<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Related to, but does not resolve, #45267
Adds a 12h cooldown period such that when npm is resolving dependencies
it will not resolve anything released less than 12 hours ago. This
doesn't apply globally within the fleet project because some portions
use yarn which #45267 will take care of however this does add it to our
CI jobs and the .npmrc files for projects that use npm
I was going to set this as NPM_CONFIG_MIN_RELEASE_AGE in a github EV but
that won't automatically set it on every runner so leaving it in here
for now
As far as QA local builds and CI are both green. Tested
NPM_CONFIG_MIN_RELEASE_AGE=0.5 and min-release-age=0.5(in npmrc) locally
using the npm package feed https://registry.npmjs.org/-/rss to verify
that recently updated packages either chose an older version OR the
update was blocked if I tried to choose a newer one
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enhanced npm supply-chain security by implementing package
installation policies across build workflows and configuration files to
exclude packages released within the last 12 hours.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45268)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#43609 and #43566
Fixed bug were toggling GitOps mode was creating a spurious
update_conditional_access_bypass activity whenever Okta conditional
access was already configured with bypass_disabled=true.
**Related issue:** Resolves#44459
## Summary
Fixed an issue where the recovery lock password for a macOS host could
become unretrievable via the UI and API after the host was transferred
to a team with recovery lock disabled, even though the password was
still stored in the database.
## Root causes
Three bugs combined to produce the symptom:
- **Frontend visibility**: `canShowRecoveryLockPassword` gated the "Show
Recovery Lock password" action on the current team's
`enable_recovery_lock_password` setting and ignored the
`recoveryLockPasswordAvailable`
signal, so the UI option vanished whenever the host's new team had the
feature off.
- **API 404 on view**: `MarkRecoveryLockPasswordViewed` returned a
`notFound` error when its UPDATE matched zero rows. This happened as
soon as the `ClaimHostsForRecoveryLockClear` cron flipped the password
row's
`operation_type` from `install` to `remove` — causing `GET
/hosts/:id/recovery_lock_password` to 404 even though the password had
already been successfully retrieved and decrypted moments earlier in the
same
request.
- **Stale rotation deadline**: `ClaimHostsForRecoveryLockClear` left the
row's `auto_rotate_at` untouched when flipping to `remove`, so
subsequent reads still surfaced the pre-transfer view-deadline and the
UI
rendered a rotation banner promising an auto-rotation that the cron
(filtered on `operation_type='install'`) would never honor.
## Fix
- **Frontend**: updated `canShowRecoveryLockPassword` to also show the
action when a password is available, regardless of the team setting.
- **API**: changed `MarkRecoveryLockPasswordViewed` to return a zero
`time.Time` with no error when no install-state row exists. The service
skips the `AutoRotateAt` assignment in that case and explicitly nulls
any stale value loaded from the DB, so the response's `auto_rotate_at`
is omitted.
- **Data hygiene**: updated `ClaimHostsForRecoveryLockClear` to also set
`auto_rotate_at = NULL` when flipping a row to `remove`, since the
rotation deadline is meaningful only for install-state rows.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45230, Resolves#45213
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
#### For 45213
Did a gitops run to apply external URLs as logos:
<img width="395" height="122" alt="Screenshot 2026-05-12 at 10 52 25 AM"
src="https://github.com/user-attachments/assets/a1fea9ce-7a3d-419b-8c56-68568dcc704e"
/>
Command: `./build/fleetctl gitops -f
/Users/nico/dev/gitops-output-test/default.yml` (**gitops-output-test**
is where I usually have my gitops outputs).
Then I deleted both from the UI:
https://github.com/user-attachments/assets/03899795-7cda-485d-b87e-25f829b928b7
#### For 45230
- Uploaded logos using **org_logo_path_dark_mode** and
**org_logo_path_light_mode** in the first GitOps run.
- In the second GitOps run, set **org_logo_url_dark_mode:
"https://placehold.co/100"** and **org_logo_url_light_mode:
"https://placehold.co/100"**.
https://github.com/user-attachments/assets/4dfd0440-9a17-44e1-aa7d-395afd9c7d7a
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Organization logo deletion is idempotent and no longer errors on
repeated deletes.
* Orphaned hosted logo blobs are cleaned up after config changes;
deletion or activity-emission failures are logged and do not abort
requests.
* Conflicting/contradictory URL updates now produce validation errors.
* **Improvements**
* GitOps/logo sync strips gitops-only path keys and only performs
uploads in non-dry-run flows.
* Logo URL handling simplified: deprecated alias fields are mirrored and
path keys are stripped to avoid unintended deletions.
* **Tests**
* Added lifecycle tests for upload/delete, activity emissions, and
in-memory PNG generation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45236)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
FYI @rfoo2015
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated open job postings: replaced the Channel Account Manager with a
Controller role in Finance; updated hiring manager, on-target earnings,
and revised responsibilities and experience to reflect
controller/accounting requirements.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45289)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Refreshed version metadata and installer information for over 25
third-party applications, including Slack, Discord, Docker Desktop,
Claude, Firefox, Grammarly, Granola, MongoDB Compass, Signal, Telegram,
Teleport, Visual Studio Code, Notion, and others. Updates include new
installer URLs, updated security checksums, and modified version
comparison logic across macOS and Windows platforms.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45334)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
This is an experiment landing page to see if we get any different
results from his post
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added "Patch Faster" landing page with marketing content, responsive
styles, and page-level meta (title/description)
* Interactive demo request form with client-side validation, submission
flow, conversion tracking, and success state
* Integrations/platforms and proof sections plus a CTA and client script
to boot the page UI
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45278)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45290
Just drops the mobile platforms from the platform list in the chart
filters modal.
You can still find mobile devices by searching for now, as filtering
them out is a bigger change requiring either backend work or
on-the-glass filtering + pagination which is bug-prone.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated platform filter options in chart filters. iOS, iPadOS, and
Android are no longer available as filter options; macOS, Windows,
Linux, and ChromeOS remain supported.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45310)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45163
# Details
Limits CVE data collection to only those CVEs which we report on in the
chart. This is a performance optimization necessitated by the large
amount of data that bigger fleets may generate. The plan is to implement
a data compression strategy so that we can go back to collecting full
CVE data soon.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] Ran some collection jobs and verified that only tracked CVEs were
represented in "open" rows.
- [ ] Ran load test w/ new code
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
should improve results!
- [X] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Enhancements**
* CVE vulnerability tracking is now scoped to a curated set of critical
vulnerabilities, improving the relevance of security impact data
displayed across your systems.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45247)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42405
Unreleased bug fix.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Android MDM profile detail messages (e.g., certificate status) are
preserved when adding additional profiles or marking profiles pending,
preventing loss of important status information.
* **Tests**
* Added an integration test verifying ONC/certificate detail is retained
when additional Android MDM profiles are uploaded for the same team.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45299)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Updated the build-static-content script to modify links to embedded
YouTube videos to use youtube-nocookie.com instead
- Removed unused video modals on the homepage and orchestration page
- Updated embedded video links to use youtube-nocookie.com instead of
youtube
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced privacy for embedded YouTube videos site-wide by switching to
a privacy-focused embed domain.
* **Bug Fixes**
* Removed several end-of-page video modals (homepage and observability)
and consolidated homepage content into a preferences-focused modal;
minor content cleanup including a hidden identifier for page handling.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45275)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44046
# Details
Updates GitOps to ensure that team labels are created before any
consumers (e.g. profiles, policies, software) that might use the labels
are applied. It does this by adding a new `afterTeamApply` callback
option to `ApplyGroup` that is called after team config is applied --
this is when team labels are now created, instead of after `ApplyGroup`
runs.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed GitOps deployments failing when a label and a profile that
references it are created in the same run.
* Ensures the correct apply ordering so dry-run/log output shows label
application before profile application.
* **Tests**
* Added a regression test validating label → profile apply ordering to
prevent future regressions.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45194)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Updated test fixtures for Apple VPP configuration in GitOps workflows
to better reflect real-world scenarios.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45305)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44801
Fixed remaining issue setting end user authentication in the UI.
The root cause was that the frontend was always sending
`enable_managed_local_account : false` even when macOS MDM was disabled.
Fix:
<img width="756" height="363" alt="image"
src="https://github.com/user-attachments/assets/5f88797d-c5c3-4c03-9048-c8ee2981c374"
/>
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Automatic syncing of "Lock end user info" when toggling End User
Authentication now only runs when Apple MDM is enabled and configured
(with an exception when EUA is being disabled to preserve behavior).
* Save payloads omit Apple-only fields unless Apple MDM is configured.
* **UI**
* "Lock end user info" checkbox shows an Apple MDM–gated tooltip and is
disabled when Apple MDM is not configured.
* **Tests**
* Added coverage for Apple MDM–gated behaviors and saved-payload
variations.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45212)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42026
- Show "uninstall" button if the status is `installed` (or
`recently_installed`) which just reflects that the install script ran
successfully, not that the software title for the installer is in the
software inventory. For example, even with a no-op install script that
exits successfully the button will be available.
- Make the status clickable by removing the recentlyTakenAction check,
since that only represents the last install script that ran. This should
only really affect the `recently_installed` status (according to claude
at least).
This behaviour is already possible through the API, but it mostly
depends on the specific uninstall scripts if they will pass or fail when
the software doesn't even exist.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Uninstall option now appears for installers even when the host
inventory lacks a matching software entry, ensuring uninstall remains
accessible.
* **Tests**
* Added regression tests verifying the uninstall button is visible and
enabled for relevant installed states, including on personal device
pages.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45273)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45220 (one of many small PRs)
## Testing
- [x] QA'd all new/changed functionality manually. (Ran basic smoke
testing.)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added a consolidated test utilities package to boot full test servers,
seed users, retrieve auth tokens, and provide common mocks for
integration/service tests.
* Updated integration and service tests to use the new helpers for more
consistent, reliable test setup and wiring.
* **Chores**
* Centralized and reorganized test configuration types and options, and
standardized test wiring for clearer, maintainable test setup.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45221)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add Jonathan Porter to the Customer Success team.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Adding documented profiles for PSSO simplified setup. These are
specifically for the macOS 26+ feature, though most of what's in them is
also applicable to lower versions
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Documentation**
* Added example configuration profiles for macOS SSO extension setup
with Entra and Okta platforms.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45157)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Part of #38790. Stacked on top of #44935.
Closes#43968.
The two activate functions are the only `InstallApplication` command
builders, so fetching configuration and substituting `$FLEET_VAR_*`
inside them covers every enqueue path (manual, self-service, policy
auto-install, scheduled auto-update, setup experience, retry, admin
reinstall) by construction. Documents this invariant on each function.
Adds integration tests asserting an iOS install enqueues
`<key>Configuration>` with the host UUID substituted in, and macOS
installs omit the field.
---------
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
Part of #38790. Stacked on top of #44934.
Closes#43967.
Adds `SubstituteFleetVarsInAppConfig` in `server/mdm/apple`, called from
`nanoEnqueueVPPInstall` and `activateNextInHouseAppInstallActivity`
right before the `InstallApplication` plist is built. Reuses
`profiles.ReplaceFleetVariableInXML` (XML-escapes substituted values)
and `profiles.ReplaceHostEndUserIDPVariables` for IDP fields.
Supports the full `FleetVarsSupportedInAppleAppConfig` allow-list:
`HOST_UUID`, `HOST_HARDWARE_SERIAL`, `HOST_PLATFORM`,
`HOST_END_USER_EMAIL_IDP`, `HOST_END_USER_IDP_USERNAME` / `_LOCAL_PART`
/ `_GROUPS` / `_DEPARTMENT` / `_FULLNAME`. Returns
`ErrUnresolvableAppConfigVar` when the host can't supply a referenced
variable (e.g. end-user IDP not enrolled) so the caller can fail the
install rather than send an empty value to the device.
Pulls `hardware_serial` onto the host SELECT so `HOST_HARDWARE_SERIAL`
is available without a second round-trip.
---------
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
Part of #38790. Stacked on top of #44933.
Closes#43966.
The `InstallApplication` MDM command for VPP and in-house (`.ipa`) apps
was assembled inline in SQL via `CONCAT`, which can't carry
per-(adam_id, team_id, platform) configuration. Move the assembly into
Go: new `BuildInstallApplicationCommand` helper in `server/mdm/apple`,
plus refactored `nanoEnqueueVPPInstall` and
`activateNextInHouseAppInstallActivity` to SELECT pending tuples,
bulk-fetch configurations, build per-host plist bytes, and batch-INSERT
into `nano_commands`.
For iOS / iPadOS, the `Configuration` dict is inlined when stored
configuration is present. macOS VPP installs always drop the field
regardless of input. Empty / absent configuration omits the
`<key>Configuration>` entry — Apple treats this as "clear any managed
config for this app on next apply."
`$FLEET_VAR_*` tokens in the configuration are passed through
unsubstituted in this PR; per-host substitution comes in #43967.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced Apple app installation handling with improved command
generation and configuration management for VPP and in-house app
deployments.
* **Tests**
* Added comprehensive test coverage for app installation command
generation.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44934)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
Part of #38790. Stacked on top of #44932.
Closes#43969.
`fleetctl gitops` reads `configuration.path` for iOS / iPadOS VPP apps
and in-house `.ipa` apps, validates the file via
`fleet.ValidateAppleAppConfiguration`, and stores the bytes through the
service layer.
`fleetctl generate-gitops` emits `configuration.path` for apps that have
a stored configuration, writing the XML to
`lib/<team>/software/<app-slug>-config.xml`. Apps without configuration
omit the block entirely.
Round-trip integration tests
(`cmd/fleetctl/integrationtest/gitops/software_test.go`) cover apply +
generate for both VPP and in-house, plus a negative case for invalid
configuration content.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added managed app configuration support for enterprise software
deployments through GitOps
* Configurations now support platform-specific formats: XML for
iOS/iPadOS, JSON for Android
* Configuration validation ensures compatibility and prevents invalid
variable references
* **Tests**
* Added integration tests for configuration handling in software
deployment workflows
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44933)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
Resolves#45256
In macOS:
before: 129 MB build/fleet, 58 MB build/fleetctl.
after: 86 MB build/fleet, 42 MB build/fleetctl.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] QA'd all new/changed functionality manually. (Basic smoke testing
of the binaries in macOS.)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Optimized binary sizes for fleet and fleetctl releases.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45260)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#43279
On the My device page (DeviceUserPage), the Location and MDM status rows
in the Vitals card rendered as <Button variant="link"> even though no
modal was wired up, so clicking did nothing while the link styling
implied otherwise.
Resolves#39727
Fixed bug on QueryDetailsPage's backPath() implementation, so the "Back
to host details" button does not followed the stale filteredQueriesPath
set when the user previously visited the reports page.
Added additional API endpoints for Account-driven User Enrollment for
iOS devices.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves
https://github.com/fleetdm/fleet/issues/44742
Part of #38790. Stacked on top of #44931.
Closes#43965.
Wires managed configuration through the existing REST endpoints (`POST
/api/.../app_store_apps`, `PATCH
/api/.../software/titles/:id/app_store_app`, in-house `.ipa` upload /
update). Validation runs at the service layer for iOS / iPadOS; macOS
VPP installs silently drop the field. Wire format: a JSON-encoded string
of the XML plist on POST/PATCH and on GET single-title responses (not
base64).
Includes `server/service/integration_apple_vpp_config_test.go` with
end-to-end coverage: add / update with valid plist, allowed
`$FLEET_VAR_HOST_UUID`, omit-field-no-change, **`configuration: null` →
row deleted** (regression test for the clear-on-null fix in #43964),
malformed XML → 422, disallowed Fleet variable → 422, and macOS
silent-drop pre- / post-validation.
Also drops a stray `fmt.Println("auth")` in `SoftwareTitleByID`'s
authorization-failure branch.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for managed app configuration on iOS/iPadOS devices
through VPP and in-house installers.
* Configuration now validates plist format and detects disallowed Fleet
variables.
* **Bug Fixes**
* macOS apps now correctly ignore configuration settings as expected.
* **Tests**
* Added comprehensive integration tests for Apple VPP and in-house
installer configuration workflows.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44932)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
Co-authored-by: Jonathan Katz <44128041+jkatz01@users.noreply.github.com>
Jordan Montgomery
