**Related issue:** Resolves#49419
Adds the UI for patching Fleet-maintained apps when the app is closed.
The patch toggle becomes a Deploy control with Force install and Patch
checkboxes. Checking Patch reveals a radio group: Patch when app is
closed, Force patch, or End user initiated. The control appears in the
Add software flow, a new Deploy modal, and the edit-policy page. The
change also adds skipped-install copy in the activity feed and install
details, a Self-service toggle for Fleet-maintained apps, and GitOps and
Premium gating.
The PR also includes backend changes that expose the patch policy's
continuous-automation state and a Fleet-maintained app's install query
in the API. The UI reads both to show the correct Deploy options, so
they ship in one PR.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Eng QA walkthrough [part
1](https://drive.google.com/file/d/1Un-Z4QoTk2eXslQ_b8t95cE11QYq1SUt/view?usp=drive_link),
[part
2](https://drive.google.com/file/d/12_1Eh_RHOJ7RTjXBxFgas0VhKWvhLS0r/view?usp=drive_link)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49416
- Adds patch_when_closed to the new policy, update policy, and update
package endpoints
- Sets pre_install_query in the software title endpoint to
software_installers.app_open_query if the policy is a patch when closed
policy (discussed in standup)
- Deletes the existing pre_install_query if setting patch_when_closed
(discussed in standup)
- Fixes a small error in the patch_policy package
- Fixes the default macOS query in patch_policy package to use to escape
symbols in a.path
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a “patch when closed” option for patch policies and
Fleet-maintained apps.
* Added installer controls for enabling patching and configuring whether
apps must be closed before installation.
* Automatically manages pre-install behavior and continuous automation
requirements for these policies.
* **Bug Fixes**
* Improved app detection based on application path prefixes on macOS.
* Corrected RStudio process detection on Windows.
* Added validation to prevent incompatible patch policy settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49417
Makes an "app was open" result on a patch-when-closed policy install a
**skip** rather than a failure:
- Detects the skip in `SaveHostSoftwareInstallResult` — policy
`patch_when_closed` + empty pre-install output — and labels the
`installed_software` activity with `install_skipped_when_app_open`.
- Doesn't let the skip consume a retry attempt: stores `attempt_number =
0` (excluded from the retry-sequence count) and doesn't queue an
immediate retry — the next continuous-automation run re-fires.
- Shows "The app was open" copy in install details, distinct from the
generic pre-install-query-failed copy.
- Keys on the managed policy flag, not on empty output, so an ordinary
empty `pre_install_query` on a non-managed policy still fails and still
counts toward the retry limit.
The `changes/` entry for this feature lives on the base feature branch
per the stacked-PR convention.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one host's records do not affect another)
- [x] QA'd all new/changed functionality manually
- Drove the orbit `software_install/result` endpoint end-to-end against
a running server: app-open result → `failed_install`, activity
`install_skipped_when_app_open: true`, `attempt_number = 0`, no retry
queued, and install details showing "The app was open".
- Regression: an ordinary empty `pre_install_query` on a non-managed
policy still fails, counts (`attempt_number = 1`), and queues a retry.
**Related issue:** Resolves#49418
Adds `patch_when_closed` support to GitOps for patch policies and
round-trips it through `fleetctl generate-gitops`.
- Validate `patch_when_closed` in the patch-policy YAML: reject an
explicit `continuous_automations_enabled: false` alongside it (GitOps is
declarative — the datastore would otherwise silently force it on),
auto-set it when omitted, and reject a `pre_install_query` on the
referenced Fleet-maintained app (Fleet manages that query).
- Emit `patch_when_closed` from `fleetctl generate-gitops`.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## New Fleet configuration settings
Follow this checklist for GitOps-enabled settings:
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md)
(#49022)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file
---------
Co-authored-by: Jonathan Katz <yehonatankatz@gmail.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49415
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- Tested with FLEET_DEV_MAINTAINED_APPS_BASE_URL pointed to a branch
with the new queries. If there is an open query, adding the FMA adds it
to `app_open_query`. If not, it remains empty.
- Also tested a few of the `SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM
apps a JOIN processes p ON p.path LIKE concat(a.path, '/%%') WHERE
a.bundle_identifier = '%s');` queries locally on apps available in
dogfood self service, looks like it will work reasonably well for a
start.
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- N/A Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- No timestamp updates
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a policy option to skip patch installation while the managed
application is open.
* Added support for detecting open applications on macOS and Windows.
* Maintained applications now preserve and use app-open checks during
installation and updates.
* Policy and installer responses now include the related configuration
fields.
* **Bug Fixes**
* Ensured app-open settings are retained when installers are created,
updated, or retrieved.
* Existing policies and installers receive safe default values for the
new settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
prep work for #49367
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for disowning Apple DEP devices, returning per-device
results (successful, failed, and inaccessible).
* **Bug Fixes**
* Improved consistency of authentication-related requests by carrying
over the original `User-Agent` when it is set.
* **Chores**
* Updated the bundled upstream dependency to a newer commit.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#47698
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for marking ABM tokens as invalid with a new
default-enabled status field.
* Existing token records are now initialized with a valid default state
during the update.
* **Tests**
* Added coverage to verify the new token status field is created
correctly and backfilled for existing records.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated BetterTouchTool for macOS to 6.651.
- Updated BetterZip for macOS to 6.0.
- Updated Downie for macOS to 4.12.11.
- Updated Firefox for macOS to 153.0, Firefox ESR to 140.13.0esr, and
Firefox Nightly to the latest build.
- Updated NordPass for macOS to 7.9.2.
- Updated Miro for Windows to 0.11.162.
- Updated Royal TS for Windows to 7.4.50721.0.
- Updated Typora for Windows to 1.14.7.
- Refreshed installer links and verification data for applicable
applications.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Token redemption consumed the key via a non-atomic read-then-delete,
which allowed concurrent requests to redeem the same one-time token more
than once. Made consumption atomic so a token can only be used once,
even under concurrent access, and added coverage for the concurrent
path.
Resolve the matching Fleet user from the persisted SCIM record rather
than the incoming request state when handling deactivation, so
deprovisioning still works when identifiers change in the same request.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated managed app packages to newer releases across macOS and
Windows, including Aptakube, AWS CLI, AWS VPN Client, ChatGPT,
CleanShot, DisplayLink, Firefox Nightly, Granola, Jamovi, Keyboard
Maestro, Microsoft 365 Copilot, NAPS2, Notion, Postman, Reqable, Tor
Browser, Typora, VirtualBox, WebCatalog, Webex, WhatsApp, and Wispr
Flow.
* Refreshed version detection logic and package integrity checks, along
with the associated download links.
* Updated installation behavior where required for DisplayLink,
Microsoft 365 Copilot, and NAPS2.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** No issue
Add Rajendra Kadam to Apple at Work team page.
Updated formatting for app request section in communications.md.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Changes:
- Updated the meta title of the /ai page (AI in IT » AI-powered IT)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the AI page’s metadata title to “AI-powered IT” for improved
page labeling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
systemd-run runs the detached child as a transient unit with
WorkingDirectory=/, so a relative $0 (e.g. ./uninstall-fleetd-linux.sh
per the uninstall guide) couldn't be found and the removal silently
never ran. Resolve $0 to an absolute path before re-exec.
Fixes#49411
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved the Linux uninstall process so the detached cleanup task
always runs from the correct script location.
- Enhanced compatibility between systemd-based environments and
non-systemd systems.
- Better supports script paths that include spaces or special
characters.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#49328
Adds Prisma Access Browser (Homebrew cask `prisma-access-browser`) as a
macOS Fleet-maintained app.
## Notes for reviewers
**Naming/slug:** This product already ships as a Windows FMA named
**Prisma Browser** (`prisma-browser/windows`, added in #46409 — "Prisma
Browser" is Palo Alto's current branding for what was Prisma Access
Browser). The FMA library combines platforms into one row by slug token,
so this entry uses `name: "Prisma Browser"` and `slug:
"prisma-browser/darwin"` while keeping `token: "prisma-access-browser"`
for the cask lookup (same token≠slug pattern as the `libreoffice`,
`ollama`, and `zoom` inputs). Both platforms now show as a single
"Prisma Browser" library row and share the existing Prisma icon, so no
icon changes are needed.
**Identity verified against the real installer** (downloaded the full
pkg; SHA256 matches the cask):
- `CFBundleIdentifier` = `com.talon-sec.Work` (from the pkg
Distribution/PackageInfo), so the exists query matches osquery's `apps`
table.
- `CFBundleShortVersionString` = `150.49.5.129`, exactly the cask
version before the comma, so the patched query's `bundle_short_version`
comparison reconciles.
- Installs `Prisma Access Browser.app` machine-wide to `/Applications`
as root; requires macOS 12+. Not a bootstrapper.
**Install script filename:** the cask's pkg artifact
(`PrismaBrowser-universal.pkg`) doesn't match the URL basename, but the
vendor serves that name via `Content-Disposition`, which is what the
server stores (`FilenameFromResponse`) and what orbit names the
downloaded installer on both download paths — so the auto-generated
install script works without a custom script.
**Installer URL** is pinned (version + hash in the path), so no
latest-redirect SHA-drift risk.
# Checklist for submitter
## Testing
- [x] Verified installer identity fields (bundle ID, versions, SHA256)
against the real pkg
- [x] `go test ./ee/maintained-apps/... ./cmd/maintained-apps/...`
passes; generated JSON validated
- [ ] FMA validator run (CI) confirms install/uninstall on a macOS host
Closes: https://github.com/fleetdm/confidential/issues/16847
Changes:
- Added a new page, AI-powered IT (/ai)
- Added links to the new page to the homepage, /linux-management,
/infrastructure-as-code, /device-management, and
/visibility-and-reporting pages
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an “AI-powered IT” page at `/ai`, including structured marketing
content, responsive hero imagery, and clear calls to action.
* Added an “AI-powered IT” entry to the Solutions navigation and updated
key page CTAs to link to `/ai`.
* **Style**
* Introduced and refined responsive `section-buttons`/button-group
layouts across multiple pages.
* Added dedicated styling for the new AI in IT page and adjusted related
feature-with-image spacing for better mobile presentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
The ESP release wrote the user-scope ServerHasFinishedProvisioning
Replace and immediately committed awaiting_configuration=None. During
OOBE the device rejects user-scope writes with SyncML 405 until its user
MDM context initializes, so the Account setup phase never received its
completion signal and the device hung until the 3-hour timeout, while
Fleet believed the ESP had completed (and relaxed the DMClient poll,
crippling remediation).
The release path now stays Active until the device acks the user-scope
Replace with a 200: a new resend phase re-sends the Replace once per
session (bounded by the existing 3-hour timeout), and the Active->None
transition commits only on the 200.
Live-validated on Win11 26200 on both a fresh and a re-enrolled device:
the 405 reproduced at release time in both flows, and the retried
Replace acked 200 one session after the user context came up, releasing
the ESP.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49134
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
- Fixed an issue where Windows Autopilot enrollment could intermittently
hang at **“Account setup”** on the Enrollment Status Page.
- Updated Enrollment Status Page release handling so enrollment **stays
active until the device acknowledges** the user-scope completion
command.
- When the user-scope completion is rejected or still unacknowledged, it
is **retried in subsequent management sessions** until successfully
acknowledged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44954
When a custom host vital referenced in a script or profile has no value
set for a host, the delivery failure detail didn't name the vital,
making it hard for admins to tell which one needed a value. The message
now includes both the vital's name and its `$FLEET_HOST_VITAL_<id>`
token.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved missing custom host vital error messages by including both
the vital name and its corresponding environment variable identifier.
- Updated the wording to be clearer about why values can’t be populated
when no value is set for the host.
- Kept singular vs. plural messaging correct when one or multiple vital
values are missing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enabled the “Product Designer” role so it now appears on the open
positions page.
* Published complete position details, including department,
compensation range, hiring manager, responsibilities, and experience
requirements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Isabell Reedy <113355639+ireedy@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
Saw I missed these when doing the DDM assets backend
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Expanded endpoint coverage for device management asset routes,
including listing, retrieving, deleting, and batch creation.
* Documented a remaining limitation affecting multipart asset uploads.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48343
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
No changes file as this is covered by the base feature branch
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added the ability to edit existing configuration profiles, including
profile contents and targeting labels.
* Added file validation for supported profile formats and clearer
edit-specific error messages.
* Added activity feed entries and filtering for edited configuration
profiles.
* Updated profile actions with an edit option and improved team-specific
label handling.
* **Bug Fixes**
* Improved label data refreshing when switching between teams.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: andymFleet <andrewmellor@fleetdm.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48342
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for editing existing Apple, Windows, and Android
configuration profiles through the API.
* Supports updating profile content, names where applicable, label
targeting, and Fleet variable associations without replacing the profile
identity.
* Added support for editing Apple DDM declarations.
* Added activity tracking for configuration profile edits.
* **Bug Fixes**
* Added validation for unsupported edits, invalid labels, duplicate
names, missing profiles, and protected Fleet-managed profiles.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Changes:
- Added a case study from Primo
- Added a link to the new case study to the /customers page
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added a new Primo case study card to the Customers page, including its
logo, description, and navigation link.
- **Bug Fixes**
- Corrected the Customers page template block comment syntax to improve
rendering consistency.
- Updated case-study quote author images to display with a circular
shape.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Changed typo "manger" to "manager"
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Closes: https://github.com/fleetdm/fleet/issues/46496
Changes:
- Updated the website's custom hook to create a Google API auth client
and make it available at `sails.googleAuthClient`
- Updated Android proxy endpoints to use the shared Google API auth
client.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Optimized Google API authentication handling for Android management
features to improve system performance and reliability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#47699
## Testing
- [x] QA'd all new/changed functionality manually
## What & why
Entra conditional access is becoming available to self-hosted Fleet
Premium instances, which don't have the shared `MS-API-KEY` that
cloud-managed customers use. This makes the `microsoft-proxy/*`
endpoints reachable without that key by dropping the `is-cloud-customer`
policy gate (and the now-unused shared-secret config comments / policy
file).
A replacement auth mechanism for the proxy is tracked separately in
#47702.
> Split out of #49414 so the website change can ship independently.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security / Access Control**
* Updated Microsoft proxy access handling to bypass the prior
cloud-customer check for matching requests.
* **Configuration**
* Removed unused cloud-customer compliance proxy shared-secret settings.
* **Bug Fixes**
* Improved compliance partner tenant creation by detecting existing
tenants using the provided Entra tenant ID and corrected the success
message text.
* **Data Model**
* Removed uniqueness enforcement for stored fleet instance URLs to
prevent avoidable conflicts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
**Related issue:** Resolves#49455
Offer `.py` script-only packages on macOS hosts, matching `.sh`.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Python (`.py`) installer packages are now treated as compatible
alongside shell (`.sh`) installers on macOS and Linux.
* Python installers can now appear in software availability,
self-service installation, and setup experience selections.
* Windows behavior remains unchanged (Unix-script installers are
excluded).
* **Bug Fixes**
* Improved cross-platform compatibility matching for Unix-like hosts
when choosing the first eligible installer package.
* **Tests**
* Added and expanded unit/integration coverage for `.py` installer
compatibility across platforms and flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated maintained app packages to newer releases across macOS and
Windows, including Arc, Bruno, Docker Desktop, Firefox Nightly,
Grammarly, Granola, Hive, Podman Desktop, QSpace Pro, Readest, Reqable,
Typora, and Zoom.
* Refreshed installer download links and verification checksums for the
updated releases.
* Corrected the Adobe Creative Cloud Windows installer checksum.
* Improved Grammarly Desktop removal behavior to clean up related
services and application data.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
- @noahtalerman: Follow up for the [this
bug](https://github.com/fleetdm/fleet/issues/48967) because @Brajim20
discovered we hadn't fixed the issue for macOS:
https://github.com/fleetdm/fleet/pull/48968#issuecomment-5024066554
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated the macOS panel enrollment link input color for improved
visual consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
**Related issue:** NA — routine custom-tap cask maintenance
## What
Bump three custom-tap casks to their latest upstream releases and
regenerate the api JSONs (`regenerate.sh`) and FMA output manifests (`go
run cmd/maintained-apps/main.go --slug=<token>/darwin`):
| Cask | Old | New |
|------|-----|-----|
| Druva inSync | 7.6.1 (r110931) | 8.1.3 (r110967) |
| Fleet Desktop | 1.3.2 | 1.3.4 |
| Zoom Rooms | 7.0.5.12655 | 7.1.0.13088 |
XCreds 5.9 (9148) is still the latest upstream release and is unchanged.
## Why / reviewer notes
- **Druva:** the 8.0.0 phased rollout never reached the public CDN (its
`.dmg` 404'd since March); 8.1.3 is the first 8.x build served from
`downloads.druva.com`. Druva 8.x officially supports macOS 14 (Sonoma)+
only, so `depends_on` moves from `:big_sur` to `:sonoma` (informational
— the ingester doesn't read it).
- **`api/xcreds.json` +2 lines with no cask change:** `regenerate.sh`
rebuilds all api JSONs, and current Homebrew now emits
`pinned`/`pinned_version` fields. Expected drift; anyone running the
script gets the same output.
- **Verification done against the downloaded installers:**
- sha256 values computed locally from the actual downloads; the Druva
download's SHA1 matches the checksum published on Druva's download page.
- Installer internals inspected: the Druva dmg still contains `Install
inSync.pkg`, and pkg receipt IDs are unchanged across all three
(`com.druva.inSync.pkg` @ 8.1.3, `com.fleetdm.fleet-desktop` @ 1.3.4,
`us.zoom.pkg.zp` @ 7.1.0.13088), so existing install/uninstall stanzas
remain valid.
- No `changes/` file, consistent with prior cask-bump PRs (#45912,
#48028) and the automated FMA-ingestion PRs.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] `go test ./ee/maintained-apps/...` passes
- [ ] QA'd all new/changed functionality manually (installer metadata,
URLs, and checksums verified as above; not yet deployed through a Fleet
server)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
Sets the new `byod_fleet` option on both Apple Business Manager tokens
in the dogfood GitOps config, so BYOD hosts appearing in Apple Business
Manager are automatically added to the right fleet instead of
"Unassigned":
- **Fleet Device Management Inc.** → `📱🔐 Personal mobile devices`
- **Mactivate LLC** → `🧪 Testing & QA`
Fleet names match the definitions in
`it-and-security/fleets/personal-mobile-devices.yml` and
`it-and-security/fleets/testing-and-qa.yml` verbatim (including emoji
prefixes). The file keeps the existing `apple_business_manager` parent
key (deprecated alias for `apple_business`) to match the surrounding
config; the alias machinery renames the parent before resolving nested
keys, so `byod_fleet` resolves correctly under it.
Note for reviewers: this only affects where *newly appearing* BYOD hosts
are placed — existing BYOD hosts in "Unassigned" are not retroactively
moved.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] QA'd all new/changed functionality manually — verified the YAML
parses (yaml.v3) and both ABM entries resolve to the intended fleet
names; config-only change to the dogfood GitOps setup, no product code
touched.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated macOS packages for ChatGPT, Windsurf, DuckDuckGo, Firefox
Nightly, Krisp, PicView, Postman, Processing, Shapr3D, and Zoom.
* Updated Postman for Windows to version 12.20.0.
* Refreshed installer links, version detection, and integrity checks for
the latest releases.
* Improved uninstall cleanup for DuckDuckGo and QLMarkdown.
* Updated Krisp installation and removal behavior for improved app
lifecycle handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Carlo