new release.
* Improved release detection so installed applications can be accurately
compared with the latest available versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#49013
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Hid the **Install all** button on the unfiltered **All** software
view.
* Kept **Install all** available when a specific category is selected.
* Updated install-all behavior so the correct category is used when
launching installs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Noah Talerman