<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#36094
Followup work for #36094 after doc PR review
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves oversight on initial bug fix:
https://github.com/fleetdm/fleet/issues/32920#issuecomment-3716712957
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
1. Root cause: cmd/msrc/generate.go
Problem: The MSRC feed generator panicked when the January 2026 feed
wasn't available. The grace period was only 5 days, but MSRC feed
publication dates vary (not available right now).
Fix: Extended grace period from 5 to 15 days.
2. Defensive fix:
server/vulnerabilities/macoffice/integration_sync_test.go
Problem: Test only checked for files from the last 2 days, which failed
when the NVD repo hadn't published for a few days.
Fix: Extended tolerance to 7 days.
**Related issue:** #33760
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [X] Confirmed that the fix is not expected to adversely impact load
test results
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37926
# Details
This PR updates the `ActivityInstalledAppStoreApp` activity and the code
that generates it so that if a VPP install is triggered by a software
title's auto-update config, `fleet_initiated` is set to `1` in the
activity record. This is needed for auditing purposes in general, and
for accurate display of the activity in the Fleet UI in particular.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [ ] Added/updated automated tests
@lucasmrod is adding integration tests for this flow, we can check the
"last activity" from there and verify that `fleet_initiated=1`.
- [X] QA'd all new/changed functionality manually
Before:
<img width="718" height="138" alt="image"
src="https://github.com/user-attachments/assets/94489c20-a655-48ba-8284-21be02e8123c"
/>
After:
<img width="433" height="71" alt="image"
src="https://github.com/user-attachments/assets/9c4360d5-fc1b-41fd-9fd2-45211cea940d"
/>
Also verified that manual installs and re-installs still work as
expected and have `fleet_intiated=0`.
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
## Summary
Fixes the publisher name in the 1Password Windows Fleet-maintained app
query to match the actual Windows registry value.
## Issue
The generated query was using `AgileBits Inc.` (capital 'B') from the
winget manifest, but Windows registry shows the publisher as `Agilebits
Inc.` (lowercase 'b'). This caused a mismatch preventing Fleet from
properly matching the installed software with the Fleet-maintained app.
## Changes
- Added `program_publisher` override to `inputs/winget/1password.json`
with the correct publisher name
- Regenerated output manifest with corrected query
## Test plan
- [x] Verify the query matches actual Windows registry value on a test
host
- [x] Confirm Fleet can now properly match installed 1Password software
## Summary
Fixes the app name in the Slack Windows Fleet-maintained app query to
match the actual Windows registry value.
## Issue
The generated query was using `Slack` as the app name, but Windows
registry shows the app name as `Slack (Machine - MSI)`. This caused a
mismatch preventing Fleet from properly matching the installed software
with the Fleet-maintained app.
## Changes
- Updated `unique_identifier` in `inputs/winget/slack.json` from
`"Slack"` to `"Slack (Machine - MSI)"`
- Regenerated output manifest with corrected query
- Version updated to 4.47.69 (latest available)
## Test plan
- [x] Verify the query matches actual Windows registry value on a test
host
- [x] Confirm Fleet can now properly match installed Slack software
The "Mister Rogersing" anchor link in the Writing Style section was
missing an "s" at the end of "communication" in the path segment of the
URL, resulting in a 404.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Fixes#33291
Fix an issue where the abm terms expiry banner was not removed after the
expired token was deleted.
Also added a tooltip to the expired abm token name table cell
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] QA'd all new/changed functionality manually
Expanded the section on lists to distinguish between ordered and
unordered lists, added links to relevant sections, and clarified how
each list type should be represented in Markdown. Also updated examples
and improved consistency in list-related instructions.
Changed the Docker software slug from 'docker/darwin' to
'docker-desktop/darwin' for Apple Silicon macOS hosts in both
workstations and workstations-canary YAML files to ensure correct
package referencing.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37736
Enabling the public Android agent for Android MDM, by default
- `com.fleetdm.agent`
Also bug fix: [Preserve Fleet Agent in Android policy during GitOps/API
app
updates.](https://github.com/fleetdm/fleet/pull/37770/commits/9b3ccf55dc6f09078271d1f6a2e411e2220ee81d)
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added Android agent application with automatic deployment via Android
MDM to support SCEP certificate management on Android devices.
* Introduced configurable Android agent settings for package name and
signing certificate.
* **Documentation**
* Updated Android MDM configuration documentation with environment
variable and YAML configuration examples for Android agent deployment.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request updates the installation scripts for several macOS
applications to improve the user experience during installation. The new
scripts now track whether the application was running before
installation and automatically relaunch it afterwards if necessary.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37916
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
This pull request updates the installation scripts for several
maintained macOS applications to improve user experience by ensuring
that if the app was running before installation, it will be relaunched
automatically after the update.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37192
- Move /server/service/middleware/endpoint_utils to
/server/platform/endpointer
- Move /server/service/middleware/authzcheck to
/server/platform/middleware/authzcheck
- Move /server/service/middleware/ratelimit to
/server/platform/middleware/ratelimit
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Refactor**
* Reorganized internal endpoint utilities to a centralized platform
location for improved code organization and maintainability. No
functional changes to existing features or APIs.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request updates the installer scripts for the macOS FMAs to
improve the user experience during installation. The main enhancement is
that the installer scripts now detect if the application was running
before installation, quit it if necessary, and automatically relaunch it
after the installation completes.
This pull request updates the installation scripts for maintained macOS
applications. The main improvement is the addition of logic to
gracefully quit the application before installation and relaunch it
afterward if it was previously running. This helps prevent issues with
files in use during upgrades and provides a smoother user experience.
Resolves#35455
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [ ] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Introduced scheduled software updates for iOS/iPadOS managed devices
with time-window based installation scheduling that considers device
timezone
* Added timezone tracking for managed iOS/iPadOS hosts to enable
timezone-aware update scheduling
* **Improvements**
* Enhanced software update scheduling system with timezone and
time-window awareness for eligible devices
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Scott Gress <scottmgress@gmail.com>
Added instructions for making requests to the GTM Ops team, including
issue creation, kanban board access, and communication guidelines in the
IT and Enablement handbook.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35458
# Details
This PR adds new metadata to the `ActivityEditedAppStoreApp` activity
relating to the app's auto-update schedule. The data will be included
with every `ActivityEditedAppStoreApp` activity regardless of whether
the values changed. I have an open question about this on the [activity
docs
PR](https://github.com/fleetdm/fleet/pull/36534/changes#r2648884183).
One functional change to note here is that the act of recording the
activity has been moved up a level into the endpoint code, because the
activity now contains metadata from two different service methods (one
that updates the VPP app, and one that creates the auto-update
schedule).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
Updated NDES SCEP proxy to auto-detect response encoding, enabling
compatibility with Okta CA and other UTF-8-based CAs.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#36652
Video demo: https://www.youtube.com/watch?v=M7yLXEofdCE
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved response encoding handling in the NDES SCEP proxy with
automatic detection, enabling seamless compatibility with Okta CA and
other certificate authorities using UTF-8 encoding.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Jordan Montgomery