68c467a280f1facd66e8c8fc3b8c0cd4ea20c7c8
2563
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Luke Heath
|
cb44e287f2 | Fix high-severity CodeQL and Scorecard code scanning alerts (#50333) | ||
|
dependabot[bot]
|
25d4120857 | Bump postcss from 8.5.10 to 8.5.23 in /ee/fleetd-chrome (#49906) | ||
|
kitzyandAllen Houchins
|
7837b8ec8f |
Add AOMEI Backupper Standard as a Windows Fleet-maintained app (#50021)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #50020 # What this does Adds **AOMEI Backupper Standard** as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing Install and detection were already fine on the SYSTEM-context Windows runner — the validator installed it and osquery found `AOMEI Backupper` 8.4.0. **Uninstall** was the failure: ``` ERROR msg="Error uninstalling app: exit status 1" app="AOMEI Backupper Standard" ERROR msg="Output: Uninstaller for 'AOMEI Backupper Standard' not found." ``` AOMEI unified the ARP `DisplayName` across editions around v7.4 — the registry entry reads `AOMEI Backupper`, with no `Standard` suffix. The uninstall script searched for the catalog name and matched nothing. `unique_identifier` was already corrected to `AOMEI Backupper`; this fixes the uninstall script to match. ## Notes - **Edition matching.** `AOMEI Backupper` also matches the paid Pro/Workstation/Server editions — AOMEI shares the DisplayName across editions and no registry value distinguishes them. Detecting the free edition specifically isn't possible from inventory. - **Non-pinned installer URL.** `https://www2.aomeisoftware.com/download/adb/AOMEIBackupperStd.exe` is a "latest" URL, so the pinned SHA will drift when AOMEI ships a new build until the FMA auto-update bumps it. - x86-only installer, so it lands in `C:\Program Files (x86)`. The validator's "no changes detected in `C:\Program Files`" line is an expected warning, not a failure. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) **passes** on the SYSTEM-context Windows runner — [run 30383902487](https://github.com/fleetdm/fleet/actions/runs/30383902487) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added **AOMEI Backupper Standard** (version **8.4.0.0.0**) to the Windows software catalog, including verified installer download (SHA-256). - Introduced dedicated silent **install** and **uninstall** support, with version gating and idempotent uninstall behavior when the app isn’t present. - Added a **new software icon** and updated the listing so the correct icon now appears for this product. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
kitzy
|
43bff98998 |
Add Gpg4win as a Windows FMA (#50026)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #50020 # What this does Adds **Gpg4win** as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing Same root cause as GNU Privacy Guard (#50025) — Gpg4win bundles GnuPG. The install worked; the *script* never returned: ``` 20:30:53 INFO msg="Executing install script..." app=Gpg4win 20:40:53 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later 20:40:53 INFO msg="New application detected at: C:\Program Files\Gpg4win" ``` Ten minutes on the nose is the validator's `executeScript` timeout. **`Start-Process -Wait` waits for the process *and all of its descendants***, and Gpg4win leaves `gpg-agent`, `dirmngr`, `keyboxd` and `scdaemon` resident (plus Kleopatra), so `-Wait` never returns. The same run left `gpg4win-5.0.2.exe` locked in the validator's temp dir, confirming a live child process. The install script now follows the pattern already established by [`ollama_install.ps1`](ee/maintained-apps/inputs/winget/scripts/ollama_install.ps1): start with `-PassThru` (no `-Wait`), wait on the installer process alone with a 7-minute cap (below the caller's 10-minute script budget), poll for the Add/Remove Programs entry, then stop the leftovers. The uninstall script stops those processes up front (they hold file locks that make the uninstall fail), uses NSIS's `_?=<dir>` switch so the uninstaller runs in place rather than relaunching itself detached from `%TEMP%`, and polls the ARP key to confirm removal. ## Notes - **Versioned ARP name.** The registry `DisplayName` is `Gpg4win (5.0.2)`, so the input uses `fuzzy_match_name` and the exists query is `name LIKE 'Gpg4win %'`. The uninstall script matches the same prefix. - x86-only installer. Publisher `The Gpg4win Project`. - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) **passes** on the SYSTEM-context Windows runner — [run 30384125610](https://github.com/fleetdm/fleet/actions/runs/30384125610) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added Gpg4win as a supported Windows application. - Added Gpg4win version 5.0.2 with Security categorization. - Added a Gpg4win icon to the software interface. - Introduced silent install and uninstall support with process cleanup, timeouts, and registry-based verification to confirm install/removal outcomes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
5c54c33c41 |
Update Fleet-maintained apps (#50299)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Updated Windows packages: 3DF Zephyr Free, Android Studio, AWS CLI, Calibre, ImageGlass, NordVPN, OBS Studio, OneDrive, and Postman. * Updated macOS packages: BusyContacts, Calibre, Clop, Postman, Shapr3D, Typora, Unity Hub, and Wispr Flow. * Refreshed release versions, download sources, update detection, and integrity verification for the listed applications. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Nico
|
7f1b330c90 |
Restrict deleting a fleet to global admins (#50271)
# Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Restricted fleet deletion to users with global write permissions, including global administrators and GitOps. * Corrected team deletion authorization to require global write access. * Prevented global technicians, team technicians, and observer-level users from deleting teams. * Updated authorization behavior to consistently enforce the required access level. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
3e884177ab |
Update Fleet-maintained apps (#50279)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Updated Brave Browser for macOS to version 151.1.93.129. * Updated IBM Semeru JRE 8 for Windows to version 8.0.502.0. * Updated NordPass for macOS to version 7.9.3. * Refreshed installer information, checksums, and version detection for the updated releases. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
fleet-releaseandallenhouchins
|
e71aa713b3 |
Update Fleet-maintained apps (#50278)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Updates** - Refreshed Windows packages for 1Password, Claude, Cursor, GitKraken, Node.js, OBS Studio, VirtualBox, and IBM Semeru JDK/JRE releases. - Refreshed macOS packages for Arc, Beeper, BrickLink Studio, ChatGPT, Firefox Nightly, Kiro CLI, Melodics, Azure Storage Explorer, Nextcloud Talk, Spokenly, and Warp. - Updated installer metadata, version detection, download sources, and integrity checks to support the latest releases. - Updated uninstall handling where required for 1Password and Node.js. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
|
0177c98f9a |
Regenerate macOS FMA install scripts (#50264)
Automated ingestion of latest Fleet-maintained app data. --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
Carlo
|
3660b546f2 |
Fix FMA auto-update keeping the stale install script (#50200)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #50097 ## Summary FMA auto-update preserves an admin-customized install script by comparing the active script against the new manifest's, but FMA scripts hardcode the versioned installer filename, so a routine version bump looked like an edit and the old script (old filename) was kept against the newly downloaded installer, and the install failed. The fix neutralizes the installer filename in both scripts before comparing (mirroring the existing uninstall `$PACKAGE_ID` handling), so a filename-only difference adopts the new script while a genuine edit is still preserved. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/` (`changes/50097-fma-auto-update-keeps-stale-install-script`). ## Testing - [x] Added/updated automated tests (adopt-on-version-bump regression + preserve-genuine-edit counterpart). - [x] QA'd all new/changed functionality manually. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed Fleet-maintained app auto-updates that could keep an outdated install script after downloading a newer version, causing install failures. * Improved install-script change detection by ignoring version-only installer filename differences. * Continued to preserve administrator-customized install scripts when updates change more than just the installer filename. * **Tests** * Added and expanded coverage for installer-script normalization and auto-update install-script selection behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
CarloandAllen Houchins
|
0594f653dd |
Propagate errors in macOS FMA install scripts (#50198)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #50056 ## Summary macOS FMA install scripts never checked the exit code of the install command (`installer -pkg` / `cp -R`) — the script's last statement is always `relaunch_application`, which exits 0 — so a failed install exited 0 and Fleet reported it installed. **Generated scripts.** The generator now propagates failure: both `installer -pkg` variants end with `|| exit $?`, and the `cp -R` path exits non-zero on a failed copy, removes the partial copy (so a failed fresh install isn't inventoried as the new version), and restores the app it moved aside. Regenerated `outputs/` for non-frozen generated apps are produced by the `ingest-maintained-apps` job, so they aren't committed here. **Custom scripts.** 9 of the 18 custom input scripts had the same bug and are fixed with the same pattern: Google Chrome, Zoom, Microsoft Edge, GitHub Desktop, Webex, Cycling '74 Max, Pd, Grammarly Desktop, and P4V. The DMG-based ones also now fail before removing/moving the existing app when the mount or staging copy fails, so a bad download can't leave a host with nothing. Their `outputs/*/darwin.json` are updated in the same commit (script content + recomputed 8-char sha256 ref, versions untouched), following the precedent of #49033. Docker Desktop (`set -euo pipefail`), 1Password/Slack/LogiTune (installer is the last statement), and the rest already propagated errors. **Frozen apps.** The ingest job never rewrites frozen outputs, so the 10 frozen apps with generated scripts (adobe-acrobat-pro, comet, evernote, firealpaca, keeper-password-manager, nvidia-geforce-now, pritunl, vnc-viewer, wins, worksheet-crafter) had the fix applied directly to their published `darwin.json` scripts — the exact text the current generator would emit, with pinned versions/URLs/hashes untouched. The 11th frozen app (logi-options+) uses a custom script that was already correct and in sync. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/` (`changes/50056-fma-install-scripts-ignore-errors`). - [x] Untrusted data interpolated into shell scripts is validated against shell metacharacters. (No new untrusted interpolation: the guard reuses the same curated cask-derived name the adjacent lines already interpolate.) ## Testing - [x] Added/updated automated tests (three generator tests: pkg, pkg-with-choices, cp-R restore — the last now pins the exact emitted block). - [x] All 19 updated output manifests validated: embedded scripts pass `bash -n`, refs match `sha256(script)[:8]`, refs map stays key-sorted like Go's encoder. - [x] QA'd all new/changed functionality manually. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * macOS Fleet-maintained app installations now fail fast when installers, DMG extraction/mounting, or app copy steps error. * If an upgrade fails, the system removes any partial app and restores the previously installed version when available. * Improved robustness during app staging/copying, including safer handling of paths with spaces or special characters. * **Tests** * Added unit coverage to verify installer failure propagation and rollback behavior. * **Documentation** * Clarified that the install-script error handling applies to both generated and custom scripts, including already-published frozen apps. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
|
e383c42da6 |
Update Fleet-maintained apps (#50230)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated Proton Drive for Windows to version 3.0.4. * Refreshed the installer download reference and checksum verification. * Improved uninstall behavior by adding a pre-uninstall stop for running Proton Drive processes and introducing a timeout-based “watchdog” to prevent the uninstaller from hanging. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
Carlo
|
a442d7af3a |
Python script-only packages: follow-on QA fixes (#50143)
**Related issues:** Resolves #50068, Resolves #50106, Resolves #50107, Resolves #50108, Resolves #50110, Resolves #50114 Follow-on fixes from QA of #41470 (Python script-only packages): - Software-installer validation errors are action-neutral, so the Add and Edit flows each show the correct single verb, and the unsupported-file error names a content/format mismatch instead of blaming the extension (#50068, #50107). - `.py` packages accept `setup_experience_platform` (`darwin`/`linux`), matching `.sh` (#50106). - A failed-to-run install script (exit code `-1`) now renders a diagnostic instead of empty output, and orbit surfaces the underlying execve error (#50108). - The install-rejection message for `.sh`/`.py` packages says "macOS and Linux hosts" instead of "linux" (#50110). - Orbit writes each script's temp file with an extension matching its shebang (`.py`/`.sh`/`.ps1`), so tracebacks reference the right file type (#50114). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes. - [x] Verified compatibility with the latest released version of Fleet (orbit-only change; the server↔agent `SoftwareInstallDetails` contract is unchanged). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved installer validation and rejection messaging for unsupported/invalid package contents (including correcting “add” vs “edit” wording and avoiding duplicated phrasing). * Added clearer diagnostics when install scripts fail to start (including empty output cases). * Corrected handling of script-only packages so Python scripts use the proper script type/extension, reducing misleading tracebacks. * Updated platform availability messaging so `.sh`/`.py` packages display macOS+Linux support. * **New Features** * Python script-only packages can now specify macOS and Linux setup experience platforms. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
d2946b7bd3 |
Update Fleet-maintained apps (#50229)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Updated Evernote for Windows to version 11.27.5. * Updated Granola for Windows to version 7.452.1. * Updated Postman for Windows to version 12.21.7. * Updated Trezor Suite for macOS to version 26.7.3. * Refreshed installer links and verification checksums for each release. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
fleet-releaseandallenhouchins
|
5a45d781b7 |
Update Fleet-maintained apps (#50216)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added availability for the latest releases of numerous maintained applications across Windows and macOS. * Updated applications include Chrome, Firefox Nightly, Postman, Signal, Notion, Podman Desktop, Draw.io, CMake, JDK/JRE, and many others. * **Bug Fixes** * Refreshed installer links, version detection, and package verification data to ensure updates install and validate correctly. * Updated app-specific installation handling where required for newer releases. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Allen Houchins
|
344e5aa5a2 |
Remove Dynalist macOS Fleet-maintained app (cask deleted from homebrew-cask) (#50215)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA — fixing a failing scheduled "Update Fleet-maintained apps" run. Removes the **macOS** Dynalist Fleet-maintained app. The Windows (winget) FMA is unaffected and stays. ## Why The `dynalist` cask was deleted from homebrew-cask on 2026-07-30 ([commit `adac21ffc4`](https://github.com/Homebrew/homebrew-cask/commit/adac21ffc401)), completing Homebrew's full deprecation lifecycle: - `deprecate!` 2024-07-29, `because: :unmaintained` - `disable!` 2025-07-29 - cask file removed 2026-07-30 `https://formulae.brew.sh/api/cask/dynalist.json` now returns 404, so the scheduled ingester panics: ``` {"level":"INFO","msg":"ingesting homebrew app","name":"Dynalist"} panic: ingesting homebrew app: app not found in brew API ``` Marking the app `"frozen": true` does **not** fix this — the ingester fetches the cask JSON before the frozen flag is consulted (`cmd/maintained-apps/main.go`), so removal is the only fix for a dead upstream cask. ## What changed Deletions only (39 lines, no additions): - `ee/maintained-apps/inputs/homebrew/dynalist.json` — deleted - `ee/maintained-apps/outputs/dynalist/darwin.json` — deleted - the `dynalist/darwin` entry in `ee/maintained-apps/outputs/apps.json` — removed; `dynalist/windows` remains ## Deliberately kept Because the Windows FMA still needs them: - `ee/maintained-apps/outputs/dynalist/windows.json`, `ee/maintained-apps/inputs/winget/dynalist.json`, and its install/uninstall scripts - `frontend/pages/SoftwarePage/components/icons/Dynalist.tsx` and its `dynalist:` mapping in `icons/index.ts` — the map is keyed by lowercased app name and is shared across platforms - `website/assets/images/app-icon-dynalist-60x60@2x.png` — keyed by slug token, still serving the Windows entry in the app library ## Note for reviewers Hosts that currently have the macOS Dynalist FMA installed will lose the maintained-app entry on the next sync. This matches the behavior of prior FMA removals (Nocturnal #50050, Dell Display Manager #47420, Messenger #46541). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. Not applicable — consistent with prior FMA removal PRs, which do not add a changes file. ## Testing - [x] QA'd all new/changed functionality manually Verified that `ee/maintained-apps/outputs/apps.json` still parses as valid JSON (1381 apps) and that `Dynalist` now resolves to only `dynalist/windows`. Confirmed the 404 against the brew API and read the pre-removal cask at `adac21ffc4~1` to establish the deprecation reason. `git diff` confirms the change is deletions-only. |
||
|
|
c83ecc2231 |
Match Windows software with version in name to FMA software title
Resolves #44406 Windows programs report a version in their name (e.g. `Granola 7.373.2`), so each version created its own `software_title` and never linked to the Fleet-maintained app installer's title (`Granola`), hiding the uninstall action. macOS handles this via `bundle_identifier`; Windows had no join key. - Give matching Windows programs the canonical FMA name at ingestion (name-prefix match), so all versions collapse onto the title the installer owns. `software.name` is unchanged. - Merge already-mismatched versioned titles onto the canonical title in `ReconcileMaintainedAppSoftwareNames` (runs on FMA sync; no migration needed). --------- Co-authored-by: Tim Lee <timlee@fleetdm.com> Co-authored-by: Juan Fernandez <juan@fleetdm.com> |
||
|
fleet-releaseandallenhouchins
|
d052e980b7 |
Update Fleet-maintained apps (#50199)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Updated AWS CLI for Windows to version 2.36.11. * Updated Windsurf for macOS to version 3.6.22. * Updated Gitify for macOS to version 7.2.0. * Updated GoLand for Windows to the 2026.2 release. * Updated Linear for macOS to version 1.32.0. * Updated Rancher Desktop for macOS to version 1.24.0. * Refreshed installer links and verification data for each release. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
fleet-releaseandallenhouchins
|
66b47813fe |
Update Fleet-maintained apps (#50184)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Updates** - Updated Krita for Windows to version 5.3.3.0. - Updated Loom for macOS and Windows to version 0.365.0. - Updated Vivaldi for Windows to version 8.1.4087.61. - Refreshed installer links and verification data to support reliable installation and version detection. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
fleet-releaseandallenhouchins
|
12ee3384e6 |
Update Fleet-maintained apps (#50172)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated managed Zed app installers for macOS and Windows to version 1.13.1. * Updated download links and integrity checks to match the new release. * Improved version detection so outdated installations are correctly identified. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
fleet-releaseandallenhouchins
|
f3eb7ea3e7 |
Update Fleet-maintained apps (#50167)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Updated maintained app releases for macOS and Windows, including Adlock, Another Redis Desktop Manager, BetterTouchTool, BoltAI, CodexBar, Egnyte, Firefox Developer Edition, Mimestream, Superwhisper, and TeamViewer. * Updated installation downloads and version detection for each new release. * Refreshed package integrity checks to support the latest installers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
fleet-releaseandallenhouchins
|
c25f37abd6 |
Update Fleet-maintained apps (#50156)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Updated maintained app releases for Gitify, JetBrains Toolbox, Microsoft 365 Copilot, Spokenly, Tower, and Vivaldi. * Refreshed installer links and verification checksums for the latest versions across macOS and Windows. * **Bug Fixes** * Updated Pastebot’s macOS uninstall process to remove the app and related user files while avoiding removal of additional system paths. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
|
ddf3e96fa9 |
Update Fleet-maintained apps (#50150)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Versions** * Updated release metadata and installer details for AnyBurn, BetterDisplay, Blender, ChatGPT, ChatWise, CLion, DataGrip, Dataspell, Draw.io Desktop, Elgato Camera Hub, Firefox, Firefox Nightly, GIMP, GoLand, IntelliJ IDEA (and variants), Keka, Kitty, LibreOffice, MacPacker, MuseScore, Nudge, OBS, PhpStorm, PyCharm (CE), Rider, RubyMine, RustRover, Spyder, Typinator, Visual Studio Code, VLC, WebStorm, Wispr Flow, XLD, and others. * Refreshed app version detection and package checksums accordingly. * **Bug Fixes** * Improved uninstall reliability on macOS and Windows by removing unintended extra cleanup actions while keeping application and user-data removal. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
fleet-releaseandallenhouchins
|
f67d9a5b3c |
Update Fleet-maintained apps (#50138)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for the latest versions of AnyBurn, BetterZip, Canva, Eclipse Temurin, ExifCleaner, Gemini, LibreOffice, NordVPN, Postman, TablePlus, Tailscale, and other maintained applications across Windows and macOS. * **Bug Fixes** * Improved macOS uninstall cleanup for numerous applications by removing additional caches, preferences, recent-document entries, containers, support files, and related data. * Updated installer downloads and verification checks to match the latest releases. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Jonathan Katz
|
1a0f0101cc |
Fix gitops not updating FMA installer (#50000)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49811 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed Fleet-maintained app updates when a rebuilt installer keeps the same version. * Rebuilt installers now update their files, hashes, filenames, and install scripts correctly. * Prevented installers from being incorrectly skipped when their contents differ despite matching versions. * **Tests** * Added coverage for same-version installer rebuilds and team-specific caching behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel RodriguezandCopilot Autofix powered by AI
|
9c2ef14947 |
Scrub device policy responses in Fleet Desktop (#50094)
- [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security Improvements** * Updated device-authenticated policy and host-detail responses to omit policy author identity fields and any raw SQL/query data. * Device policy endpoints now return a device-safe policy representation consistently. * **Bug Fixes** * Prevented administrative policy information from appearing in device-authenticated host details and policy listings. * **Tests** * Strengthened integration coverage to verify device-safe responses (required user-facing fields present; sensitive fields absent). <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Nico
|
f5ca4b5b0d |
Add Android support for custom host vitals (#49696)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49421 Custom host vitals (`$FLEET_HOST_VITAL_<id>`) already worked in scripts and Apple/Windows configuration profiles, but Android configuration profiles and managed app configuration explicitly rejected them at upload to keep parity with `$FLEET_SECRET_*`. This left admins unable to inject per-host vitals (e.g. an asset tag) into Android MDM configuration the same way they can for every other platform. For more context, prior PRs: - https://github.com/fleetdm/fleet/pull/49334 - https://github.com/fleetdm/fleet/pull/49586 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually - Created an "Asset tag" host vital. - Enrolled an Android device. - Initially the test profile showed as "Failed" because no value was set for the vital. - Set a value for the vital, saw that it went from Enforcing to Verified. <img width="1446" height="510" alt="Screenshot 2026-07-24 at 8 57 46 AM" src="https://github.com/user-attachments/assets/c0e2348c-e521-48f3-85cd-6f884689b2cd" /> <img width="1520" height="936" alt="Screenshot 2026-07-24 at 8 56 56 AM" src="https://github.com/user-attachments/assets/169b9545-ec7a-429b-8f45-0e2740f61c77" /> <img width="1607" height="1136" alt="Screenshot 2026-07-24 at 8 57 30 AM" src="https://github.com/user-attachments/assets/a8213745-b224-4a36-a54d-32152a15c377" /> Also tested the rejection cases: - trying to upload a profile with an invalid custom host vital id (either a non-numeric value, a numeric but non-existent ID, and referencing a vital as a JSON key instead of a value) - deleting a vital referenced in a profile https://github.com/user-attachments/assets/e8b4acde-ddf4-41c0-b00a-5ab4945d0bc2 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Android app configurations and profiles now support custom host vital placeholders (`$FLEET_HOST_VITAL_<id>`). * Custom host vital values are expanded per device during Android delivery. * Managed Android profiles/configurations are automatically resent when a referenced vital value changes. * **Bug Fixes** * Added validation for malformed, missing, or undefined vital references during Android app association and profile/config uploads. * Prevented deletion of vitals referenced by Android profiles. * Improved error handling and delivery failure details when a device lacks a required vital value. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kitzy
|
f4d7064f9a |
Add Rtools as a Windows FMA (#50028)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #50020 # What this does Adds **Rtools** as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing The install script hit the validator's 10-minute `executeScript` cap exactly: ``` 20:41:22 INFO msg="Executing install script..." app=Rtools 20:51:22 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later 20:51:22 WARN msg="failed to remove rtools45-6768-6492.exe: ... Access is denied." ``` The locked installer in the temp dir shows a process was still alive. `Start-Process -Wait` waits for the process *and all of its descendants*, which is the same root cause as the other install-timeout apps in this batch. Rtools is also the one app in the batch where a **slow unpack** is a plausible second cause — the installer is ~460 MB and expands a full toolchain. So rather than assume, the script now waits on the installer process alone with a 480s cap (under the caller's 10-minute budget) and logs elapsed time plus Add/Remove Programs registration state on every poll. If the cap is reached: - **registered** → the install finished and only a lingering child remains, so it stops that process and succeeds; - **not registered** → the unpack genuinely didn't finish, and it fails with that stated explicitly. Either way the CI log now says which one happened instead of just timing out. ## Notes - **Identity verified against the installer**, not winget metadata. The setup stub's PE version resource reads `CompanyName: The R Foundation`, `ProductName: Rtools`. Inno derives `VersionInfoCompany` from `AppPublisher`, so the ARP publisher is `The R Foundation` — which is what the exists query uses. - **Versioned ARP name.** The registry `DisplayName` is `Rtools 4.5 (6768-6492)`, so the input uses `fuzzy_match_name` and the exists query is `name LIKE 'Rtools %'`. - Installs to `C:\rtools45`, not Program Files, so the validator's "no changes detected in `C:\Program Files`" line is an expected warning, not a failure. - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) **passes** on the SYSTEM-context Windows runner — [run 30384196159](https://github.com/fleetdm/fleet/actions/runs/30384196159) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries checked against the installer's PE version resource, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Rtools as a supported Windows application. * Added installation and uninstallation support with silent setup and silent removal. * Added Rtools version metadata, installer verification, and Developer tools categorization. * Added a dedicated Rtools icon for software listings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kitzy
|
ea3f95ccc5 |
Add Google Earth Pro as a Windows FMA (#50022)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #50020 # What this does Adds **Google Earth Pro** as a Windows Fleet-maintained app (a Windows counterpart to the existing `google-earth-pro/darwin` FMA). One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing Install and detection were already fine on the SYSTEM-context Windows runner — osquery found `Google Earth Pro` 7.3.7.1155. **Uninstall** was the failure: ``` INFO msg="Executing uninstall script for app..." app="Google Earth Pro" INFO msg="Found app: 'Google Earth Pro' at , Version: 7.3.7.1155" ERROR msg="App still present after uninstall (expected no match for version '7.3.7.1155' in programs)" ``` The EXE wraps a WiX MSI, so the ARP `UninstallString` is `MsiExec.exe /X{ProductCode}` — with **no quiet switch**. The old script ran that string verbatim, which raises a confirmation dialog in session 0 where nothing can click it, so the uninstall silently no-ops. The uninstall script now resolves the MSI product code (from the `UninstallString`, falling back to the registry key name) and runs `msiexec /x <code> /quiet /norestart` with a bounded 5-minute wait, then drains child `msiexec` processes. `3010`/`1641` are treated as success. ## Notes - **Identity verified against the real installer**, not winget metadata. The installer's embedded MSI Property table reads: `ProductName` = `Google Earth Pro`, `Manufacturer` = `Google`, `ProductVersion` = `7.3.7.1155`, `ALLUSERS` = `1`, `ProductCode` = `{E3B69BB6-FFD8-441C-933E-BB8A3136ED8F}`. No `ARPSYSTEMCOMPONENT`, so it is not a bootstrapper. That confirms `unique_identifier` = `Google Earth Pro` and the exists-query publisher `Google` (not "Google LLC"). - Installs to `C:\Program Files (x86)`, so the validator's "no changes detected in `C:\Program Files`" line is an expected warning, not a failure. - Reuses the existing `google earth pro` catalog icon — no new icon needed. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) **passes** on the SYSTEM-context Windows runner — [run 30383934805](https://github.com/fleetdm/fleet/actions/runs/30383934805) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries checked against the MSI Property table, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Google Earth Pro for Windows to the maintained app catalog. * Added maintained-apps install and uninstall support for Google Earth Pro (version 7.3.7.1155). * Included automated download integrity verification and detection logic for installed/updated versions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kitzy
|
c61632305a |
Add Logitech Unifying Software as a Windows FMA (#50024)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #50020 # What this does Adds **Logitech Unifying Software** as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing Install and detection were already fine on the SYSTEM-context Windows runner — osquery found `Logitech Unifying Software 2.52` at `C:\Program Files\Common Files\LogiShrd\Unifying`. **Uninstall** was the failure: ``` 20:40:55 INFO msg="Executing uninstall script for app..." 20:40:57 INFO msg="Found app: 'Logitech Unifying Software 2.52' ... Version: 2.52.33" 20:40:57 ERROR msg="App still present after uninstall (expected no match for version '2.52.33' in programs)" ``` Two seconds start to finish — the uninstaller hadn't actually done anything yet. This is standard NSIS behavior: the uninstaller copies itself to `%TEMP%` and relaunches, so the process the script starts exits almost immediately while the real work happens in a detached child. The fix passes NSIS's `_?=<dir>` switch, which runs the uninstaller in place instead of relaunching, making it synchronous. It has to be the last argument and unquoted, so the script builds a single argument string rather than an array (PowerShell would quote an element containing spaces). A bounded poll on the ARP key follows as a backstop, and the script fails explicitly if the entry is still there. ## Notes - **Versioned ARP name.** The registry `DisplayName` is `Logitech Unifying Software 2.52`, so the input uses `fuzzy_match_name` and the exists query is `name LIKE 'Logitech Unifying Software %'`. The uninstall script matches the same prefix rather than an exact string. - Publisher `Logitech` confirmed against the winget locale manifest. - Installs under `C:\Program Files\Common Files`, so the validator's "no changes detected in `C:\Program Files`" line is an expected warning, not a failure. - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) **passes** on the SYSTEM-context Windows runner — [run 30384010810](https://github.com/fleetdm/fleet/actions/runs/30384010810) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Logitech Unifying Software to the Windows software catalog, including the version 2.52.33 download, checksum, and install-detection metadata. * Implemented silent installation and a robust, registry-aware uninstall flow (with process lock handling and timeout behavior). * Added a dedicated Logitech Unifying Software icon to the software page UI. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kitzy
|
cfbb5a59fa |
Add GNU Privacy Guard as a Windows FMA (#50025)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #50020 # What this does Adds **GNU Privacy Guard** as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing The install itself worked — the validator logged `New application detected at: C:\Program Files\GnuPG`. The *script* never returned: ``` 20:18:36 INFO msg="Executing install script..." app="GNU Privacy Guard" 20:28:36 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later 20:28:36 INFO msg="New application detected at: C:\Program Files\GnuPG" ``` Ten minutes on the nose is the validator's `executeScript` timeout. The cause is a PowerShell detail rather than anything wrong with the installer: **`Start-Process -Wait` waits for the process *and all of its descendants***. GnuPG's installer starts `gpg-agent`, `dirmngr`, `keyboxd` and `scdaemon` and leaves them resident, so `-Wait` never returns. The same run left the installer `.exe` locked in the validator's temp dir, which is the other tell that a child process was still alive. The install script now follows the pattern already established by [`ollama_install.ps1`](ee/maintained-apps/inputs/winget/scripts/ollama_install.ps1): start with `-PassThru` (no `-Wait`), wait on the installer process alone with a 7-minute cap (below the caller's 10-minute script budget), poll for the Add/Remove Programs entry so a fast-returning installer can't be mistaken for a finished one, then stop the daemons. Stopping the daemons also fixes the uninstall, which would otherwise fail on files those processes hold open. The uninstall script stops them up front, uses NSIS's `_?=<dir>` switch so the uninstaller runs in place instead of relaunching itself detached from `%TEMP%`, and polls the ARP key to confirm removal. ## Notes - Clean ARP `DisplayName` (`GNU Privacy Guard`), so exact name matching — no `fuzzy_match_name` needed. Publisher `The GnuPG Project`. - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) **passes** on the SYSTEM-context Windows runner — [run 30384069714](https://github.com/fleetdm/fleet/actions/runs/30384069714) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added GNU Privacy Guard as a supported Windows application in the maintained apps catalog. * Added install/upgrade detection and uninstall support for Windows. * Added GNU Privacy Guard to the software catalog (Security category). * Added a dedicated GNU Privacy Guard icon to the software interface for proper name-based display. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kitzy
|
2fc41c7592 |
Add Azure Data Studio as a Windows FMA (#50027)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #50020 # What this does Adds **Azure Data Studio** as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing The install itself worked — the validator logged `New application detected at: C:\Program Files\Azure Data Studio`. The *script* never returned: ``` 20:08:19 INFO msg="Executing install script..." app="Azure Data Studio" 20:18:19 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later 20:18:19 INFO msg="New application detected at: C:\Program Files\Azure Data Studio" ``` Ten minutes on the nose is the validator's `executeScript` timeout. Azure Data Studio is a Visual Studio Code fork and ships the same Inno Setup script — including the **`runcode` task, which launches the app when the install finishes**. Because `Start-Process -Wait` waits for the process *and all of its descendants*, the launched app kept the script blocked forever. The fix is the switch VS Code's own FMA already uses: `/MERGETASKS=!runcode` (see [`vscode_install.ps1`](ee/maintained-apps/inputs/winget/scripts/vscode_install.ps1) and [`vscodium_install.ps1`](ee/maintained-apps/inputs/winget/scripts/vscodium_install.ps1), both of which pass validation). The script also waits on the installer process alone rather than its descendants, polls for the Add/Remove Programs entry, and stops a stray `azuredatastudio` process as a backstop in case a future build ignores the task suppression. ## Notes - Machine-scope x64 installer, per the winget manifest — Azure Data Studio publishes both user and machine scope, and Fleet installs run as SYSTEM, so machine scope is required. - Clean ARP `DisplayName` (`Azure Data Studio`), so exact name matching. Publisher `Microsoft Corporation`. - Uninstall is unchanged: the Inno uninstaller doesn't leave anything resident, and `-Wait` waiting on descendants is the desired behavior there (Inno relaunches itself from `%TEMP%`). - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) **passes** on the SYSTEM-context Windows runner — [run 30384162280](https://github.com/fleetdm/fleet/actions/runs/30384162280) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Azure Data Studio to the available Windows software catalog. * Added support for installing and uninstalling Azure Data Studio (version 1.52.0) via silent installer and uninstaller flows with completion detection. * Added an Azure Data Studio icon to the software interface for better visual identification. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
38d1f6a856 |
Update Fleet-maintained apps (#50113)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for numerous current macOS and Windows application releases, including updated installers, download links, and integrity checks. * Improved uninstall cleanup for several applications by removing additional services, launch items, recent-document entries, and application data. * **Bug Fixes** * Corrected version detection thresholds so outdated installations are accurately identified. * Updated installer and uninstaller behavior for newer application builds, including improved relaunch and cleanup handling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Allen Houchins
|
a3cdb7e14b |
Fix macOS-only copy on two Windows FMA catalog entries (#50111)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A — found while removing the macOS Yubikey Manager FMA (#50109) Two Windows Fleet-maintained apps describe themselves as macOS software in `ee/maintained-apps/outputs/apps.json`, because the entries were copy-pasted from their macOS counterparts. This copy is customer-facing: it shows in the Fleet UI's software catalog and on `fleetdm.com/software-catalog/<slug>`. - `proxyman/windows` — "Proxyman is a high-performance **macOS** app that enables developers to view HTTP/HTTPS requests and responses." → drops "macOS". (The `proxyman/darwin` description keeps it; it's accurate there.) - `wechat/windows` — name "**WeChat for Mac**" and "**WeChat for Mac** is a free messaging and calling application." → "WeChat". The winget input (`inputs/winget/wechat.json`) already declares `"name": "WeChat"`, so this also makes `apps.json` agree with its own input. The `wechat/darwin` entry keeps "WeChat for Mac", which is the actual macOS product name. Renaming the Windows entry needs a matching icon key. `getMatchedSoftwareIcon` matches on the lowercased app name and requires an exact match or a whole-word prefix (`matchLoosePrefixToKey`: `s === key || s.startsWith(key + " ")`), so the existing `"wechat for mac"` key would **not** match a name of "WeChat" and the app would fall back to the generic package icon. Added a `wechat: Wechat` key alongside it (both point at the same component; the `"wechat for mac"` key stays for macOS and for hosts reporting that name in inventory). No server-side impact: `UpsertMaintainedApp` keys on `slug` and updates `name` in place, and `ReconcileMaintainedAppSoftwareNames` only renames `darwin` titles, so the Windows rename doesn't touch existing software titles. Website icons resolve from the slug (`build-static-content.js` builds `app-icon-<slug>-60x60@2x.png`), not the name, so `app-icon-wechat-60x60@2x.png` is unaffected. Descriptions here mirror upstream cask/winget copy, so these are minimal factual corrections rather than a voice rewrite. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually: - `apps.json` still parses; 1378 apps; verified the four `proxyman`/`wechat` entries read as intended and the `darwin` ones are untouched. - Traced the icon lookup by hand: name "wechat" now hits the new exact-match key; "wechat for mac" still hits the original. - Swept every non-darwin entry in `apps.json` for macOS-only phrasing (`Rosetta`, `macOS`, `Mac`, `Apple`) — these two were the only genuine mismatches. `duo-desktop/windows` (lists macOS, Windows, and Linux) and `imazing-profile-editor/windows` (edits Apple configuration profiles) are correct as written. Note: `node_modules` isn't installed in my working copy, so ESLint/Prettier weren't run locally — the added line is a one-line map entry matching the surrounding style. CI will confirm. |
||
|
Allen Houchins
|
1e8b96e03d |
Remove Yubikey Manager as a macOS FMA (#50109)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A — fixes the failing scheduled "Update Fleet-maintained apps" workflow The `yubico-yubikey-manager` cask was removed from homebrew-cask on 2026-07-28 ([Homebrew/homebrew-cask@7ffabaa](https://github.com/Homebrew/homebrew-cask/commit/7ffabaad8fcc657dc90343844ad76a50bb60b945)) after being disabled on 2025-07-27 `because: :discontinued, replacement_cask: "yubico-authenticator"` — Yubico discontinued `yubikey-manager-qt` (the 1.2.5 installer this FMA pinned) in favor of Yubico Authenticator. The brew API now returns 404 for the token, so the maintained-apps ingester panics: ``` {"level":"INFO","msg":"ingesting homebrew app","name":"Yubikey Manager"} panic: ingesting homebrew app: app not found in brew API ``` Freezing the app in #50054 did not resolve this: `fetchCask` runs before the `frozen` flag is applied, so the ingester still fetches the cask and fails on the 404. This is the follow-up that PR called out. Removes Yubikey Manager as a **macOS** Fleet-maintained app, following the same pattern as #50050 (Nocturnal), #46541 (Messenger), and #47420 (Dell Display Manager): - `ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json` — Homebrew input - `ee/maintained-apps/outputs/yubico-yubikey-manager/darwin.json` — macOS output data - `ee/maintained-apps/outputs/apps.json` — the `yubico-yubikey-manager/darwin` entry - `website/config/routes.js` — the bare `/software-catalog/yubico-yubikey-manager` redirect pointed at `-darwin`, which would now 404; retargeted to `-windows` The **Windows** FMA is unaffected and continues to update, so these are deliberately kept: - `ee/maintained-apps/inputs/winget/yubico-yubikey-manager.json` and its install/uninstall scripts - `ee/maintained-apps/outputs/yubico-yubikey-manager/windows.json` - the `yubico-yubikey-manager/windows` entry in `apps.json` - `frontend/pages/SoftwarePage/components/icons/YubikeyManager.tsx` and its `"yubikey manager"` mapping in `index.ts` - `website/assets/images/app-icon-yubico-yubikey-manager-60x60@2x.png` Also drops "Requires Rosetta 2." from the Windows entry's description in `apps.json`. Rosetta is macOS-only; the sentence was copy-pasted from the macOS entry, and with macOS gone the Windows page is what `/software-catalog/yubico-yubikey-manager` now resolves to. Descriptions in `apps.json` are hand-maintained — `updateAppsListFile` in `cmd/maintained-apps/main.go` only appends entries whose slug it doesn't already find, so it won't overwrite the edit. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually: - `go run ./cmd/maintained-apps -slug yubico-yubikey-manager/darwin` exits 0 with no panic and writes no files (before this change, the same run panicked on the brew 404). - `apps.json` still parses and holds 1377 apps; the only remaining `yubico-yubikey-manager` entry is `/windows`. - Grepped the repo for `yubico-yubikey-manager`: remaining hits are the winget input, its two script paths, the windows `apps.json` entry, and the retargeted website redirect. No automated tests added — this is a data-file removal with no new code paths. |
||
|
Victor Lyuboslavsky
|
ffc85a42ae |
Add Windows admin account config (#49863)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48720 Subtask of https://github.com/fleetdm/fleet/issues/43488 This PR only adds the Windows config, and doesn't mess with macOS configs. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added managed local account settings for Windows to app and team configuration, including GitOps support. * Exposed an explicit enabled/disabled toggle in configuration output and Fleet controls. * Added licensing and Windows MDM prerequisites for enabling the setting. * **Bug Fixes** * Managed local account enable/disable actions are now correctly persisted and declaratively applied. * Activity feed messages now display platform-specific (macOS vs Windows) wording. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel RodriguezandAllen Houchins
|
4b8a8435af |
Amend Docker Desktop patch policy SQL (#50041)
My workstation has Docker Desktop 4.84.0 (latest as of today) and was incorrectly failing the "macOS - Docker Desktop up to date" patch policy. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved Docker Desktop patch-status detection on macOS by excluding application paths containing `.back` anywhere in the path, avoiding incorrect patching of nested/backup bundles. - **Improvements** - Enhanced Docker Desktop install and uninstall cleanup to remove stale `Docker.app.back` artifacts and related staged in-progress update copies (including cleanup during upgrade timing). - **Tests** - Updated macOS Docker Desktop ingestion/patched check expectations to match the new `.back` path filtering behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
|
95008e853d |
Freeze the macOS Yubikey Manager FMA (#50054)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A Pins the macOS Fleet-maintained app for Yubikey Manager at its current output version, `1.2.5`, by setting `"frozen": true` on the Homebrew input. - `ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json` — added `"frozen": true` The flag is read by the ingester into the manifest ([`homebrew/ingester.go`](https://github.com/fleetdm/fleet/blob/main/ee/maintained-apps/ingesters/homebrew/ingester.go)) and then consumed in two places: - [`cmd/maintained-apps/main.go`](https://github.com/fleetdm/fleet/blob/main/cmd/maintained-apps/main.go) skips overwriting `outputs/yubico-yubikey-manager/darwin.json` when the output file already exists, so the published version, installer URL, SHA256, and patch-policy query stop moving. - [`cmd/maintained-apps/validate/main.go`](https://github.com/fleetdm/fleet/blob/main/cmd/maintained-apps/validate/main.go) skips the app entirely during validation. `frozen` is tagged `json:"-"` on the manifest struct, so it does not appear in the output JSON — that file is intentionally left untouched by this PR. The Windows FMA (`inputs/winget/yubico-yubikey-manager.json`) is deliberately **not** frozen and continues to update. ## Note for reviewers While preparing this change I found that the `yubico-yubikey-manager` cask has been **removed from homebrew-cask**: ``` https://formulae.brew.sh/api/cask/yubico-yubikey-manager.json → 404 ``` The full cask list now contains only `pallotron-yubiswitch`, `yubico-authenticator`, and `yubihsm2-sdk`, and the token is not present in `inputs/homebrew/custom-tap/` either. This matches upstream: Yubico discontinued `yubikey-manager-qt` (the 1.2.5 installer this FMA pins) in favor of Yubico Authenticator. **Freezing does not resolve that 404.** The ingester fetches cask metadata *before* the frozen flag is applied, so the scheduled "Update Fleet-maintained apps" workflow is still expected to fail for this app with: ``` panic: ingesting homebrew app: app not found in brew API ``` Fully resolving that would mean removing the macOS FMA, the way #50050 did for Nocturnal (input, output, `apps.json` entry, frontend icon + mapping, website PNG). This PR is scoped to the freeze only, per the request; the removal can be a follow-up if that is the direction we want. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually — confirmed the edited input still parses as JSON, and traced the `frozen` flag through the ingester into both the output-write skip and the validation skip. No automated tests were added; this is a single data-file flag with no new code paths. --------- Co-authored-by: Kitzy <kitzy@kitzy.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
kitzyandAllen Houchins
|
3ce3e238ed |
Add 6 Windows Fleet-maintained apps (#50016)
**Related issue:** N/A — Windows Fleet-maintained app (FMA) coverage for apps found deployed in a customer's ManageEngine SDP environment but missing from Fleet. ## What this does Adds **6** Windows Fleet-maintained apps — the subset of a larger batch that passes the FMA validator cleanly. Each has a winget-sourced input, a generated output manifest, and a catalog icon. Detection identity was verified against each app's real registry DisplayName; apps whose DisplayName carries a version suffix use fuzzy name matching, the rest match exactly. **MSI (clean, auto upgrade-code uninstall):** - **Git Extensions** — versioned ARP name (`Git Extensions 7.2.0.92`) → fuzzy match - **TightVNC**, **Yarn**, **SonicWall NetExtender** (WiX), **Zoom Outlook Plugin** — clean ARP names → exact match **EXE — NSIS (custom `/S` install + registry-lookup uninstall):** - **Spyder** — versioned ARP name (`Spyder 6`) → fuzzy match ## Notes - **Detection verification.** Every app's `unique_identifier` (registry DisplayName / osquery `programs.name`) and publisher were verified per the `new-fma` skill against winget `AppsAndFeaturesEntries`, MSI Property tables (`msiinfo`), and vendor installer scripts — not assumed. Git Extensions' MSI `ProductName` is `Git Extensions 7.2.0.92` and Spyder's ARP entry is `Spyder 6`, so both need `fuzzy_match_name`; the four exact-match apps were confirmed clean (e.g. TightVNC registers as `TightVNC`, not a versioned string). - **Validated on a real Windows host.** All six pass the FMA CI validator (install → detect → uninstall) on the SYSTEM-context Windows runner. - **Icons.** Git Extensions, SonicWall NetExtender, TightVNC, Yarn, and Zoom Outlook Plugin ship new catalog icons + website assets; Spyder reuses the existing `Spyder` icon. ## Testing - [x] FMA CI validator (install → detect → uninstall) on the SYSTEM-context Windows runner. - Generated outputs verified locally: all 6 produce valid manifests; MSI apps carry the correct UpgradeCode-based uninstall; exists/patched queries reviewed for name + publisher correctness; `go test ./ee/maintained-apps/...` passes. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added maintained Windows catalog entries for Git Extensions, SonicWall NetExtender, Spyder, TightVNC, Yarn, and Zoom Outlook Plugin, including silent install, version upgrade detection, and maintenance-ready uninstall flows. * Added new software icons for these apps and expanded icon matching so they display correctly in the catalog. * **Bug Fixes** * Improved Spyder Windows uninstall targeting and command/argument handling for more reliable removals. * **Documentation** * Refreshed Spyder supported version details to 6.1.5. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
Allen Houchins
|
aea7c4068f |
Remove Nocturnal as a macOS FMA (#50050)
**Related issue:** N/A — fixes the failing scheduled "Update Fleet-maintained apps" workflow The `nocturnal` cask was removed from homebrew-cask on 2026-07-28 ([Homebrew/homebrew-cask@517db75](https://github.com/Homebrew/homebrew-cask/commit/517db75b78)) after being deprecated on 2024-07-27 and disabled on 2025-07-27, both `because: :unmaintained` (upstream repo's last push was in 2018). The brew API now returns 404 for it, so the maintained-apps ingester panics: ``` panic: ingesting homebrew app: app not found in brew API ``` This removes Nocturnal as a Fleet-maintained app, following the same pattern as #46541 (Messenger) and #47420 (Dell Display Manager): - `ee/maintained-apps/inputs/homebrew/nocturnal.json` — Homebrew input - `ee/maintained-apps/outputs/nocturnal/darwin.json` — macOS output data - `ee/maintained-apps/outputs/apps.json` — Nocturnal entry - `frontend/pages/SoftwarePage/components/icons/Nocturnal.tsx` and its import/mapping in `index.ts` - `website/assets/images/app-icon-nocturnal-60x60@2x.png` # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually (verified `apps.json` still parses, no remaining `nocturnal` references, ESLint passes on the icons index) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Removed Apps** - Removed Nocturnal from the maintained application catalog. - Removed its installation and uninstallation support. - Removed the Nocturnal icon from software listings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
e3c9ed84c5 |
Update Fleet-maintained apps (#50033)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the Windows Discord package to version 1.0.9250. * Updated the installer download reference and verification checksum. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
fleet-releaseandallenhouchins
|
5db4146b4f |
Update Fleet-maintained apps (#50032)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Refreshed maintained application packages to their latest releases across macOS and Windows. * Updated ActiveDock, AWS CLI, BetterZip, Cursor, Docker Desktop, DuckDuckGo, EagleFiler, Figma, Firefox, Garmin Express, Hive, iMazing, Kiro CLI, Loom, LuLu, Microsoft Edge, Nessus Agent, Notepad, Ollama, PyCharm, Reqable, Spokenly, SQL Server Management Studio, Telegram, and Zed. * Updated download links and verification checksums to match the new installers. * Improved uninstall or installation behavior for select applications, including Figma, iMazing, and Ollama. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
fleet-releaseandallenhouchins
|
bdd04ba838 |
Update Fleet-maintained apps (#49989)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for the latest releases of Air Explorer, Appium Inspector, BetterZip, GeoGebra Classic, Google Drive, Grammarly, Melodics, NordLayer, Opencode, Screen Studio, VoiceInk, WhatsApp, RealVNC Server, Firefox Nightly, and Zed. * **Bug Fixes** * Refreshed download links and integrity checks for updated application packages. * Improved uninstall cleanup for Elgato Control Center, Kiro, Marked, Mellel, PureVPN, Reqable, and Rize. * Improved Zed removal by closing the app before deleting its files. * Updated SourceTree package metadata to the latest available installer. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Andrew Mellor
|
d06a4c222c |
47700 abm token invalid errors (#49770)
**Related issue:** Resolves #47700 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually. **_Not able to do for all code paths yet_** <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added `token_invalid` for Apple Business Manager tokens, automatically tracked based on Apple responses. * Enhanced host DEP assignment API responses with a structured `dep_device_error` field to classify why device details couldn’t be retrieved. * **Bug Fixes** * Improved error handling for DEP device lookup, distinguishing invalid/rejected tokens, expired terms, not-found devices, server/API errors, and unavailable/unspecified failures. * Added regression and unit test coverage for ABM token invalidation and DEP device error classification. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordan Montgomery
|
89f67544b4 |
Add support for fleet vars in scripts(controls scripts, software scripts/script-only packages and setup experience scripts) (#49781)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49511 and #46837 as a whole # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for Fleet built-in variables in host scripts, software installer scripts, setup-experience scripts, and maintained-app installer scripts. * Variables are resolved per host at execution time; saved content remains unexpanded. * **Bug Fixes** * Requests now validate Fleet variables up-front, with clear script-specific error messages for unsupported variables. * Added improved messaging when variable resolution fails during execution. * Enforced Fleet Premium licensing for script/installer flows that use Fleet variables. * **Documentation** * Documented supported variables and Premium requirements, including usage examples. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
9add93bcdb |
Update Fleet-maintained apps (#49954)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Updated Mellel for macOS to version 6.7.1. * Updated OnlySwitch for macOS to version 2.7.2. * Updated Reqable to version 3.2.15 on macOS and Windows. * Updated Visual Studio Code for Windows to version 1.130.0. * Refreshed installer links and verification data for each release. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
fleet-releaseandallenhouchins
|
9472107594 |
Update Fleet-maintained apps (#49952)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Updates** - Updated AnyDesk for macOS to version 9.7.3. - Updated Elgato Control Center for macOS to version 1.9. - Updated Firefox Nightly on macOS and Windows to newer builds. - Updated Marked, Notepad, PureVPN, Rize, Syncovery, and Zettlr for macOS. - Updated Zettlr for Windows to version 4.7.0. - Refreshed download links and verification checksums for applicable installers. - Updated installed-version detection so devices correctly recognize the latest releases. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
fleet-releaseandallenhouchins
|
5cd8edbfb5 |
Update Fleet-maintained apps (#49946)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Updated macOS and Windows installation metadata for Kiro, including version 1.0.228 installers and checksums. * Updated macOS installation metadata for Notepad to version 1.5.8. * Updated Firefox Nightly macOS installer metadata to a newer build. * **Bug Fixes** * Improved uninstall cleanup for Antigravity IDE, DevKnife, Dot, IsThereNet, Jellyfin, QLMarkdown, and RetroArch by correcting cleanup targets and Trash handling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
fleet-releaseandallenhouchins
|
77d4c647df |
Update Fleet-maintained apps (#49942)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Updated the Franz macOS app to version 6.5.2. * Updated the Ollama Windows app to version 0.32.4. * Refreshed download links and verification checksums for both applications. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
fleet-releaseandallenhouchins
|
44a3b8d3d7 |
Update Fleet-maintained apps (#49940)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added the latest available releases for numerous maintained apps across macOS and Windows, including ClickUp, OBS Studio, WeChat, Ollama, Arc, GoLand, and others. * Updated download packages and verification data so installations use the correct release artifacts. * **Bug Fixes** * Improved upgrade detection for updated app versions. * Refined cleanup behavior for CapCut and Pastebot during uninstallation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
