<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- Not needed
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Batch software installer and app-association endpoints now return the
list of referenced self-service categories.
* Category fields support an “omit when unset” JSON behavior so omitted
vs empty categories are distinguishable.
* **Bug Fixes**
* Improved category validation (trim + case-insensitive dedupe) and
GitOps reconciliation to remove unused categories.
* **Chores**
* GitOps schema simplified: no separate top-level
self_service_categories; categories are defined inline with packages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
<img width="2119" height="774" alt="Screenshot 2026-06-11 at 11 45
58 AM"
src="https://github.com/user-attachments/assets/1b940649-e1fe-4162-bb22-d9eb73401f47"
/>
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* UI now disables actions for users outside an admin’s full scope,
showing tooltips; column config now respects the current user.
* Added a permission helper to determine if one user can manage all
teams of another.
* Server-side authorization tightened to deny team-admin actions when
coverage of the target’s teams is incomplete.
* **Tests**
* Added comprehensive tests for multi-team and mixed-role permission
scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Adds 43 Fleet-maintained app(s) whose cask token starts with 'D':
inputs, outputs, app icons (TSX + website PNG), and the matching
index.ts and apps.json entries.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for 40+ new macOS applications (e.g., DaisyDisk,
Dangerzone, DarkModeBuddy, DataSpell, Deezer, DuckDuckGo, and many more)
so users can discover, install, update, and remove them via the
platform.
* Added application-specific installer/uninstaller behaviors to improve
safe installs and clean removals.
* Added UI icons for all newly supported applications for clearer visual
identification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add a new macOS installer script
(ee/maintained-apps/inputs/homebrew/scripts/webex_install.sh) that
handles dmg extraction, quitting/relaunching the app, backing up
existing /Applications/Webex.app, and removing stale Webex upgrade
bundles. Update the homebrew input (webex.json) to reference the new
install script path and update the darwin output
(ee/maintained-apps/outputs/webex/darwin.json) to point to the new
install_script_ref (d105863f) which contains the new script content.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47440
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Granola app versions to 7.319.1 for macOS and Windows
* Updated Hive app macOS version to 1.1.27
* Updated RightFont macOS version to 10.0.1
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Adds 55 Fleet-maintained app(s) whose cask token starts with 'P':
inputs, outputs, app icons (TSX + website PNG), and the matching
index.ts and apps.json entries.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for 40+ macOS applications to the software catalog
(productivity, utilities, browsers, developer tools — e.g., Pacifist,
Pale Moon, Paletro, Pastebot, PDF Expert, PixelSnap, Plex, Proton apps,
and more).
* **New Icons**
* Added app icons for the newly listed applications so they appear in
the Software page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add support for Logi Tune: include a Homebrew input manifest and
install/uninstall scripts, add a transformer to override the installer
URL to Logitech's enterprise PKG (and set SHA256 to "no_check"), and
register the app in outputs. Also add darwin output refs with version,
installer URL and embedded script refs, update apps.json to list Logi
Tune, and add a frontend icon component + PNG asset and icon map entry.
The PKG override is used because the Homebrew DMG contains a GUI-only
installer without a silent mode; version is still sourced from Homebrew.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added Logi Tune application support on macOS, including installation,
removal, and visual identification in the software catalog.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47085
# Details
When "Agent" columns is visible in the hosts table, using the "export"
feature caused a 400 because there's no "Agent" field in the struct with
a `csv` tag. This PR fixes the issue by exporting both osquery and orbit
version columns in the CSV, which are the constituent fields that make
up "Agent".
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
## Testing
- [ ] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] on main, got the 400 trying to export hosts list with the "Agent"
column present
- [X] on this branch, exporting with "Agent" present results in the
"osquery version" and "orbit version" columns in the exported CSV.
For unreleased bug fixes in a release candidate, one of:
- [X] Confirmed that the fix is not expected to adversely impact load
test results
- [X] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved hosts CSV export: empty and selection-only columns are
excluded and the display-only "agent" column is replaced by the actual
backend version fields, yielding cleaner, more accurate exports.
* **Tests**
* Added automated test to verify the CSV export requests the correct
columns and prevents download-side side effects.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Recut to version 4.4.5
* Updated Reminders Menubar to version 2.0.0
* Recategorized Remote Buddy as a Productivity tool
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* SF Symbols support updated to version 8.0 with new installer package
configuration and enhanced version compatibility checks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#41053
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
- [x] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Android device display-name resolution and formatting: SCIM
end-user full name → IdP full name → hardware model; applies to existing
and newly enrolled devices and formats names like "Alice's iPhone" when
a fullname is available.
* **Tests**
* Expanded test coverage for display-name precedence and fallbacks;
added mocks so enrollment, status, app install, and re‑enrollment flows
run when SCIM/IdP data is absent.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds 38 Fleet-maintained app(s) whose cask token starts with 'R':
inputs, outputs, app icons (TSX + website PNG), and the matching
index.ts and apps.json entries.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for 38+ new macOS apps (Radio Silence → RunJS) across
Productivity, Developer Tools, Security, and Utilities.
* Added installer/update manifests for these apps so they appear in app
listings and can be installed/updated.
* Added new app icons for all newly supported apps to improve UI display
and recognition.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47410
Quick win PR
# Checklist for submitter
## Testing
- [ ] QA'd all new/changed functionality manually _No, it's hard to
test, and depends on Apple's (undocumented) conditions for required
updates_
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Apple MDM now detects and records when devices require mandatory
software updates during enrollment.
* Enrollment logging enhanced to capture device identifiers and software
update status when a mandatory update is present.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated version metadata for 40+ maintained applications across macOS
and Windows platforms, including installer URLs and integrity checksums.
* Refreshed version constraints and detection logic to match latest
releases.
* Updated uninstall scripts where necessary to target correct
application versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Resolves#47412.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Agent settings editor now renders empty or null command-line flags
visibly (instead of hiding them), preserving their clearing behavior for
host-level settings.
* **Tests**
* Added tests to validate YAML output and formatting for command-line
flags, missing keys, and related edge cases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Delete Dell Display Manager from the codebase: remove winget input (app
definition) and installer/uninstaller scripts, remove the app's outputs
(windows.json) and its entry in ee/maintained-apps/outputs/apps.json,
and remove the frontend icon component and image. Also update the icons
index to drop the import and mapping for "dell display manager".
QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added a weekly ritual "Check Talk to us Calendly links" (effective
2026-06-12) to ensure demo booking links are working; includes automated
issue creation for any problems and a placeholder for additional
documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds a new section to `/handbook/company/why-this-way.md` explaining
why Fleet team members should preserve large free blocks on their
calendars.
- Covers key recommendations: maximize "free" availability for
customer-facing scheduling, avoid "Swiss cheese" calendars, keep
recurring habits marked as "free" longer in Reclaim, and book 30-minute
breaks instead of 15-minute ones.
- Notes that Reclaim's ability to choose "free" vs "busy" for habits is
available on both free and premium tiers, so all team members can use
this regardless of plan.
- Includes concrete examples illustrating how work blocks and fragmented
calendars hurt booking availability.
- Adds a FAQ section addressing common questions about personal blocks
(childcare), high external call volume, and short bathroom breaks.
- Grounds the guidance in Fleet's principle of optimizing for the
customer experience.
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/C01BQKMTJNR/p1781150656608139?thread_ts=1781148849.359729&cid=C01BQKMTJNR)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45595
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. (Will add in a follow up story)
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Enabled BYOD fleet enrollments with default team assignment capability
* Added enrollment challenge tracking and management for ADUE device
registrations
* Implemented secure enrollment URL token generation for enrollment
flows
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45635
Moved profile reconciler work from SQL to code, similar to what Apple
MDM team did last sprint.
The Windows MDM loadtest for 40 profiles with 30K hosts looks much
better.
```
┌──────────────────────────┬─────────────────────────────────────────┬───────────────────────────────────────────┐
│ │ Pre-fix baseline │ This branch │
├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤
│ Transfer wall time │ ~40–42 min │ ~15.5 min │
├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤
│ Per work tick │ 215–257s (host-finding query dominated) │ ~48s (host-finding gone; now bulk writes) │
├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤
│ Ticks > 30s (work ticks) │ ~all │ ~all (16/17, ~48s) │
├──────────────────────────┼─────────────────────────────────────────┼───────────────────────────────────────────┤
│ Pacing governor │ the host-finding query │ the 2000-host delivery cap + 30s interval │
└──────────────────────────┴─────────────────────────────────────────┴───────────────────────────────────────────┘
```
The writer spikes briefly to 16 AAS, but has CPU headroom, so I'd say we
can claim to support 40 profies on 30K hosts.
```
┌───────────────┬───────────────┬───────────────────────────┬───────────────────────────────────────┐
│ Instance │ CPU avg / max │ DBLoad avg / max (4 vCPU) │ Read / Write / Commit latency │
├───────────────┼───────────────┼───────────────────────────┼───────────────────────────────────────┤
│ writer -two │ 67.9% / 74.9% │ 4.84 / 16.0 │ 0.28ms / 2.07ms / 10.6ms (max 12.2ms) │
├───────────────┼───────────────┼───────────────────────────┼───────────────────────────────────────┤
│ reader -one │ 46.1% / 52.7% │ 1.19 / 5.0 │ 1.59ms / — / — │
├───────────────┼───────────────┼───────────────────────────┼───────────────────────────────────────┤
│ reader -three │ 65.4% / 70.1% │ 1.77 / 5.0 │ 1.72ms / — / — │
└───────────────┴───────────────┴───────────────────────────┴───────────────────────────────────────┘
```
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Reworked Windows MDM reconciliation to a snapshot-based, batched
drain-loop, improving responsiveness and reducing database load during
large profile operations.
* **Performance / Reliability**
* Windows MDM profile changes now reach hosts faster; large team-wide
profile additions/removals (including host transfers) complete more
quickly with lower DB impact.
* **Chore / Configuration**
* Added tunables to control per-tick delivery caps and scan budgets.
* **Tests**
* Expanded end-to-end and property tests for install/remove, team/label
gating, and multi-window drain behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add Jamf PPPC Utility to maintained apps: create input metadata
(homebrew token), add app entry to apps list, and provide darwin output
with version 2.0.0, installer URL, sha256, and installer/uninstaller
script refs. Also add frontend SVG icon, update icon index, and include
the app PNG asset. This integrates PPPC Utility into the installer
catalog and UI under the Developer tools category.
Adds 21 Fleet-maintained app(s) whose cask token starts with 'E':
inputs, outputs, app icons (TSX + website PNG), and the matching
index.ts and apps.json entries.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for 20+ macOS applications including productivity tools,
utilities, communication apps, and development software with automated
installation, updating, and removal capabilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/47185
Changes:
- Updated the options for the "Estimated number of devices" input on the
deal registration form on the /partners page.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* In the deal registration modal, the "Estimated number of devices"
dropdown now uses an updated field label and consolidates prior
lower-range choices into a single "500–1,000" option.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds 34 Fleet-maintained app(s) whose cask token starts with 'B':
inputs, outputs, app icons (TSX + website PNG), and the matching
index.ts and apps.json entries.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added 34 new applications to the platform including Background Music,
Balsamiq Wireframes, Bambu Studio, Bitwig Studio, BoltAI, and others.
* Added visual icons for all new applications.
* Expanded macOS application management with installer and uninstaller
support for each new app.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
No changes file, already covered
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved compatibility with multiple Apple plist format versions for
more reliable file handling.
* Strengthened validation of plist inputs to reduce false positives and
improve security.
* Adjusted early bounds checking so very short or malformed plist files
are handled more robustly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
- @noahtalerman: Field descriptions show only the new names. JSON
examples show both old and new keys for backwards compatibility.
- Part of the following issue:
- https://github.com/fleetdm/fleet/issues/41419
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47239
Unreleased bug fixes.
- [ ] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45309
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Refactored internal code organization for improved maintainability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Jonathan Katz