Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Improved Amazon WorkSpaces macOS uninstall behavior for better file
cleanup operations
* Updated Google Gemini macOS version support to 1.63.12.361
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Resolves#43045
Fixed a bug where the carve cleanup cron job called the MySQL
implementation instead of the S3-aware implementation on S3-configured
deployments, meaning expired carves were never marked as expired in S3.
Also fixed a panic in S3 carve cleanup that occurred when there were no
non-expired carves.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Amazon WorkSpaces support on macOS (version 5.32.0.6080) with
installation and uninstallation workflows.
* App now appears in the apps list for macOS.
* **Documentation**
* Updated Amazon WorkSpaces description for the existing Windows entry.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Cursor macOS (ARM64) maintained-app definition to version
3.6.31 with updated installer download source and verification checksum.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46338
Changes load tested (osquery load test).
<img width="1532" height="282" alt="image"
src="https://github.com/user-attachments/assets/9eb38629-918e-4e05-bc0b-e2ae22e8b148"
/>
<img width="1414" height="937" alt="image"
src="https://github.com/user-attachments/assets/1b90afd3-087c-452e-939f-b495df3e59c8"
/>
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Performance Improvements**
* Extended host cache retention period from 60 seconds to 180 seconds to
improve overall cache efficiency and hit rates.
* Optimized host cache invalidation strategy to eliminate unnecessary
reverse-index lookups, significantly reducing database reader load and
Redis CPU consumption.
* **Tests**
* Added test coverage for host update cache invalidation edge cases to
ensure proper behavior.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46458?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced Windows uninstall reliability by improving how Zed is
identified in the system registry, transitioning from broad pattern
matching to exact matching for more consistent and reliable uninstall
operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Switch the homebrew input for corp.sap.privileges to use an
installer_format of "pkg" instead of "dmg". Update the darwin output to
reference a new install script (67ca5549 -> 7a7e7893) that installs the
.pkg directly (removes the hdiutil attach/copy flow used for DMGs) while
preserving the app quit/relaunch logic. No other metadata or checksum
changes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Zed support for Windows package management (new Windows package
entry and metadata for v1.4.4).
* Implemented silent install and uninstall flows for Windows with
automated handling of running processes.
* Added registry-based uninstall detection and robust exit-code handling
for reliable deployments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Delete Messenger-maintenance and UI assets: remove Homebrew input
(ee/maintained-apps/inputs/homebrew/messenger.json), macOS output data
(ee/maintained-apps/outputs/messenger/darwin.json) and the Messenger
entry in ee/maintained-apps/outputs/apps.json. Also remove the frontend
icon component and its import/mapping
(frontend/pages/SoftwarePage/components/icons/Messenger.tsx and related
index.ts updates). Cleans up packaging metadata and UI references for
Messenger.
Pipe `yes` into `hdiutil attach` to auto-accept DMG license prompts,
make attach failures exit, and ignore detach failures. Add a unit test
to verify the DMG extract commands. Remove per-app install script files
and corresponding install_script_path entries from inputs, and update
outputs to reference consolidated install scripts that track/relaunch
running apps after installation (updated install_script_ref hashes).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved DMG installation handling with automatic license prompt
acceptance
* Enhanced app state management during installation to preserve running
state and relaunch post-install
* **Bug Fixes**
* Added error handling for failed DMG mount operations
* **Tests**
* Added test coverage for DMG extraction improvements
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45895?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Enhance the trash() implementation to detect glob patterns in the target
path, expand them, and move each matched file into the user's .Trash
with a timestamp and random suffix. If no matches are found the function
logs that the pattern doesn't exist.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Trash utility now supports glob patterns (`*`, `?`, `[]`) to remove
multiple matching files at once.
* Each trashed item receives a unique suffix to avoid filename
collisions.
* Per-file removal messages shown; a clear notification is printed when
a pattern matches no files.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46287?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated application version metadata for Adobe DNG Converter (18.3.2),
Bitwarden (2026.5.0), DBeaver Community (26.1.0), Power BI Desktop, and
Rectangle (0.96).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Detect AI/LLM referrers and classify them as an "Organic AI (AI)"
source. Adds a REFERRER_DOMAINS_FOR_ORGANIC_AI list and branching logic
to set attributionDetails.sourceChannelDetails and
attributionDetails.campaign based on the referring AI platform (ChatGPT,
Claude, Gemini, or Other) in
website/api/helpers/salesforce/update-or-create-contact-and-account.js.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:**
resolvesfleetdm/confidential#16034
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved contact attribution: traffic from AI/LLM platforms (ChatGPT,
Claude, Gemini, etc.) is now labeled "Organic AI (AI)" and assigned
platform-specific default campaigns.
* Refined organic search detection to better identify Bing search
referrals.
* Other non-digital/non-event referrers now default to "Web referral
(WR)".
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46182?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves # None - Regenerating a cert to fix tests
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Replaced SCEP test CA certificates and associated encrypted
private-key test fixtures used by automated tests.
* **Chores**
* CI workflow path filters updated so changes to test data now trigger
test runs.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46475?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#44892
Claude also added tests, since this wasn't covered before, but I've kept
them in a separate commit in case they're not needed.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved spec parsing to correctly accept resources declared as either
team or fleet, handling nested spec keys consistently and preserving
backward-compatible behavior.
* **Tests**
* Added and updated tests and fixtures to validate parsing across both
team/fleet variants and to assert specific conflict/reporting behavior
when both keys are present.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44894?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Scott Gress <scott@fleetdm.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45281
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. Will be added in the backend work PR
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added backend tracking to consolidate Apple and Windows software
update settings into a single, consistent store with uniqueness and
cascade-delete safeguards.
* Backfilled existing qualifying Apple and Windows update configurations
into the new tracking store.
* **Tests**
* Added tests validating correct population, constraint enforcement, and
cascade-delete behavior.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46433?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
Follow up work as discovery made on the Apple reconciler changes.
One more follow up PR will come with a clean up of all old and unused
code.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Updated integration tests to use batched reconciliation workflows
instead of direct database manipulation.
* Improved test determinism by explicitly awaiting async
profile-schedule triggers before state assertions.
* Enhanced test failure diagnostics with more detailed profile
comparison messages.
* **Chores**
* Marked internal reconciliation methods for future deletion with TODO
annotations.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46321?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
