**Related issue:** Resolves#50360
Adds Microsoft .NET Desktop Runtime 10 as a Windows Fleet-maintained
app, from winget `Microsoft.DotNet.DesktopRuntime.10` (10.0.10, WiX burn
bundle, x64).
This closes the gap opened by HandBrake (#50323 / #50352). HandBrake
requires the .NET **Desktop** Runtime and its install script now
hard-fails without it, but Fleet had no FMA that could satisfy that — we
ship `microsoft-dotnet-runtime-8`/`-10`, which are the *base* runtime, a
different package with its own Add/Remove Programs entry. The customer's
ManageEngine catalog also deploys the Desktop Runtime directly.
## Verification
The winget manifest supplies `AppsAndFeaturesEntries`, and I confirmed
each value against the real installer by extracting the burn bundle's
registration data:
```
Microsoft Windows Desktop Runtime 10.0.10 (x64)
Publisher="Microsoft Corporation"
Version="10.0.10.50000"
```
- Installer SHA confirmed against a local download (`e82fc901…84d1`).
- The `DisplayName` carries both version and architecture, so the exists
query uses the same `LIKE 'Microsoft Windows Desktop Runtime 10.%' AND
name LIKE '%(x64)'` shape as the existing base-runtime FMAs.
- The bundle exposes several ProductCodes (the bundle plus its MSI
components), which is exactly the shape the existing uninstall script
already documents and handles.
**`use_display_version_for_patch` is required here.** The registry
`DisplayVersion` is `10.0.10.50000` but the winget package version is
`10.0.10`. Without the flag the patch policy would compare against the
marketing version and mis-order against what osquery reports. The
generated patched query correctly compares against `10.0.10.50000`.
## Reuse rather than duplication
- **Scripts:** this reuses `microsoft_dotnet_runtime_install.ps1` /
`_uninstall.ps1` unchanged. The Desktop Runtime is the same burn bundle
shape, and the uninstaller already resolves the bundle from the injected
`$PACKAGE_ID` with a Package Cache fallback. Those scripts are already
shared by the two base-runtime FMAs, so this follows the existing
pattern rather than adding a near-identical copy.
- **Icon:** reuses the existing `MicrosoftDotnetRuntime` component and
its `.NET` artwork. The burn bundle only carries a 32×32 icon, so
extracting one would have meant shipping a blurry upscale of the same
logo.
The new map key is `"microsoft .net desktop runtime"` (no version). Icon
lookup is a loose *prefix* match — `s === key || s.startsWith(key + "
")` — so one key covers 10 and any future major, mirroring how
`"microsoft .net runtime"` already serves both base-runtime FMAs. It is
longer than that key, and lookup sorts longest-first, so the desktop
runtime cannot be mis-matched to the base runtime icon.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Microsoft .NET Desktop Runtime 10 to the Windows software
catalog.
* Added support for installing and uninstalling the x64 desktop runtime,
including version detection and reboot handling.
* Added a dedicated Microsoft .NET Runtime icon for the software
listing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#50323
Adds HandBrake as a Windows Fleet-maintained app, from winget
`HandBrake.HandBrake` (1.11.2, NSIS, machine scope, x64). Found in a
customer's ManageEngine ServiceDesk Plus Windows deployment catalog with
no Fleet equivalent.
Per @allenhouchins' guidance on the issue, the `.NET Desktop Runtime 10`
prerequisite is handled in the install script with a clear failure
message rather than left to fail silently after install.
## The prerequisite check
HandBrake's own installer text states it plainly:
> HandBrake requires Microsoft .NET *Desktop* Runtime 10. If this is not
installed, you will be prompted to install it when you first run the
app.
The installer neither bundles nor installs that runtime, and the FMA
ingester drops winget's `Dependencies` field. Without a check, Fleet
would install HandBrake, register it in Add/Remove Programs, report
success, and the user would hit a runtime prompt on first launch. The
script now checks
`%ProgramFiles%\dotnet\shared\Microsoft.WindowsDesktop.App\10.*` and
exits 1 with an actionable message when it is absent.
Two things worth reviewers' judgement:
- **We fail rather than warn.** The vendor does prompt the user at first
run, so an install without the runtime is recoverable by hand. I chose
to fail because in a SYSTEM-context managed deployment an end-user
runtime prompt is a support ticket, and a truthful "install failed, here
is why" is more useful than a silently unusable app. Easy to soften to a
warning + `Exit 0` if we would rather defer to the vendor's prompt.
- **We ship no `.NET Desktop Runtime` FMA today.** Fleet has
`microsoft-dotnet-runtime-8`/`-10`, but those are the *base* runtime,
not the Desktop runtime — a separate package with its own ARP entry. So
there is currently no in-product way to satisfy this prerequisite; an
admin has to deploy the runtime by other means. That gap is worth its
own issue.
## Identity — two traps, both from reading the vendor's NSIS script
HandBrake's
[`Installer64.nsi`](https://github.com/HandBrake/HandBrake/blob/master/win/CS/HandBrake.Nsis.Installer/Installer64.nsi)
writes only four values:
```nsis
Name "${PRODUCT_NAME} ${PRODUCT_VERSION}"
...
WriteRegStr HKLM "${PRODUCT_UNINST_KEY}" "DisplayName" "$(^Name)"
WriteRegStr HKLM "${PRODUCT_UNINST_KEY}" "UninstallString" "$INSTDIR\uninst.exe"
WriteRegStr HKLM "${PRODUCT_UNINST_KEY}" "DisplayIcon" "$INSTDIR\HandBrake.exe"
WriteRegStr HKLM "${PRODUCT_UNINST_KEY}" "DisplayVersion" "${PRODUCT_VERSION}"
```
1. **`DisplayName` is version-suffixed** (`HandBrake 1.11.2`), so the
exists query is a prefix match, not equality.
2. **No `Publisher` is ever written.** The default generated query would
have pinned `publisher = 'The HandBrake Team'` from the winget locale
manifest and matched nothing, forever, while the validator still passed.
The exists query is overridden to drop the publisher clause.
`UninstallString` is also an unquoted path containing spaces
(`C:\Program Files\HandBrake\uninst.exe`), which the defensive parser in
the uninstall script handles by capturing through `.exe`.
The uninstall script additionally waits for the registry entry to
disappear: a silent NSIS uninstaller returns before removal completes,
so its exit code alone is not a reliable completion signal.
## Verification
- Installer SHA confirmed against a local download (`6becb8e5…f8cd`);
the URL is GitHub Releases, so none of the SourceForge trouble from
#50322 applies.
- **No icon work needed.** Reusing the catalog name `HandBrake` means
this shares the existing `handbrake` icon with `handbrake-app/darwin`,
and the two group together in the FMA library.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added HandBrake 1.11.2 to the Windows maintained applications catalog.
* Added support for silent installation and uninstallation, including
version detection and installer verification.
* Added validation for the required .NET Desktop Runtime 10
prerequisite.
* Added handling for installation completion, reboot-required results,
and uninstall status reporting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#50331
Adds Scribe as a Windows Fleet-maintained app, from winget
`ColonyLabs.ScribeDesktopCapture` (6.7.23.0, MSI, machine scope, x64).
Found in a customer's ManageEngine ServiceDesk Plus Windows deployment
catalog with no Fleet equivalent.
The simplest of this batch: a plain machine-scope MSI, so the install
and upgrade-code uninstall scripts are auto-generated and no custom
scripts are needed.
## Verification
Identity read directly from the MSI Property table rather than inferred
from winget:
```
ProductName Scribe
Manufacturer Colony Labs, Inc
ProductCode {87a51b1f-554d-414d-92a4-002a0916c91c}
UpgradeCode {351EF756-3AF5-4117-8697-53AB61427040}
ALLUSERS 2
```
`Manufacturer` matches the winget locale `Publisher` exactly, so no
`program_publisher` override is needed. `ALLUSERS=2` confirms
per-machine install when elevated, which is how Fleet runs it. No
`ARPSYSTEMCOMPONENT`, so this is a real product entry and not a
bootstrapper.
- Installer SHA confirmed against a local download of
`Scribe_6.7.23.msi` (`41004c21…9b74`).
- Icon extracted from the MSI's own `Scribe for Windows.exe` resource,
not sourced from the web.
## Note on the name
`Scribe` is a generic `DisplayName`, so the exists query pins `publisher
= 'Colony Labs, Inc'` to avoid matching an unrelated product of the same
name.
This is **not** related to `timescribe/darwin`, which is already in the
catalog — different vendor, different product. It deliberately does not
share that catalog name or icon.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Scribe to the maintained applications catalog for Windows.
* Added support for installing and uninstalling Scribe MSI packages,
including version detection and installer metadata.
* Added reliable installation handling with logging, elevated execution,
restart control, and support for standard successful installer exit
codes.
* Added the Scribe app icon to the software interface.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
**Related issue:** Resolves#50330
Adds Paint.NET as a Windows Fleet-maintained app, from winget
`dotPDN.PaintDotNet` (5.1.12, machine scope, x64). Found in a customer's
ManageEngine ServiceDesk Plus Windows deployment catalog with no Fleet
equivalent.
## Identity: winget's metadata is wrong here
The winget locale manifest gives `PackageName: paint.net` (lowercase).
The actual registry `DisplayName` is **`Paint.NET`**, read straight out
of the MSI Property table:
```
ProductName Paint.NET
Manufacturer dotPDN LLC
UpgradeCode {04A40F40-A207-4B48-AED7-6AA532E43275}
ALLUSERS 2
```
There is no `ARPDISPLAYNAME` override and no `ARPSYSTEMCOMPONENT`, so
`ProductName` is what lands in Add/Remove Programs. Taking the winget
name at face value would have produced an exists query that silently
never matches. `ALLUSERS=2` confirms it installs per-machine when run
elevated, which is how Fleet runs it.
## This is a zip-wrapped installer
Paint.NET publishes **only** `.zip` assets — there is no bare `.exe` or
`.msi` on the vendor's GitHub releases. So this uses `installer_type:
zip` with custom scripts, following the existing precedent of
`agent-ransack`, `adobe-acrobat-pro`, `vnc-server`, and `vnc-viewer`.
The install script extracts the archive and runs the nested installer
with `/auto`, the vendor's silent switch per the manifest's
`InstallerSwitches`.
**Uninstall resolves the product from the UpgradeCode, not the
ProductCode.** Paint.NET's ProductCode changes with every release, and
the `.exe` and `.msi` variants register *different* ProductCodes. The
UpgradeCode is stable — I verified it is identical across 5.1.10 and
5.1.12 — so `RelatedProducts` on it removes whichever variant is
present.
## One thing reviewers may want to change
The manifest offers six installers; three are x64/machine/zip and differ
only by `NestedInstallerType` (`exe`, `wix`, `portable`). The ingester's
selection loop takes the **first** match and breaks, so it picks the
`.install.x64.exe` bootstrapper. The `.winmsi.x64.zip` variant is
arguably the better FMA target — a plain MSI with predictable ARP
behaviour — but there is no way to express "prefer this nested type" in
the input today. Selecting it would need an ingester change, so I did
not do it here. Worth a follow-up if we hit trouble with the
bootstrapper.
## Verification
- Zip SHA confirmed against a local download (`3cd861b5…c867`); archive
contains exactly one file, `paint.net.5.1.12.install.x64.exe`.
- Icon extracted from that installer's own 256px resource, not sourced
from the web.
- Icon map key is `"paint.net"`, the lowercased catalog name. The icon
generator derives its key from the slug and produced `"paint dot net"`,
which would never have matched at runtime — corrected by hand.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Paint.NET to the Windows software catalog.
* Added support for installing, upgrading, detecting, and uninstalling
Paint.NET.
* Added Paint.NET branding and an icon to the software interface.
* Included Paint.NET version 5.1.12 with verified download metadata and
Productivity categorization.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#50377
# What this does
Adds **Dante Controller** as a macOS Fleet-maintained app, from Homebrew
cask
[`dante-controller`](https://formulae.brew.sh/cask/dante-controller)
(4.18.1.1). The cask ships a DMG containing `DanteController.pkg`, so
`installer_format: "dmg"` with the standard mount-and-`installer -pkg`
install script — the same shape as AdGuard, Adobe Acrobat Pro, and other
existing DMG+pkg FMAs. Uninstall is fully generated from the cask's
directives (2 `launchctl` services, 8 `pkgutil` receipt IDs, 3 zap trash
paths) — no custom scripts.
Windows is out of scope: no `Audinate.DanteController` winget package
exists. See #50377 for the full feasibility analysis, including why
Dante Virtual Soundcard was excluded on both platforms.
## Notes
- **Identity verified against the real installer**, not cask metadata.
Extracted `DanteController.pkg` from the DMG and read the app bundle's
`Info.plist`: `CFBundleIdentifier` =
`com.audinate.dante.DanteController`, confirming the input's
`unique_identifier`. This needed checking because the cask's preferences
path uses a *different* domain (`com.audinate.dante.controller`).
- `CFBundleShortVersionString` and `CFBundleVersion` are both
`4.18.1.1`, matching the cask version, so the exists/patched queries
reconcile with osquery's `apps` table.
- Installer SHA confirmed against a local download of the DMG
(`4515cd12…38ff`) — matches both the cask and the generated output.
- **Arch split.** The cask ships separate arm64/x64 DMGs; the brew API's
top-level URL (which the ingester pins) is the arm64 build. This matches
the behavior of the ~173 existing darwin FMAs with arch-specific URLs.
- **`auto_updates true`.** Dante Updater self-patches, so hosts may
drift ahead of the FMA-pinned version.
- Ships a new catalog icon, extracted from the app bundle's own `.icns`
— not sourced from the web.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
macOS runner — [run
30682752130](https://github.com/fleetdm/fleet/actions/runs/30682752130/job/91322957939)
(`Found app: 'Dante Controller' at /Applications/Dante Controller.app,
Version: 4.18.1.1` → `All 1 apps were successfully validated.`)
- [x] Generated output verified locally: installer SHA matches the cask,
exists/patched queries checked against the app bundle's `Info.plist`,
`apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
---------
Co-authored-by: Claude <noreply@anthropic.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated app catalogs with the latest releases for Actual, BoltAI, Bome
Network, DBeaver Community, Dockside, ExifCleaner, Firefox Nightly,
LinearMouse, Ocenaudio, OpenRCT2, Spokenly, Stats, WinDirStat, and Zed.
- Added refreshed installer links, version detection, and integrity
checks for the updated packages.
- Updates cover macOS and Windows, including DBeaver Community and Zed
on both platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Resolves#50266.
At production numbers the table looks like this - 20,691 CVEs × 83,000
hosts, ~268M raw (cve, host) rows (software + OS joins combined):
```
┌─────────────────────────┬─────────────────────────┬───────────────────────┐
│ Shape of host IDs │ Old (map[string][]uint) │ New (roaring bitmaps) │
├─────────────────────────┼─────────────────────────┼───────────────────────┤
│ Dense (contiguous runs) │ 2,479 MB │ 4.5 MB │
├─────────────────────────┼─────────────────────────┼───────────────────────┤
│ Sparse (random) │ 2,488 MB │ 282 MB │
└─────────────────────────┴─────────────────────────┴───────────────────────┘
```
A few things worth noting about how these map to your real data:
- The old cost is shape-independent: ~2.5 GB retained just for the
result map (268M rows × 8 bytes plus append slack), and the peak during
collection is higher still because append doubling leaves garbage
behind. That's the number that was blowing up the cron.
- The new sparse figure is an overstated worst case. Your 268M rows
include duplicates — multiple vulnerable software rows per host for the
same CVE (the multi-kernel case) and overlap between the software and OS
joins. The old code retained every raw row; the bitmap dedupes on Add,
so it's bounded by unique pairs, and real fleets with AUTO_INCREMENT
host IDs sit much closer to the dense row than the sparse one.
- The new representation also has a hard ceiling the old one doesn't: a
roaring bitmap over 83k host IDs maxes out around 16 KB per CVE
regardless of contents, so even a pathological dataset caps at ~330 MB
for all 20,691 CVEs — versus the old form growing linearly with join
rows, unbounded.
TL;DR: At scale the change is roughly a 550× reduction in the realistic
(dense) case, and at minimum ~9× in the theoretical worst case.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [X] Confirmed that the fix is not expected to adversely impact load
test results
- [X] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Performance**
- Reduced memory usage for CVE chart data collection.
- Improved efficiency when processing large CVE and affected-host
datasets.
- **Bug Fixes**
- Preserved correct CVE filtering, duplicate-host handling,
disabled-fleet exclusions, and empty-result behavior.
- Added coverage for CVEs sourced from both software and
operating-system data.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves #
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [ ] QA'd all new/changed functionality manually
---
## Summary
Updates the Evernote macOS application version from 11.20.2 to 11.27.5
in the maintained apps configuration. This change updates both the
version identifier and the corresponding SQL query that checks for
patched versions.
## Changes
- Updated `ee/maintained-apps/outputs/evernote/darwin.json`:
- Version bumped from `11.20.2` to `11.27.5`
- Updated the `patched` query to check against the new version `11.27.5`
instead of `11.20.2`
This ensures that Fleet's vulnerability detection and patching workflows
correctly identify whether Evernote on macOS is up-to-date with the
latest version.
https://claude.ai/code/session_01F85XismGHNQj3ZEn7zPNpD
Co-authored-by: Claude <noreply@anthropic.com>
Automated unfreeze probe. Removes `"frozen": true` and regenerates the
output manifest so
`test-fma-darwin-pr-only` can validate `nvidia-geforce-now/darwin` at
its current upstream version.
Frozen since: 2026-06-15 (#47645, automated FMA update run)
Version: 2.0.85.133 -> 2.0.87.131
Upstream Homebrew cask reports 2.0.87.131, which is newer than the
pinned 2.0.85.133, so this is
a genuine forward bump rather than a regression.
Note: the regenerated manifest also picks up a newer
`uninstall_script_ref`, because the frozen
output missed the script-template updates that landed on main while it
was pinned.
Draft until validation reports. Merge only if the FMA checks are green
and the validate shard
actually ran for this slug.
**Related issue:** NA
# Checklist for submitter
- [x] QA'd all new/changed functionality manually — pending CI
validation, see above.
---
_Generated by [Claude
Code](https://claude.ai/code/session_01F3HnFWdGjLMbqHdxWZXBAo)_
Co-authored-by: Claude <noreply@anthropic.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated release metadata for 24 maintained applications across macOS
and Windows.
- Added the latest available versions of apps including 3DF Zephyr Free,
BoltAI, ChatGPT, Firefox Nightly, Microsoft Edge, Shotcut, Telegram,
Teleport Connect, Typora, and Zappy.
- Refreshed download links and verification checksums to ensure
installations use the correct release packages.
- Updated Teleport Suite’s macOS installation package to match version
18.10.3.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#50305
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Performance Improvements**
* Improved software ingestion performance by optimizing software title
lookups.
* Reduced unnecessary database scanning while preserving matching for
bundle identifiers, names, and Windows upgrade codes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated unfreeze probe, revised after validation. The full unfreeze
failed: the Homebrew cask
reports 26.001.21771 (tracking Adobe's updater manifest), but Adobe's
version-less web installer
DMG still delivers 26.001.21691, so the validator's post-install osquery
check failed at
26.001.21771 — the same installer-lags-manifest behavior that caused the
original freeze.
This PR instead pins the output manifest to 26.001.21691 (the version
the DMG actually installs,
confirmed by the 2026-08-01 validator run) and keeps `"frozen": true` so
the nightly ingester
doesn't bump it back to the cask version.
Frozen since: 2025-12-02 (#36609 — "product updated but installer was
not, causing validation issues")
Version: 26.001.21662 -> 26.001.21691 (cask claims 26.001.21771;
installer not updated yet)
Note: the regenerated manifest also picks up a newer
`uninstall_script_ref`, because the frozen
output missed the script-template updates that landed on main while it
was pinned.
Draft until validation reports. Merge only if the FMA checks are green
and the validate shard
actually ran for this slug.
**Related issue:** NA
# Checklist for submitter
- [x] QA'd all new/changed functionality manually — pending CI
validation, see above.
---
_Generated by [Claude
Code](https://claude.ai/code/session_01EBxhs5D65LRUwCEJejBLJH)_
---------
Co-authored-by: allenhouchins <allen@fleetdm.com>
Automated unfreeze probe. Removes `"frozen": true` and regenerates the
output manifest so
`test-fma-darwin-pr-only` can validate `logi-options+/darwin` at its
current upstream version.
Frozen since: 2026-04-03 (#42984, automated FMA update run)
Version: 2.4.903778 -> 2.5.926888
Note: the regenerated manifest also picks up a newer
`uninstall_script_ref`, because the frozen
output missed the script-template updates that landed on main while it
was pinned.
Draft until validation reports. Merge only if the FMA checks are green
and the validate shard
actually ran for this slug.
**Related issue:** NA
# Checklist for submitter
- [x] QA'd all new/changed functionality manually — pending CI
validation, see above.
---
_Generated by [Claude
Code](https://claude.ai/code/session_01EBxhs5D65LRUwCEJejBLJH)_
Co-authored-by: allenhouchins <allen@fleetdm.com>
Automated unfreeze probe. Removes `"frozen": true` and regenerates the
output manifest so
`test-fma-darwin-pr-only` can validate `keeper-password-manager/darwin`
at its current upstream version.
Frozen since: 2026-02-10 (#39623, automated FMA update run)
Version: 18.2.1 -> 18.5.0
Draft until validation reports. Merge only if the FMA checks are green
and the validate shard
actually ran for this slug.
**Related issue:** NA
# Checklist for submitter
- [x] QA'd all new/changed functionality manually — pending CI
validation, see above.
---
_Generated by [Claude
Code](https://claude.ai/code/session_01EBxhs5D65LRUwCEJejBLJH)_
Co-authored-by: allenhouchins <allen@fleetdm.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Windows packages for AWS CLI, AWS SAM CLI, Brave Browser,
DataGrip, and Postman to their latest versions.
* Updated macOS packages for Fellow, Microsoft Edge, Postman, and
Typora.
* Refreshed installer links, version checks, and checksums to support
reliable downloads and verification.
* Updated versions include AWS CLI 2.36.14, AWS SAM CLI 1.165.0, Brave
151.1.93.129, DataGrip 2026.2.2, Fellow 5.7.2, Edge 151.0.4129.59,
Postman 12.21.10, and Typora 1.14.8.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45728
Changes:
- Adds a new redis key to keep track of downloaded packages. It starts
out with an empty list and gets filled with each download. Each update
writes the entire struct at once to the key.
- Adds logging in the fleetctl gitops client to show which packages were
downloaded
- Fixes the categories key potentially expiring
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- ❌ Timeouts are implemented and retries are limited to avoid infinite
loops
- Right now the batch will write the whole slice of all packages to a
single redis key for every package in the loop. Looks like performance
is acceptable for now (500 packages), but maybe this will need to be
limited.
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## New Features
- Added per-package software download progress in fleetctl GitOps.
- Progress now reports downloading, completed, skipped, and failed
packages during real and dry runs.
- Installation output now distinguishes applying and applied stages.
## Bug Fixes
- Improved download error messages and cached-package handling.
- Prevented duplicate progress messages and ensured tracking issues do
not interrupt successful software batches.
## Tests
- Expanded coverage for progress reporting, failures, dry runs, package
types, and authorization scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#50324
Adds Lenovo System Update as a Windows Fleet-maintained app, from winget
`Lenovo.SystemUpdate` (5.08.03.59, Inno Setup, machine scope, x86-only).
Found in a customer's ManageEngine ServiceDesk Plus Windows deployment
catalog with no Fleet equivalent. Distinct from
`lenovo-dock-manager/windows`, which we already ship.
## Verification
- Installer SHA confirmed against a local download of
`system_update_5.08.03.59.exe` (`e66794dc…53e0d`), served from
`download.lenovo.com` — a pinned vendor URL, so none of the SourceForge
mirror trouble from #50322 applies.
- Registry `DisplayName` determined offline as a bare `Lenovo System
Update`: `innoextract --info` reports `AppVerName` when set and falls
back to `AppName`, and Inno writes that same value to `DisplayName`.
This installer reports no version suffix, unlike CrystalDiskMark in
#50322 which reports `"CrystalDiskMark 9.0.3"`. That is why the exists
query here is an exact match rather than a prefix.
- Icon extracted from the installer's own `Tvsukernel.exe` resource, not
sourced from the web.
- The uninstall script targets the Inno registry key directly via the
manifest's `ProductCode` (`TVSU_is1` — a key name, not a GUID) using the
`$PACKAGE_ID` substitution, rather than string-matching `DisplayName`.
## Two things reviewers should weigh in on
**1. The exists query deliberately omits the publisher.** House style
usually pins `publisher = '...'`, but the registry `Publisher` is not
determinable offline for Inno, and the validator's log prints only the
name and version — so I could not confirm it. A wrong publisher makes
the exists query silently never match while the validator still passes,
which is the exact failure mode called out in the FMA docs. `name =
'Lenovo System Update'` is unambiguous on its own. Happy to add the
publisher clause if someone can confirm the registry value on a real
Lenovo host.
**2. This may not be validatable on the CI runner.** Lenovo System
Update is a vendor tool for Lenovo hardware, and the runner is a generic
Azure VM. If the installer refuses to run on non-Lenovo hardware this
will fail the way Dell Display and Peripheral Manager did in #50020
(which was dropped for exactly this reason, and is being retried on a
client-OS runner in #50313). Leaving this in draft until the validator
reports.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Lenovo System Update to the maintained Windows software catalog.
* Added support for silent installation and uninstallation, including
status verification and reboot-success handling.
* Added Lenovo System Update metadata, download information,
categorization, and application icon.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Updated the contact source used for contacts created by the
deliver-webinar-access-request action (Webinar » Website - Gated video)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Webinar access requests are now categorized as “Website - Gated video”
in Salesforce.
- Updated contact and account records use the new source label
consistently.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the software management page to link to Fleet’s software
catalog.
* Clarified that the catalog includes 1,000+ apps.
* Noted automatic updates across macOS, Windows, and additional
platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#44088.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Linux as a label platform option.
* Linux labels now apply across supported distributions, including
Ubuntu, Debian, RHEL, CentOS, and generic Linux hosts.
* Updated platform names for improved clarity and consistency.
* **Bug Fixes**
* Improved platform matching so Linux labels apply consistently to
compatible hosts.
* Removed the obsolete Zorin platform option.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43544
This blueprint has drifted from the deployed `fleet-mcp` service in two
ways. `FLEET_LIVE_QUERY_REST_PERIOD=25s` is too short for a hosted
service aimed at a whole fleet: enough targeted hosts are asleep or
offline that `run_live_query` returns a near-empty result before they
check in, reading as "no data" rather than "still waiting." And `plan:
starter` disagrees with the Standard instance the service actually runs
on, so a blueprint sync risked silently downgrading it. Both fields
carry literal values, making them blueprint-managed, so a dashboard
override would be reverted on the next sync.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Configuration**
* Updated the hosted Fleet deployment to use the standard plan.
* Increased the live-query interval to 15 minutes.
* Clarified configuration guidance for Fleet server alignment and hosted
Fleet behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds press logos below "The road to AI in IT" report card.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a press coverage section to the AI in IT page.
* Displays logos for Apple World Today, Cybersecurity Insiders, and IT
Brief, linking to related articles.
* Added responsive layouts for desktop, tablet, and mobile screens.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
## Summary
- Adds a **Target hosts with labels** section to the Configuration
profiles guide (`articles/custom-os-settings.md`).
- Documents the three targeting modes (**Include all**, **Include any**,
**Exclude any**), that only one can be used per profile, and that
profiles are inherently platform-scoped (no label needed to keep a
profile on the right platform).
- Shows the flow across Fleet UI, GitOps (`labels_include_all` /
`labels_include_any` / `labels_exclude_any`, with a YAML example), and
the Fleet API.
- Bumps `publishedOn` to the current date. Author unchanged.
## Why
Prospects and customers hit this gap when trying to scope a profile to a
subset of hosts: the label include/exclude syntax lived only in the YAML
and REST API reference docs, with no walkthrough in the guide.
## Test plan
- [ ] Article renders correctly on the fleetdm.com preview
- [ ] All links resolve
- [ ] Meta tags present with updated `publishedOn` date
- [ ] Style guide compliance verified
Update the Manage Users API key display label from "API Key" to "API
key" for consistent capitalization in the UI.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated the API key label wording for consistency in the admin user
page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected the capitalization of the “Android Enterprise ID” tooltip
label in Android MDM settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes: https://github.com/fleetdm/fleet/actions/runs/30610975232
New run: https://github.com/fleetdm/fleet/actions/runs/30632404621.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security**
* Added vulnerability assessments for five CVEs affecting a transitive
XML-parsing dependency.
* Recorded that the application is not affected because vulnerable XML
processing cannot be controlled by an attacker.
* Updated security transparency records with supporting applicability
justifications.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **AOMEI Backupper Standard** as a Windows Fleet-maintained app. One
of the 11 apps split out of #48501 that failed the FMA validator; #50016
shipped the 6 that passed.
## Why it was failing
Install and detection were already fine on the SYSTEM-context Windows
runner — the validator installed it and osquery found `AOMEI Backupper`
8.4.0. **Uninstall** was the failure:
```
ERROR msg="Error uninstalling app: exit status 1" app="AOMEI Backupper Standard"
ERROR msg="Output: Uninstaller for 'AOMEI Backupper Standard' not found."
```
AOMEI unified the ARP `DisplayName` across editions around v7.4 — the
registry entry reads `AOMEI Backupper`, with no `Standard` suffix. The
uninstall script searched for the catalog name and matched nothing.
`unique_identifier` was already corrected to `AOMEI Backupper`; this
fixes the uninstall script to match.
## Notes
- **Edition matching.** `AOMEI Backupper` also matches the paid
Pro/Workstation/Server editions — AOMEI shares the DisplayName across
editions and no registry value distinguishes them. Detecting the free
edition specifically isn't possible from inventory.
- **Non-pinned installer URL.**
`https://www2.aomeisoftware.com/download/adb/AOMEIBackupperStd.exe` is a
"latest" URL, so the pinned SHA will drift when AOMEI ships a new build
until the FMA auto-update bumps it.
- x86-only installer, so it lands in `C:\Program Files (x86)`. The
validator's "no changes detected in `C:\Program Files`" line is an
expected warning, not a failure.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30383902487](https://github.com/fleetdm/fleet/actions/runs/30383902487)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries reviewed for name + publisher
correctness, `apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added **AOMEI Backupper Standard** (version **8.4.0.0.0**) to the
Windows software catalog, including verified installer download
(SHA-256).
- Introduced dedicated silent **install** and **uninstall** support,
with version gating and idempotent uninstall behavior when the app isn’t
present.
- Added a **new software icon** and updated the listing so the correct
icon now appears for this product.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **Gpg4win** as a Windows Fleet-maintained app. One of the 11 apps
split out of #48501 that failed the FMA validator; #50016 shipped the 6
that passed.
## Why it was failing
Same root cause as GNU Privacy Guard (#50025) — Gpg4win bundles GnuPG.
The install worked; the *script* never returned:
```
20:30:53 INFO msg="Executing install script..." app=Gpg4win
20:40:53 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later
20:40:53 INFO msg="New application detected at: C:\Program Files\Gpg4win"
```
Ten minutes on the nose is the validator's `executeScript` timeout.
**`Start-Process -Wait` waits for the process *and all of its
descendants***, and Gpg4win leaves `gpg-agent`, `dirmngr`, `keyboxd` and
`scdaemon` resident (plus Kleopatra), so `-Wait` never returns. The same
run left `gpg4win-5.0.2.exe` locked in the validator's temp dir,
confirming a live child process.
The install script now follows the pattern already established by
[`ollama_install.ps1`](ee/maintained-apps/inputs/winget/scripts/ollama_install.ps1):
start with `-PassThru` (no `-Wait`), wait on the installer process alone
with a 7-minute cap (below the caller's 10-minute script budget), poll
for the Add/Remove Programs entry, then stop the leftovers.
The uninstall script stops those processes up front (they hold file
locks that make the uninstall fail), uses NSIS's `_?=<dir>` switch so
the uninstaller runs in place rather than relaunching itself detached
from `%TEMP%`, and polls the ARP key to confirm removal.
## Notes
- **Versioned ARP name.** The registry `DisplayName` is `Gpg4win
(5.0.2)`, so the input uses `fuzzy_match_name` and the exists query is
`name LIKE 'Gpg4win %'`. The uninstall script matches the same prefix.
- x86-only installer. Publisher `The Gpg4win Project`.
- Ships a new catalog icon and website asset.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30384125610](https://github.com/fleetdm/fleet/actions/runs/30384125610)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries reviewed for name + publisher
correctness, `apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added Gpg4win as a supported Windows application.
- Added Gpg4win version 5.0.2 with Security categorization.
- Added a Gpg4win icon to the software interface.
- Introduced silent install and uninstall support with process cleanup,
timeouts, and registry-based verification to confirm install/removal
outcomes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#50285
## Summary
- Restore the `All Hosts` and Apple platform built-in label memberships
in the same transaction that clears stale host state during Automated
Device Enrollment (ADE).
- Backfill missing built-in memberships for existing macOS, iOS, and
iPadOS hosts.
- Add regression coverage confirming that an iPadOS update declaration
remains targeted and reaches verified status after the enrollment reset.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one host's records do not affect another)
- [ ] QA'd all new/changed functionality manually
Automated verification:
```sh
MYSQL_TEST=1 go test -run 'TestMDMApple/MDMAppleResetOnReenrollment' ./server/datastore/mysql
MYSQL_TEST=1 go test -run TestUp_20260731100711 ./server/datastore/mysql/migrations/tables
MYSQL_TEST=1 go test -run 'TestIntegrationsMDM/TestIPadOSUpdateDeclarationAfterMDMReset' ./server/service
go test -run TestMDMTokenUpdateResetOnReenrollment ./server/service
go vet ./server/datastore/mysql ./server/service
go build ./server/datastore/mysql/migrations/...
make test-schema
```
## Database migrations
- [x] Checked schema for all modified tables for columns that
auto-update timestamps during migration.
- [x] Confirmed that timestamp behavior is acceptable and will not cause
unwanted side effects. The migration inserts only missing memberships
and leaves existing membership timestamps unchanged.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Apple devices now retain their built-in label memberships after
Automated Device Enrollment or MDM reset.
* Label-scoped profiles, software, and operating system updates can now
continue to be delivered after a reset.
* Platform-specific memberships are restored for macOS, iOS, and iPadOS
devices, including applicable hosts with unspecified platforms.
* iPadOS update declarations now reconcile successfully after an MDM
reset.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
It's not used by CI or tests. Probably a leftover from when we tested
some Prometheus integration manually.
While I was at it fixed some typos on the `writing.md` file.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed the Prometheus monitoring service from the local development
environment.
* Removed the associated metrics scraping configuration for the
application.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Restricted fleet deletion to users with global write permissions,
including global administrators and GitOps.
* Corrected team deletion authorization to require global write access.
* Prevented global technicians, team technicians, and observer-level
users from deleting teams.
* Updated authorization behavior to consistently enforce the required
access level.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Manually QA'd the change (handbook-only: previewed the Markdown
rendering)
## Details
Adds a "Let's get you set up" calls section to the 🚂 Go-To-Market
operations handbook page, documenting:
- Ownership: Dave Siederer (@ds0x) on the Solutions Consulting team owns
these calls. Scheduling is tied to his calendar, and he coordinates
coverage when he is unable to attend.
- Staffing: every call includes a Solutions Consultant and a Solutions
Specialist.
- Schedule: every Friday at 10 AM and 2 PM US Central time.
The section is placed after the "Solution Specialist inbound lead
follow-up" process and before "Proof of value (POV)", matching the
meeting-booking stage of the funnel. No product code changes, so no
changes file is needed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a new customer testimonial entry, including the quote, author
name and job title, profile image, LinkedIn link, and product category
tags.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#49966
Adds the schema for custom DDM activations (parent story #48222).
- **Creates `mdm_apple_ddm_activations`** — stores the activation JSON
as-is (`mediumtext`, so the generated `token` column hashes the exact
stored bytes) with a `declaration_uuid` FK to `mdm_apple_declarations`
that cascades on delete.
- **Extends `mdm_configuration_profile_variables`** with
`apple_ddm_activation_uuid` so activations can carry Fleet variables
(needed by #49970).
- **Adds `activation_updated_at`** to `host_mdm_apple_declarations` so a
changed activation regenerates the declaration's effective token,
mirroring `variables_updated_at` / `assets_updated_at`.
- **Drops `mdm_apple_declaration_activation_references`** — created with
the original DDM tables in `20240327115530_AddDDMTables.go`, never
written to by any code path, so it is empty in every deployment.
### Deviations from the SQL in #49966
The `declaration_uuid` FK is the one addition, [confirmed with
@MagnusHJensen](https://github.com/fleetdm/fleet/issues/49966): it keeps
the 1:1 lifecycle enforced by the database rather than requiring cleanup
in every delete path. `configuration_identifier` is kept alongside it
for validation and DDM serving. Its unique key doubles as the FK's
backing index.
The rest are corrections needed for the specced SQL to work, all
following the precedent in `20260409153715_AddDDMVariablesSupport.go`:
- **`ck_mdm_configuration_profile_variables_exactly_one` is dropped and
re-added** to count the new column. That constraint requires exactly one
owner column to be non-null; adding a seventh without updating it means
any row setting `apple_ddm_activation_uuid` sums to 0, fails the check,
and is rejected.
- **`UNIQUE (apple_ddm_activation_uuid, fleet_variable_id)` added** to
match the six existing owner columns. That table's write path is `INSERT
... ON DUPLICATE KEY UPDATE`, which needs a unique key to collide on.
- **`activation_updated_at` is `DATETIME(6)`, not `TIMESTAMP(6)`** — its
siblings are `datetime(6)` and `EffectiveDDMToken` formats them into the
token string, so `TIMESTAMP`'s session-timezone conversion on read would
change tokens and re-push declarations to every host.
- **`team_id` gets `DEFAULT '0'`** to match `mdm_apple_declarations`,
where 0 is Unassigned.
### Note for #49970
`declaration_uuid` is `NOT NULL`, so the upload path must populate it in
addition to `configuration_identifier`. The declaration UUID prefix has
no separator (`MDMAppleDeclarationUUIDPrefix = "d"`, 1 char + 36-char
UUID = the full `varchar(37)`).
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
No changes file: this sub-task adds schema only and ships no
user-visible behavior.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
`TestUp_20260729115013` covers: the stale table is present before and
gone after; pre-existing `mdm_configuration_profile_variables` rows
survive the check constraint replacement (that `ADD CONSTRAINT`
revalidates every existing row); an activation attaches to a declaration
and gets its generated token; the 1:1 unique key and the FK both reject
bad inserts; a variable row binds to an activation (the case the old
constraint would have rejected); the constraint still rejects two-owner
and zero-owner rows; and deleting the declaration cascades to the
activation and through it to the activation's variable rows.
Also ran the full migrations suite (`MYSQL_TEST=1 go test
./server/datastore/mysql/migrations/...`) to confirm no other migration
is disturbed, and verified the regenerated `schema.sql` diff contains
only changes from this migration.
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
Neither modified table has an `ON UPDATE CURRENT_TIMESTAMP` column, so
no rows have their timestamps touched.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for Apple DDM custom activations.
* Added activation-specific tokens and timestamps to support reliable
declaration updates.
* Enabled configuration variables to be associated with a specific
activation.
* Added validation to prevent duplicate or invalid activation
associations.
* Activations and related settings are now automatically removed when
their declaration is deleted.
* **Tests**
* Added coverage for activation creation, uniqueness, validation,
associations, token generation, and cascading cleanup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves #
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
Updated stat to lead with 87% and fixed wording to match actual data
from the report.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Content Updates**
* Updated the AI in IT report statistic to state that 87% of
organizations manage devices with multiple tools.
* Clarified that 13% use a single platform.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Added a new landing page: /capex-savings
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a CapEx savings page available at `/capex-savings`.
* Added guidance on device refresh cycles, hardware performance, and
recommended replacement timing.
* Added a savings calculator for device cost, refresh cycle, and fleet
size, with estimated annual savings and assumptions.
* Added responsive layouts, imagery, calls to action, and
mobile-friendly calculator controls.
* Added supporting content on refresh recommendations, Fleet hardware
performance, and device lifecycle planning.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Brave Browser for macOS to version 151.1.93.129.
* Updated IBM Semeru JRE 8 for Windows to version 8.0.502.0.
* Updated NordPass for macOS to version 7.9.3.
* Refreshed installer information, checksums, and version detection for
the updated releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
kitzy