This pull request improves the handling and installation of Docker
Desktop in Fleet, with a focus on addressing issues caused by leftover
`.back` app bundles after in-app updates. It also introduces a custom
installation script for Docker Desktop to ensure correct app replacement
and relaunch behavior. The test coverage and configuration for Docker
Desktop have been updated accordingly.
**Docker Desktop patch policy and installation improvements:**
* Updated the patch policy query for Docker Desktop in `ingester.go` to
ignore any `.back` app bundles, preventing false "out of date" patch
status when stale bundles are present after self-updates.
* Added a custom install script (`docker_desktop_install.sh`) that
safely quits Docker Desktop, removes `.back` bundles, moves the new app
into place, relaunches the app if it was running, and sets up CLI
symlinks.
* Linked the new install script in the Docker Desktop Homebrew input
JSON (`docker-desktop.json`).
* Updated the Docker Desktop output JSON to use the improved patch query
and reference the new install script.
**Test enhancements:**
* Expanded test coverage in `ingester_test.go` to include Docker
Desktop, verifying the correct patch and exists queries for this special
case.
[[1]](diffhunk://#diff-82958e1ecc7af4c2032fcb933320788e6f5e663eb18ee6cc83df106f4df960e0L90-R90)
[[2]](diffhunk://#diff-82958e1ecc7af4c2032fcb933320788e6f5e663eb18ee6cc83df106f4df960e0R123)
[[3]](diffhunk://#diff-82958e1ecc7af4c2032fcb933320788e6f5e663eb18ee6cc83df106f4df960e0R153-R164)
Resolves#41985
Fixed issue were hosts migrated from another MDM via the macOS Tahoe
end-user authentication flow had only the IdP email populated on host
details because the SCIM user mapping was never created at
OTA-enrollment ingest time.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated version metadata and installer checksums for 12 maintained
applications including Camtasia, Cavalry, Docker Desktop, draw.io,
Google Chrome, Google Drive, Intune Company Portal, Microsoft Teams,
Ollama, Visual Studio Code, Warp, and WhatsApp.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45395)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Resolves#45220 (one of many PRs)
## Testing
- [X] QA'd all new/changed functionality manually.
Smoke tested upload/download of software installers, upload/download of
bootstrap packages.
**Related issue:** Resolves#45220 (one of many PRs)
## Testing
- [X] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Test utilities moved into test-only files and removed from production
code, reducing runtime dependencies and tightening module boundaries.
* **Tests**
* Updated test setup to use internal test helpers and explicit Redis
test setup, improving test isolation and reliability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
to be published in landing page folder and not linked from the main
navigation
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an Autonomous Endpoint Management landing page with full
marketing content, capability highlights, autonomous patching workflow,
GitOps messaging, and demo CTA.
* Includes a scrollable testimonials section, responsive styles across
breakpoints, and an interactive video modal.
* Page is reachable via a new route and loads the required client script
and styles.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45342)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: johnjeremiah <jjeremiah@gmail.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
Remove unnecessary surrounding double quotes from the `resolution` field
in
it-and-security/lib/all/policies/npm-supply-chain-compromised-packages.yml.
This cleans up the YAML and prevents literal quote characters from
appearing in rendered output; no functional change to the resolution
text.
Delete the explicit 'platform: darwin,linux,windows' line from the
hosts-with-npm-package-inventory label so the dynamic label applies
regardless of OS. The label still uses the same query (SELECT 1 FROM
npm_packages LIMIT 1) and remains dynamic; this change prevents
unintentionally excluding platforms.
Second PR in the staged plan from
[#33370](https://github.com/fleetdm/fleet/issues/33370#issuecomment-4394807680).
Per [@getvictor's
confirmation](https://github.com/fleetdm/fleet/issues/33370#issuecomment-4421816049),
takes the package-level var approach so tests can swap `initFatal`
without terminating the test binary.
The new `TestGetTLSConfigInvalidProfile` covers `getTLSConfig`'s default
case (previously unreachable in tests because it calls `initFatal`)
**Related issue:** Part of #33370.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
## Database migrations
_N/A — no database migrations in this PR._
## New Fleet configuration settings
_N/A — no new configuration settings._
## fleetd/orbit/Fleet Desktop
_N/A — no agent code changes._
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Improved test coverage for TLS configuration error handling.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45343)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Adds a new policy `TanStack supply-chain attack - not affected` to the 💻
Workstations fleet that checks `npm_packages` on macOS, Windows, and
Linux hosts for any of the known-malicious `@tanstack/*` package
versions involved in the recent supply-chain compromise.
The policy returns **1 (passing)** when no compromised package/version
pair exists on the host, and **fails** when at least one match is found
— making it easy to triage affected workstations from the Fleet UI.
## Changes
- New file: `lib/all/policies/tanstack-supply-chain-attack.yml` — the
policy definition.
- Updated: `fleets/workstations.yml` — registers the new policy under
the `policies:` list.
## Notes
- `calendar_events_enabled` is left at the default (off).
- Platform is set to `darwin,windows,linux` because the `npm_packages`
osquery table is cross-platform and developer dependencies can land on
any workstation OS.
- Resolution guidance instructs users to remove/downgrade the affected
packages and rotate any developer credentials that may have been
exposed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Detect compromised npm packages on workstations (cross-platform) with
remediation guidance.
* Enforce per-user npm "min-release-age" on macOS, Linux, and Windows
with automated remediation.
* Add a host label for machines reporting an npm package inventory.
* **Chores**
* Add cross-platform scripts to automate updating per-user npm
configuration.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45264)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Style fixes, including color and spacing.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Refined spacing and typography across the patch-faster landing page
for improved hierarchy and readability.
* Updated hero text (removed trailing period) and increased H1 size;
removed several section dividers for cleaner flow.
* Restyled proof strip into a light, bordered panel with darker neutral
text and adjusted highlight colors.
* Changed feature icon background to a light neutral; adjusted CTA
gradient start and internal spacing.
* Improved responsive paddings and gaps at tablet and desktop
breakpoints.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45338)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Added details on Simplified Platform SSO introduced in macOS 26,
including prerequisites, configuration steps, and user experience.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#30674
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43640
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
I figured out that the RunScriptModal was being re-rendered without any
user events or network calls after the 2s mark.
At first I thought the parent (ScriptModalGroup.tsx) could have been the
culprit since there's a lot going on there (lots of callback functions
passed to multiple modals).
It turns out that RunScriptModal is wrapped in React.memo to avoid
re-rendering but since some of its props changed in the parent
component, this caused it to re-render and close the Actions dropdown
randomly.
To detect which where the problematic props changing, I threw this code
at the top of RunScriptModal.tsx:
```react
const prev = useRef<any>({});
useEffect(() => {
const current = {
currentUser,
hostTeamId,
onClose,
page,
setPage,
hostScriptResponse,
isFetchingHostScripts,
isLoadingHostScripts,
isError,
onClickViewScript,
onClickRunDetails,
onClickRun,
isRunningScript,
isHidden,
};
const changed = Object.entries(current).filter(
([k, v]) => prev.current[k] !== v
);
console.log(
"RunScriptModal re-render. Changed props:",
changed.map(([k]) => k)
);
prev.current = current;
});
```
and the output was:
```
RunScriptModal re-render. Changed props:
(2) ['onClickViewScript', 'onClickRunDetails']
```
So I just wrapped those two in useCallback and that fixed the issue.
https://github.com/user-attachments/assets/f6eae13e-2a60-4fda-9468-2952acdedd58
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
* Fixed the Actions dropdown in the Run script modal on the Host details
page auto-closing after 2-3 seconds.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45349)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Related to, but does not resolve, #45267
Adds a 12h cooldown period such that when npm is resolving dependencies
it will not resolve anything released less than 12 hours ago. This
doesn't apply globally within the fleet project because some portions
use yarn which #45267 will take care of however this does add it to our
CI jobs and the .npmrc files for projects that use npm
I was going to set this as NPM_CONFIG_MIN_RELEASE_AGE in a github EV but
that won't automatically set it on every runner so leaving it in here
for now
As far as QA local builds and CI are both green. Tested
NPM_CONFIG_MIN_RELEASE_AGE=0.5 and min-release-age=0.5(in npmrc) locally
using the npm package feed https://registry.npmjs.org/-/rss to verify
that recently updated packages either chose an older version OR the
update was blocked if I tried to choose a newer one
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enhanced npm supply-chain security by implementing package
installation policies across build workflows and configuration files to
exclude packages released within the last 12 hours.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45268)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#43609 and #43566
Fixed bug were toggling GitOps mode was creating a spurious
update_conditional_access_bypass activity whenever Okta conditional
access was already configured with bypass_disabled=true.
**Related issue:** Resolves#44459
## Summary
Fixed an issue where the recovery lock password for a macOS host could
become unretrievable via the UI and API after the host was transferred
to a team with recovery lock disabled, even though the password was
still stored in the database.
## Root causes
Three bugs combined to produce the symptom:
- **Frontend visibility**: `canShowRecoveryLockPassword` gated the "Show
Recovery Lock password" action on the current team's
`enable_recovery_lock_password` setting and ignored the
`recoveryLockPasswordAvailable`
signal, so the UI option vanished whenever the host's new team had the
feature off.
- **API 404 on view**: `MarkRecoveryLockPasswordViewed` returned a
`notFound` error when its UPDATE matched zero rows. This happened as
soon as the `ClaimHostsForRecoveryLockClear` cron flipped the password
row's
`operation_type` from `install` to `remove` — causing `GET
/hosts/:id/recovery_lock_password` to 404 even though the password had
already been successfully retrieved and decrypted moments earlier in the
same
request.
- **Stale rotation deadline**: `ClaimHostsForRecoveryLockClear` left the
row's `auto_rotate_at` untouched when flipping to `remove`, so
subsequent reads still surfaced the pre-transfer view-deadline and the
UI
rendered a rotation banner promising an auto-rotation that the cron
(filtered on `operation_type='install'`) would never honor.
## Fix
- **Frontend**: updated `canShowRecoveryLockPassword` to also show the
action when a password is available, regardless of the team setting.
- **API**: changed `MarkRecoveryLockPasswordViewed` to return a zero
`time.Time` with no error when no install-state row exists. The service
skips the `AutoRotateAt` assignment in that case and explicitly nulls
any stale value loaded from the DB, so the response's `auto_rotate_at`
is omitted.
- **Data hygiene**: updated `ClaimHostsForRecoveryLockClear` to also set
`auto_rotate_at = NULL` when flipping a row to `remove`, since the
rotation deadline is meaningful only for install-state rows.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45230, Resolves#45213
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
#### For 45213
Did a gitops run to apply external URLs as logos:
<img width="395" height="122" alt="Screenshot 2026-05-12 at 10 52 25 AM"
src="https://github.com/user-attachments/assets/a1fea9ce-7a3d-419b-8c56-68568dcc704e"
/>
Command: `./build/fleetctl gitops -f
/Users/nico/dev/gitops-output-test/default.yml` (**gitops-output-test**
is where I usually have my gitops outputs).
Then I deleted both from the UI:
https://github.com/user-attachments/assets/03899795-7cda-485d-b87e-25f829b928b7
#### For 45230
- Uploaded logos using **org_logo_path_dark_mode** and
**org_logo_path_light_mode** in the first GitOps run.
- In the second GitOps run, set **org_logo_url_dark_mode:
"https://placehold.co/100"** and **org_logo_url_light_mode:
"https://placehold.co/100"**.
https://github.com/user-attachments/assets/4dfd0440-9a17-44e1-aa7d-395afd9c7d7a
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Organization logo deletion is idempotent and no longer errors on
repeated deletes.
* Orphaned hosted logo blobs are cleaned up after config changes;
deletion or activity-emission failures are logged and do not abort
requests.
* Conflicting/contradictory URL updates now produce validation errors.
* **Improvements**
* GitOps/logo sync strips gitops-only path keys and only performs
uploads in non-dry-run flows.
* Logo URL handling simplified: deprecated alias fields are mirrored and
path keys are stripped to avoid unintended deletions.
* **Tests**
* Added lifecycle tests for upload/delete, activity emissions, and
in-memory PNG generation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45236)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
FYI @rfoo2015
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated open job postings: replaced the Channel Account Manager with a
Controller role in Finance; updated hiring manager, on-target earnings,
and revised responsibilities and experience to reflect
controller/accounting requirements.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45289)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Refreshed version metadata and installer information for over 25
third-party applications, including Slack, Discord, Docker Desktop,
Claude, Firefox, Grammarly, Granola, MongoDB Compass, Signal, Telegram,
Teleport, Visual Studio Code, Notion, and others. Updates include new
installer URLs, updated security checksums, and modified version
comparison logic across macOS and Windows platforms.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45334)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
This is an experiment landing page to see if we get any different
results from his post
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added "Patch Faster" landing page with marketing content, responsive
styles, and page-level meta (title/description)
* Interactive demo request form with client-side validation, submission
flow, conversion tracking, and success state
* Integrations/platforms and proof sections plus a CTA and client script
to boot the page UI
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45278)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45290
Just drops the mobile platforms from the platform list in the chart
filters modal.
You can still find mobile devices by searching for now, as filtering
them out is a bigger change requiring either backend work or
on-the-glass filtering + pagination which is bug-prone.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated platform filter options in chart filters. iOS, iPadOS, and
Android are no longer available as filter options; macOS, Windows,
Linux, and ChromeOS remain supported.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45310)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45163
# Details
Limits CVE data collection to only those CVEs which we report on in the
chart. This is a performance optimization necessitated by the large
amount of data that bigger fleets may generate. The plan is to implement
a data compression strategy so that we can go back to collecting full
CVE data soon.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] Ran some collection jobs and verified that only tracked CVEs were
represented in "open" rows.
- [ ] Ran load test w/ new code
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
should improve results!
- [X] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Enhancements**
* CVE vulnerability tracking is now scoped to a curated set of critical
vulnerabilities, improving the relevance of security impact data
displayed across your systems.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45247)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42405
Unreleased bug fix.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Android MDM profile detail messages (e.g., certificate status) are
preserved when adding additional profiles or marking profiles pending,
preventing loss of important status information.
* **Tests**
* Added an integration test verifying ONC/certificate detail is retained
when additional Android MDM profiles are uploaded for the same team.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45299)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Victor Lyuboslavsky
