**Related issue:** Resolves#46869
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Host vitals labels based on identity-provider group membership now
correctly apply to both global and team-scoped hosts, preventing
cross-team leakage.
* **Tests**
* Added and updated tests to validate IdP-group-backed vitals label
membership across global and per-team hosts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Pure refactor, no behavior change. First step for #45635 (Windows
batched in-memory reconciler).
- New server/mdm/reconcile package holds the include/exclude label
handlers and the team+label applicability dispatcher. The Apple platform
gate stays in the Apple wrapper since platform eligibility is
platform-specific.
- New platform-neutral fleet types (MDMProfileLabelRef,
MDMProfileIncludeMode, MDMLabeledEntity); the Apple names are now type
aliases so existing code and tests are unchanged.
- BulkGetHostLabelMemberships moves from apple_mdm_batched.go to a
neutral file; it was already platform-agnostic.
- The existing Apple label-scenario tests keep covering the shared logic
through the delegating wrappers; the shared package also gets its own
handler/dispatcher tests.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45635
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Moved MDM profile include/exclude label logic into a shared,
platform-neutral reconciliation flow for consistent behavior across
platforms.
* Consolidated Apple MDM label handling to reuse the shared
reconciliation primitives and improved host label membership lookup
behavior.
* **Tests**
* Added and reorganized unit tests covering MDM label-based profile
reconciliation, include/exclude rules, and Apple-specific wrapper
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Extracts the osquery status, result, and audit JSON logger setup out of
`runServeCmd` and into a new `cmd/fleet/logging.go`. Same pattern as the
prior extractions on this issue (#44929, #45343, #45583, #46166, #46421,
#46517, #46742, #46830). Continues trimming `runServeCmd` toward the
`serve.go` coverage goal on #33370 — this is the largest single slice so
far (~100 lines out).
Three functions come out of the inline block:
- `initOsqueryLogging` — builds the status and result loggers, plus the
audit logger when enabled. Mutates the shared `logging.Config` per
logger in the same sequence as before, so the constructed loggers are
identical.
- `buildLoggingConfig` — maps `config.FleetConfig` into the common
`logging.Config` shared by all three loggers.
- `shouldEnableAuditLog` — the premium-and-enabled gate for the audit
logger, pulled out so the decision is its own testable unit.
Behavior is preserved — `runServeCmd` calls this in the same place with
the same arguments, the per-logger config mutation order is unchanged,
and the full `cmd/fleet` suite passes against MySQL + Redis.
`initOsqueryLogging` returns early after `initFatal` so it's safe when
the caller's `initFatal` doesn't terminate (the case in tests), and it
guards a nil license up front since the audit gate dereferences it
(matching the nil-guard precedent from #46742/#46830).
On test scope: `TestShouldEnableAuditLog` covers all four combinations
of license tier and the config flag — audit logging is a premium
feature, so the gate is the meaningful decision here.
`TestBuildLoggingConfigMapsConfig` is a light check that the config
mapping is wired through. I didn't add a full `initOsqueryLogging`
happy-path unit test: `logging.NewJSONLogger` constructs real log sinks,
so that path is exercised by booting the server rather than by standing
up logger backends in a unit test.
**Related issue:** Refs #33370
# Checklist for submitter
- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Audit logging support is now available for premium license holders.
* **Refactor**
* Improved logging initialization and configuration management.
* **Tests**
* Added test coverage for audit logging enablement and configuration
mapping.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for three new macOS applications—BlueJ,
Burp Suite Community Edition, and LastPass—to the maintained apps
system. For each app, it introduces input definitions, output metadata,
and versioned install/uninstall scripts, enabling automated management
and inventory tracking for these apps on macOS.
**New macOS app support:**
* Added BlueJ:
- Introduced input definition (`bluej.json`) and output metadata
(`bluej/darwin.json`) with version, installer URL, and install/uninstall
scripts for BlueJ on macOS.
[[1]](diffhunk://#diff-722b9528fb3be4468c7992392cf001960853cafbae8b5140629a249a82dda943R1-R8)
[[2]](diffhunk://#diff-bb31a08cf30698a5c90ca13291bf7ca42214067807c28c34792140885a08213cR1-R22)
- Updated `apps.json` to include BlueJ for the `darwin` platform with a
description.
* Added Burp Suite Community Edition:
- Added input definition (`burp-suite.json`) and output metadata
(`burp-suite/darwin.json`) with version, installer URL, and
install/uninstall scripts for Burp Suite Community Edition on macOS.
[[1]](diffhunk://#diff-531fac23f77bd78bb99d6a3ffb9adac799d0506ea6e2ee95cbad214323e1790fR1-R8)
[[2]](diffhunk://#diff-0e6ed40888accd3caaf87216e64bce80ac0b884ecc7b7998f42ef28bcf9ad87fR1-R22)
- Updated `apps.json` to include Burp Suite Community Edition for the
`darwin` platform with a description.
* Added LastPass:
- Added input definition (`lastpass.json`) and output metadata
(`lastpass/darwin.json`) with version, installer URL, and
install/uninstall scripts for LastPass on macOS.
[[1]](diffhunk://#diff-4e017dbc26ca7fadc4365ae49dc1017e7646bebef7547643f71ede34af0bd1aaR1-R8)
[[2]](diffhunk://#diff-5ce50d7b8be0cbca9aa3fc2b15eef2159044b446cd77a1ca583c2e31e7ac8815R1-R22)
- Updated `apps.json` to include LastPass for the `darwin` platform with
a description.
Add Winget input manifest and PowerShell install/uninstall scripts for
Beekeeper Studio, and register the app in outputs. Files added:
ee/maintained-apps/inputs/winget/beekeeper-studio.json, install and
uninstall scripts under inputs/winget/scripts, and
ee/maintained-apps/outputs/beekeeper-studio/windows.json (version 5.8.1
with installer URL and SHA256). Also update
ee/maintained-apps/outputs/apps.json to include the Windows entry.
Installer script runs the NSIS installer silently with /S and /allusers
for machine-scope installs; the uninstaller searches ARP registry
entries, parses the uninstall string, and enforces /S and /allusers to
ensure a machine-scoped uninstall.
This pull request updates the uninstall scripts to treat additional MSI
exit codes that indicate a successful uninstall (but may require a
reboot) as success, rather than failure. This improves the robustness of
the uninstall process by not incorrectly flagging these scenarios as
errors.
**Improvements to exit code handling in uninstall scripts:**
* Added support for treating MSI exit codes `3010`
(ERROR_SUCCESS_REBOOT_REQUIRED) and `1641`
(ERROR_SUCCESS_REBOOT_INITIATED) as success, in addition to `0`, in both
`uninstall_msi.ps1` and `uninstall_msi_with_upgrade_code.ps1`. This is
achieved by introducing a `$successCodes` array and updating the exit
code checks to use it.
[[1]](diffhunk://#diff-09e225a2a28fbf997ddf571274119a20d9210539e5bdd49749beb2226e6de5aaR15-R20)
[[2]](diffhunk://#diff-c24faec992d742fed7d16c8621f140f7048ecb2cc88bd135fcf02cbd8653f77bR5-R8)
[[3]](diffhunk://#diff-c24faec992d742fed7d16c8621f140f7048ecb2cc88bd135fcf02cbd8653f77bL17-R21)
**Test updates:**
* Updated the golden test data for `uninstall_msi.ps1` to reflect the
new logic for handling successful exit codes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved MSI uninstall handling to recognize additional success
conditions, including scenarios requiring system restart, enhancing the
reliability of software removal operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add maintained-app metadata for Microsoft Remote Help on darwin: new
Homebrew input
(ee/maintained-apps/inputs/homebrew/microsoft-remote-help.json),
register the darwin variant in ee/maintained-apps/outputs/apps.json, and
add detailed release data in
ee/maintained-apps/outputs/microsoft-remote-help/darwin.json. The darwin
output includes version 1.0.2601221, installer URL, SHA256,
installer/uninstaller script refs and existence/patched queries to
detect installation state.
Register IBM Notifier in maintained apps and add frontend assets. Adds a
homebrew input (ibm-notifier.json), a new apps output entry, and darwin
metadata (version 3.2.3) including installer URL, sha256, and
install/uninstall script refs. Also adds a frontend SVG icon component,
the PNG app icon asset, and registers "ibm notifier" in the icon map.
Default category set to "Developer tools."
Add DFU Blaster Pro to maintained apps: input metadata (homebrew) and
outputs including an apps.json entry and a darwin-specific output with
version 4.2, installer URL, sha256, and install/uninstall script refs.
Include install/uninstall scripts that handle DMG installation, app
quit/relaunch, and cleanup of receipts/services. Also add a frontend
SVG/PNG icon (DfuBlasterPro component and 60x60@2x PNG) and update the
icons index to export the new icon. Default category set to Utilities.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Kitty for macOS to version 0.47.2
* Updated Stats for macOS to version 3.0.1
* **Bug Fixes**
* Improved Slack for Windows uninstall process to ensure reliable
package removal
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added support for Google Antigravity IDE with complete installation
and uninstallation capabilities on both macOS and Windows platforms
* Application is now discoverable and installable through the software
management interface
* Added visual icon representation for the application
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Add winget inputs, install/uninstall scripts, and outputs for PostgreSQL
15, 16 and 17. Each version includes a JSON input manifest,
install/uninstall PowerShell scripts (EnterpriseDB/BitRock installer
with --mode unattended and --unattendedmodeui none), and generated
outputs (per-version windows.json refs and apps.json entries). Also add
frontend SVG icon components and 2x PNG assets for each version to
display in the UI.
Add support for PostgreSQL 18 on Windows: new winget input manifest and
per-machine installer/uninstaller PowerShell scripts; outputs metadata
for version 18.4-1 (installer URL, sha256, and script refs) and app
registration in apps.json. Also add frontend icon component and 60x60
image asset, and update icons index to include the new icon. This
enables silent install/uninstall via the EnterpriseDB (BitRock)
installer and exposes the app in the software listing.
## Problem
The Slack Windows (winget/MSIX) uninstall script selected provisioned
packages with:
```powershell
$packageFamilyName = $PACKAGE_ID
Get-AppxProvisionedPackage -Online | Where-Object { $_.PackageFamilyName -eq $packageFamilyName }
```
Two bugs compound here:
1. **`Get-AppxProvisionedPackage` objects have no `PackageFamilyName`
property** (that's on `Get-AppxPackage` results), so
`$_.PackageFamilyName` is `$null` for every provisioned package.
2. **The FMA validator never substitutes `$PACKAGE_ID`** — it runs the
raw ref script with no substitution — so `$packageFamilyName` is also
`$null`.
The filter reduces to `$null -eq $null` → **true for every package**, so
the script tries to remove *all* provisioned packages on the machine and
fails on protected ones like `Microsoft.DesktopAppInstaller` (exit code
1603). This is the same failure mode just fixed for Affinity.
## Fix
Rewrite `slack_uninstall.ps1` to match Slack by literal identity —
across `DisplayName`/`PackageName` for provisioned packages and
null-guarded `Name`/`PackageFamilyName`/`Publisher` for installed
packages — following the working `claude_uninstall.ps1` pattern. No
longer depends on `$PACKAGE_ID` substitution or a property the
provisioned object lacks, so it works in both the validator and
production.
Regenerated the output manifest ref: `ae79ce28` → `1be2e38e` (content
hash verified against the source script).
## Note on MS Teams
`msteams_uninstall.ps1` is **not** affected — it matches a literal
`DisplayName` (`"MSTeams"`), a real property on provisioned packages,
rather than `PackageFamilyName`/`$PACKAGE_ID`. No change needed.
## Testing
- [ ] FMA validator run on a Windows host with Slack installed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Slack uninstallation reliability by enhancing package
detection logic to handle various package identification methods instead
of exact ID matching.
* Enhanced uninstall process with more robust error handling, timeout
protection (5-minute limit), and verbose progress logging for better
visibility during removal operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for several new Windows applications to
the maintained apps catalog, along with robust PowerShell install and
uninstall scripts for each. The main focus is on enabling automated,
silent deployment and removal of these apps using Winget, with careful
handling of installer quirks and registry lookups to ensure reliability
in enterprise environments.
**New application support:**
* Added `Citrix Workspace`, `Evernote`, `ExpressVPN`, `Front`, `Hyper`,
`Jabra Direct`, `Microsoft Teams`, `OneDrive`, `Opera`, `Podman
Desktop`, and `REAPER` to the `ee/maintained-apps/inputs/winget` catalog
with appropriate metadata for each app.
[[1]](diffhunk://#diff-3ba331a553f359a02dd3d824d3edab85292e2d1d9c1a6a739e313a9b63d5a88fR1-R13)
[[2]](diffhunk://#diff-917d3e25bae801c48ae70f70bf43e8540d962046bb773dbeed633eb52323e084R1-R12)
[[3]](diffhunk://#diff-b8f4026fc2a89254c0bdeb905120761ee78c6a76101deaf3dadd814ce3cafa94R1-R12)
[[4]](diffhunk://#diff-72a2bcc2c2b9fadcf09505f8caefb681e79679ee99fb068a84698c783e81f17dR1-R12)
[[5]](diffhunk://#diff-5bdb4220ac0cc23ff96963f975a55ef081493ee797545e0a1f65f9f4c50ef982R1-R12)
[[6]](diffhunk://#diff-941487a1c1f2ba4d2da50e47f47bbab46478f2bb7c7e009fdd21bf2b68090413R1-R12)
[[7]](diffhunk://#diff-9b5681ffd0b55fd89ce4f69e07668fa23df9582a921bf2000d9d2230429e16c9R1-R12)
[[8]](diffhunk://#diff-b69363f34d224c471ec183bf7a2d6bab13d776c8905e499cac0e39f31868fd19R1-R12)
[[9]](diffhunk://#diff-c8b49c5881565261369d37c862e055087cc65819900f961841c7dc76a83a879dR1-R13)
[[10]](diffhunk://#diff-88ceb0a6b8de6484bfcb3f0d19264e307d3166a34f992eba11fcc9d60facb052R1-R13)
[[11]](diffhunk://#diff-2557d37d79e9889f60f30557f28efb327e02bf33d4b255deefa912f855111412R1-R14)
**Install script implementations:**
* Added PowerShell install scripts for each new app, ensuring silent,
machine- or user-scoped installs as appropriate, with correct handling
of installer arguments and exit codes (including treating
reboot-required codes as success for Citrix Workspace and ExpressVPN).
[[1]](diffhunk://#diff-ccd33aec25bdbda547e3c4c9b4bcc32d923dcacfe6ebda1a80256d3388bb9003R1-R41)
[[2]](diffhunk://#diff-2b0d909e843c3c8265f67dd0e69843c4b59cea7d33741c5be8662ad464f39832R1-R34)
[[3]](diffhunk://#diff-fa9d859aa98e8240b9882363a62dc7c69a61186d186cf07c8065a8e11547a3c7R1-R37)
[[4]](diffhunk://#diff-9baf7c34c008963410a30fec1e6949023d03d3c400ec0166c029dd5eebcfaefeR1-R27)
**Uninstall script implementations:**
* Added PowerShell uninstall scripts for each new app, using registry
lookups to locate the correct uninstaller and applying silent uninstall
arguments. Scripts handle argument parsing defensively and ensure
correct removal in both per-user and per-machine contexts.
[[1]](diffhunk://#diff-ab38143c2c6f191c4f57aff0adb35e8c7a67cd95522da13da25febc8f65cc73eR1-R92)
[[2]](diffhunk://#diff-4657653f749298d4ae84fb467023108a273c8e621c8cc711d5821fbeacfa03cdR1-R91)
[[3]](diffhunk://#diff-1280127be173a1bdce9e7f18343fa6aae26fc3d15e1935e196669131deb484bdR1-R89)
These additions significantly expand the catalog's Windows app coverage
and improve reliability and automation for enterprise deployments.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Google Antigravity is now available for macOS via DMG installer.
* Supports automatic install and uninstall, preserving app state and
relaunching if needed.
* App appears in the software library with a dedicated icon for easier
discovery.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
This pull request adds support for several new Windows applications to
the maintained apps list by introducing new configuration JSON files for
each app under the `ee/maintained-apps/inputs/winget/` directory. Each
file defines metadata and installation details for a specific
application, including installer type, architecture, scope, categories,
and optional install/uninstall scripts. This update expands the range of
applications that can be managed and deployed.
**New application definitions:**
*Communication and Collaboration:*
- Added `Amazon Chime` (`amazon-chime.json`), `Front` (`front.json`),
and `Microsoft Teams` (`microsoft-teams.json`) with configuration for
installation, uninstallation, and categorization under "Communication".
[[1]](diffhunk://#diff-296db54aa9d8cea8e1302cc76e43abfd7565ab011bb3d1318a0d46c12b4b35f7R1-R12)
[[2]](diffhunk://#diff-72a2bcc2c2b9fadcf09505f8caefb681e79679ee99fb068a84698c783e81f17dR1-R12)
[[3]](diffhunk://#diff-9b5681ffd0b55fd89ce4f69e07668fa23df9582a921bf2000d9d2230429e16c9R1-R12)
*Productivity and Utilities:*
- Added `AnyDesk`, `Citrix Workspace`, `DeepL`, `Egnyte`, `Elgato
Control Center`, `Elgato Stream Deck`, `Evernote`, `ExpressVPN`,
`Hyper`, `Jabra Direct`, `Keeper Password Manager`, `LibreOffice`, and
`MindManager` with appropriate installer details, categories, and
scripts where applicable.
[[1]](diffhunk://#diff-9a7ba8c0afb32ab31c2950a4a95847fa1293411416302cd6698dc2bcb519fbfdR1-R12)
[[2]](diffhunk://#diff-3ba331a553f359a02dd3d824d3edab85292e2d1d9c1a6a739e313a9b63d5a88fR1-R13)
[[3]](diffhunk://#diff-03fc24bba02df2bcfb57acabaffd8d3afac94bafbda450c4336a67f85bc4429eR1-R12)
[[4]](diffhunk://#diff-ab44cad18bc633e446e1acd1714034464a92721e175cd0bd835fdb8eb4a7e0c8R1-R10)
[[5]](diffhunk://#diff-e5b9495ea0a996194b5c04a9327b33220a7b24e0e9abff2153c98ec949018bc0R1-R10)
[[6]](diffhunk://#diff-53b6cdd6d7032bffc8307f93a03eae3f1e82b57fa03316ad10b5b1af02b6c103R1-R10)
[[7]](diffhunk://#diff-917d3e25bae801c48ae70f70bf43e8540d962046bb773dbeed633eb52323e084R1-R12)
[[8]](diffhunk://#diff-b8f4026fc2a89254c0bdeb905120761ee78c6a76101deaf3dadd814ce3cafa94R1-R12)
[[9]](diffhunk://#diff-5bdb4220ac0cc23ff96963f975a55ef081493ee797545e0a1f65f9f4c50ef982R1-R12)
[[10]](diffhunk://#diff-941487a1c1f2ba4d2da50e47f47bbab46478f2bb7c7e009fdd21bf2b68090413R1-R12)
[[11]](diffhunk://#diff-605ef361eebaf639aaa110d3599f53f84c5cd3fc2cbcb5960bb741385b59e5eaR1-R12)
[[12]](diffhunk://#diff-fde7bf26f42621dd7f096bbb626af339e27312c0ca380ca2ef4a9f68ab1278ddR1-R11)
[[13]](diffhunk://#diff-c293d2eda9fea8cc74547aefd99e078d181f29b04b4289ee88bbf91b09432ae1R1-R13)
*Developer Tools:*
- Added `Arduino IDE` and `iMazing Profile Editor` with installer
metadata and categorized as "Developer tools".
[[1]](diffhunk://#diff-eaf314e8b4d4156a5f428809d9dd6484d5585bfc7382658fc93744750347773fR1-R10)
[[2]](diffhunk://#diff-649ae93e725621f9ee7d5fcddb3e81a2338eb3017ffae40a5dd915f42b75c8cfR1-R12)
*Browsers and Utilities:*
- Added `Arc` (browser) and `iMazing` (utility) with installation
details and script paths.
[[1]](diffhunk://#diff-bc27e68e5949eb7e4fd3c1d54f9f89b86cb6aed0e908f6687a4549dc81b65f49R1-R12)
[[2]](diffhunk://#diff-7c778f4e3418f1b5ad0094b2c5d366d3690ae480ef3910f1833fba1197d71d9bR1-R12)
This pull request adds support for the Comet browser (an AI-integrated
browser from Perplexity) to the maintained apps catalog for both macOS
and Windows. It introduces metadata, installation, and uninstallation
scripts, as well as versioned definitions for both platforms.
**New application support: Comet browser**
*Metadata and catalog integration:*
- Added `comet.json` metadata files for Homebrew (macOS) and Winget
(Windows) in the `inputs` directory, defining identifiers, installer
types, and categories.
[[1]](diffhunk://#diff-60e2346d602b7538ba08314f7adfdde98ca8e802dd3706c65bb75273fe7bbbd4R1-R8)
[[2]](diffhunk://#diff-ecdccc5ed1a1f1e6f2b66439941fcd74419b2706c1df155cb4bc1940abd6bfa7R1-R13)
- Updated `apps.json` to include Comet for both `darwin` (macOS) and
`windows` platforms with descriptive text.
*macOS support:*
- Added `outputs/comet/darwin.json` with versioned app definition,
install/uninstall queries, download URL, and references to
install/uninstall scripts.
*Windows support:*
- Added `outputs/comet/windows.json` with versioned app definition,
install/uninstall queries, download URL, SHA256, and references to
install/uninstall scripts.
- Added PowerShell scripts for silent installation (`comet_install.ps1`)
and uninstallation (`comet_uninstall.ps1`) of Comet, handling
machine-wide deployment and proper exit codes.
[[1]](diffhunk://#diff-5b9c60857fd2a49958f05124e8744394683297127503578e9b4eaf227470f1f7R1-R31)
[[2]](diffhunk://#diff-3433e05da3c0601490c7d90084264d4a793d0feef4211569b4aff884f85116dbR1-R101)
Add TablePlus Windows packaging: input manifest, PowerShell
install/uninstall scripts, and outputs. The install script runs the Inno
Setup installer silently with /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
/ALLUSERS; the uninstall script locates the Inno Setup uninstaller via
registry and runs it with silent args. apps.json was updated to include
TablePlus and a new outputs/tableplus/windows.json was added with
version 7.1.2, installer URL, sha256, and script references.
## Summary
Adds **WinRAR 7.22.0** as a Fleet-maintained app (Windows / winget
`RARLab.WinRAR`).
## Details
- **Installer type**: `exe` (WinRAR self-extracting installer), machine
scope → custom install/uninstall scripts (the ingester only
auto-generates for machine-scope MSI).
- **Silent install**: `-s1` — from the winget manifest's documented
`InstallerSwitches.Silent`.
- **Silent uninstall**: `uninstall.exe /S` located via the registry
`UninstallString`, parsed with the defensive 3-shape matcher.
- **Identity**: `unique_identifier: "WinRAR"` + `fuzzy_match_name: true`
→ exists query `name LIKE 'WinRAR %' AND publisher = 'win.rar GmbH'`.
Fuzzy match is required because WinRAR's registry DisplayName embeds the
version (`WinRAR 7.22.0 (64-bit)`). Registry Publisher matches the
winget locale Publisher, so no `program_publisher` override.
- **SHA**: matches the manifest's en-x64 installer; version `7.22.0`
reconciles with osquery's DisplayVersion.
- **Icon**: generated component, website PNG, and `index.ts` map entry
(`winrar`).
## Notes / risks
- Installer URL (`https://www.rarlab.com/rar/winrar-x64-722.exe`) is
version-pinned, so the SHA is stable until the FMA auto-update bumps it.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added WinRAR application support, including version 7.22.0 with
automated installation and uninstallation capabilities.
* Added custom WinRAR icon for improved visibility on the software page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add Zen Browser support: new PowerShell install and uninstall scripts
(silent NSIS installer with /S and /PreventRebootRequired; uninstaller
detects registry entries and runs uninstall string). Add winget input
manifest ee/maintained-apps/inputs/winget/zen-browser.json referencing
those scripts. Update outputs: add a apps.json entry for Zen Browser and
create ee/maintained-apps/outputs/zen-browser/windows.json containing
version 1.20b metadata, installer URL, sha256, and script refs.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated installer metadata for 13 apps (new versions, updated download
links and checksums) across Windows and macOS.
* Added a Windows uninstall script for TextExpander and registered it in
the package manifest to improve uninstall behavior and exit-code
handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Introduce a new content-style skill under .claude/skills/content-style
with a SKILL.md and three reference docs (content-types.md,
positioning.md, style-rules.md) to capture Fleet's voice, format rules,
and messaging guidance for authoring and reviewing public-facing
content. Also add .kilo/kilo.jsonc to register the .claude/skills path
so Kilo Code loads the skill automatically.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated project configuration to support automated skill management
infrastructure.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46467?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Introduce Groove OmniDialer to the maintained apps dataset and UI. Adds
a homebrew input (dmg) and an apps.json entry, plus a darwin-specific
output with version 26.603.1017, installer URL, sha256, and embedded
install/uninstall script refs. Also adds a frontend SVG icon component,
registers it in the icons index, and includes the app PNG asset.
Install/uninstall scripts handle quitting/relaunching the app and
cleaning user data.
Add ClickShare to maintained apps and frontend. Creates a Homebrew input
(ee/maintained-apps/inputs/homebrew/clickshare.json), adds an apps.json
entry, and adds an outputs file for darwin with version 4.50.0
(installer URL, sha256, and install/uninstall script refs). Also adds a
React SVG icon component, registers it in the icon map, and includes the
60x60@2x PNG asset for the app. Default category set to Communication.
Register Microsoft 365 Copilot: add a Homebrew input (unique_identifier
com.microsoft.m365copilot), add an apps.json entry, and add
darwin-specific output with version 1.2605.2501 (installer URL, sha256,
install/uninstall script refs). Also add a React SVG icon component,
update the icons index map, and include the app icon image asset.
Introduce Power Monitor (corp.sap.PowerMonitor) for Darwin: add Homebrew
input, register app in ee outputs/apps.json, and add detailed
ee/maintained-apps/outputs/power-monitor/darwin.json with version 1.3.3,
installer URL, sha256 and install/uninstall script refs. Also add
frontend assets — a React SVG icon component, register it in the icon
map, and include a 60x60@2x PNG app icon. This enables listing,
installation, and clean uninstallation of the Power Monitor app.
Introduce support for Cinc Workstation across the app catalog and UI.
Adds a winget input (ee/maintained-apps/inputs/winget/cinc.json), a new
apps catalog entry (ee/maintained-apps/outputs/apps.json), and a
Windows-specific output with versioned metadata
(ee/maintained-apps/outputs/cinc/windows.json) including installer URL,
SHA256, and install/uninstall script refs for version 23.5.1040. Also
adds a React SVG icon component, maps the app name to the icon
(frontend/pages/SoftwarePage/components/icons/*), and includes the 60x60
PNG asset for the app icon.
Rename Windsurf to Devin Desktop across EE manifests and frontend
assets. Bump darwin version to 3.0.28 and update installer URL, SHA256,
and install/uninstall script refs and contents
(ee/maintained-apps/inputs/homebrew/* and ee/maintained-apps/outputs/*).
Update ee/maintained-apps/outputs/apps.json to list Devin Desktop and
remove the old Windsurf entry. Add a new React SVG icon component and
register it in the icons index, and add the corresponding PNG asset
(frontend/pages/SoftwarePage/components/icons/DevinDesktop.tsx,
frontend/pages/SoftwarePage/components/icons/index.ts,
website/assets/images/*).
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Claude Windows to version 1.11187.4
* Updated Ollama Windows to version 0.30.6
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Claude Desktop (macOS) to version 1.11187.4
* Updated Cursor (macOS) to version 3.7.12
* Updated Figma Desktop (macOS) to version 126.4.13
* Updated Fork (Windows) to version 2.20.0
* Updated Ollama (macOS) to version 0.30.6
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected redirect links for Apple Business Manager documentation
resources, ensuring users are directed to the appropriate help content
within the Fleet UI.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for PowerShell as a managed Windows app,
including its metadata, versioning, install/uninstall scripts, and
validation logic in the CI workflow. It also ensures that any
pre-installed PowerShell 7 is removed from the test environment before
validation. The most important changes are:
**PowerShell app definition and metadata:**
* Added a new entry for PowerShell in
`ee/maintained-apps/inputs/winget/powershell.json` and included its
metadata in `ee/maintained-apps/outputs/apps.json`, enabling PowerShell
to be managed as a Windows app.
[[1]](diffhunk://#diff-7e4899a379d327948f55b7e6ba4c9893501713edd16020b128b68343569fcbfbR1-R10)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1985-R1991)
* Created `ee/maintained-apps/outputs/powershell/windows.json`
containing version information, SQL queries for existence and patch
status, installer/uninstaller scripts, and download URL for PowerShell
7.6.2.0.
**CI workflow enhancements for PowerShell:**
* Updated `.github/workflows/test-fma-windows-pr-only.yml` to detect
changes involving PowerShell, set the appropriate output flags, and
conditionally execute PowerShell-specific steps.
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR102)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR116)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR155-R162)
* Added a workflow step to remove any pre-installed PowerShell 7 from
the GitHub Actions runner, ensuring a clean environment for validation.
* Ensured that validation and related steps use Windows PowerShell 5.1
(not pwsh) after uninstalling PowerShell 7, to avoid shell availability
issues.
These changes collectively enable PowerShell to be validated, installed,
and uninstalled as part of the managed apps ecosystem and ensure
reliable, repeatable CI validation.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added PowerShell as a supported application with full Windows
integration, including installation and uninstall management
capabilities.
* Enhanced deployment scripts to support flexible input handling for app
configurations.
* Added PowerShell icon to the frontend UI for visual identification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/46872
Changes:
- Updated the `productCategories` value of the testimonial from Adam
Pippert to show it on the /software-management page.
- Updated the order of testimonials on the homepage,
/software-management, /device-management, and /linux-management
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* In-house iOS app manifest and package downloads now use secure
per-install tokens embedded in the URL path instead of query parameters
* Installation tokens are bound to specific devices and teams, enhancing
security
* Installation tokens automatically expire after 6 hours
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jonathan Katz <yehonatankatz@gmail.com>
**Related issue:** Resolves#35148
## What was added
| CVE | Rule | Reason |
|-----|------|--------|
| **CVE-2017-17522** | `IgnoreAll` | DISPUTED by Python maintainers; not
exploitable (`webbrowser.py` uses `subprocess.Popen` with
`shell=False`). Broad NVD CPE matched modern Python. |
| **CVE-2023-36632** | `IgnoreAll` | NVD-DISPUTED — Python states it's
"neither a vulnerability nor a bug" (intentional `RecursionError` in
`email.utils.parseaddr`). |
| **CVE-2024-3219** | `IgnoreIf target_sw != "windows"` | Only affects
platforms lacking AF_UNIX (Windows). Linux/macOS unaffected, but
NVD/VulnCheck CPE uses `target_sw=*`. |
**Files touched:**
- `cpe_matching_rules.go` — three new rules
- `cpe_matching_rule_test.go` — assertions covering all three (incl.
Windows-vs-macOS/Linux distinction for CVE-2024-3219)
- `changes/35148-python-cve-false-positives` — changelog
**Correctness note:** `target_sw` derives from software *source*
(`apps`/`homebrew_packages` → `macos`, `programs` → `windows`), so the
CVE-2024-3219 rule suppresses on macOS while preserving the genuine
Windows
positive.
## What was skipped, and why
| CVE | Why skipped |
|-----|-------------|
| **CVE-2024-12718** | Conflicting evidence: getvictor confirmed it's a
**true positive** (3.9.22 < fixed 3.9.23), contradicting the customer's
"only 3.12+ affected" reasoning. Needs a product/security ruling, not a
code change. |
| **CVE-2025-1795** | Likely a VulnCheck patch-level miss (customer says
3.10.17 has the backported fix). Needs the actual VulnCheck version
range to fix safely. |
| **CVE-2023-32681** | Affects `python:requests` and is **correctly
matched**; the customer dismissed it on deployment grounds ("corporate
servers only"). Not a detection bug. |
| **CVE-2007-4559** | Real tarfile path-traversal (CVSS 9.8, **not
disputed**); the customer labeled it "Other issue," not a false
positive. Suppressing it would hide a genuine vulnerability. |
**Related issue:** Resolves#42757
## Summary
Resending or renewing the Okta conditional access profile leaves an
orphaned SCEP certificate in the per-user macOS keychain, accumulating
duplicates with every renewal. This PR auto-runs an existing
keychain-cleanup script after a successful `InstallProfile` ack for the
Okta CA profile, so admins no longer have to find and run the script
manually.
## Root cause
Investigation in the issue thread isolated the trigger:
- The Okta CA `.mobileconfig` bundles `com.apple.security.scep` with
`com.apple.security.identitypreference` in a single profile (macOS
rejects the alternative — `Identity payload not found in same profile as
identity preference payload`).
- The Identity Preference payload creates a keychain-resident preference
item that keeps the *old* cert pinned across profile replacement, even
though the rewritten Identity Preference now points to the fresh SCEP
enrollment.
- EAP-TLS Wi-Fi profiles renew cleanly because they reference the cert
via SystemConfiguration (`PayloadCertificateUUID`), not the keychain —
so this isn't a generic SCEP-bundling issue.
The team decision in the issue (`@sharon-fdm`) was to delete the
duplicate certificate rather than restructure the profile. A standalone
cleanup script already shipped at
`docs/solutions/macos/scripts/delete-duplicate-scep-certificates.sh` and
was linked from the Okta CA guide; admins had to find and run it.
## Approach
Hook the existing Apple MDM `InstallProfile` ack path in
`MDMAppleCheckinAndCommandService.CommandAndReportResults`, parallel to
the existing ACME `CertificateList` follow-up. When the ack is for the
Okta CA profile and status is `verifying`, enqueue an internal host
script run that executes the cleanup script targeting the host's
per-user MDM enrollment short name.
Key properties:
- **Single hook, three paths covered.** Admin "Resend" nulls the profile
status and the reconciliation cron re-enqueues an `InstallProfile`; the
SCEP renewal cron also re-issues `InstallProfile`. Both flow through the
same ack handler this hook attaches to.
- **Idempotent.** The cleanup script no-ops when only one matching cert
is present, so triggering on initial installs (not just renewals) is
safe and removes the need to distinguish "is this a renewal".
- **Tightly gated.** Single indexed lookup keyed on `(host_uuid,
command_uuid, profile_identifier, platform='darwin')`. Other
SCEP-bearing profiles do not trigger the script. No work happens for
hosts with no per-user enrollment.
- **Internal-script semantics** (matches lock/unlock/wipe prior art).
Runs even when scripts are globally disabled. Does not appear in the
user-facing host activity feed.
- **Failure-isolated.** Enqueue errors are logged but do not break the
ack path; the renewal itself is what matters.
- **Defense in depth on the shell call.** The macOS short name is
validated against a strict regex (`^[A-Za-z0-9_][A-Za-z0-9_.-]*$`, ≤31
chars) before being interpolated, and POSIX single-quote-escaped on the
way through.
## Files
**New**
- `server/service/conditional_access_cleanup.go` — `//go:embed` of the
cleanup script, the hook helper `maybeRunOktaCACleanupScript`, the
validated shell-wrapper builder, and the POSIX single-quote escape
helper.
- `server/service/conditional_access_cleanup_test.go` — unit coverage
for username validation, shell escaping, the routing decisions of the
hook helper (mock-based), and an embed-sync assertion against the docs
copy.
-
`server/service/embedded_scripts/delete-duplicate-scep-certificates.sh`
— embed source-of-truth copy, byte-for-byte equal to the public
`docs/solutions/macos/scripts/` script.
- `changes/42757-okta-conditional-access-duplicate-scep-cert-cleanup` —
user-visible changes note.
**Datastore**
- `server/datastore/mysql/mdm.go` —
`OktaCACleanupTargetForInstallCommand`: single SQL lookup that returns
`(host_id, user_short_name, ok)` for the new hook. Returns `ok=false`
for non-Okta profiles, non-darwin hosts, or hosts without a user-channel
enrollment.
- `server/datastore/mysql/scripts.go` —
`NewInternalHostScriptExecutionRequest`: thin wrapper that routes
through the existing internal-script codepath (`isInternal=true`) used
by lock/unlock/wipe. Refactored the existing public method to share an
internal helper.
**Interface / mocks**
- `server/fleet/conditional_access_idp.go` — exported
`ConditionalAccessOktaProfileIdentifier`,
`ConditionalAccessOktaCertificateCN`, and the new `OktaCACleanupTarget`
struct, so both the template-render path and the SQL lookup can
reference the same source of truth.
- `server/fleet/datastore.go` — `OktaCACleanupTargetForInstallCommand`
and `NewInternalHostScriptExecutionRequest` added to the `Datastore`
interface.
- `server/mock/datastore_mock.go` — regenerated (additions only).
**Wiring**
- `server/service/apple_mdm.go` — call into
`maybeRunOktaCACleanupScript` from the InstallProfile
`MDMDeliveryVerifying` branch, alongside the existing ACME
`maybeQueueCertificateListForACMEProfile` follow-up. Warns on error
rather than failing the ack.
- `server/service/conditional_access_idp.go` — use the new
`fleet.ConditionalAccessOktaCertificateCN` constant when rendering the
profile template, eliminating the magic string duplication.
**Tests touched**
- `server/datastore/mysql/mdm_test.go` — integration test
`testOktaCACleanupTargetForInstallCommand` covering the happy path,
non-Okta profile, device-only enrollment, and unknown command.
- `server/datastore/mysql/scripts_test.go` —
`testNewInternalHostScriptExecutionRequest` confirming the internal flag
is set correctly and the new entry only appears under the internal-only
listing filter.
- `server/service/apple_mdm_test.go` — added the new mock stub for
`OktaCACleanupTargetForInstallCommandFunc` to
`TestMDMCommandAndReportResultsProfileHandling` so the existing test
continues to pass with the new hook in the codepath.
- `server/service/conditional_access_idp_test.go` — the rendered-profile
assertion now also pins on the shared
`ConditionalAccessOktaProfileIdentifier` and
`ConditionalAccessOktaCertificateCN` constants so the template can't
drift from the SQL lookup.
Lucas Manuel Rodriguez
