Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Mellel for macOS to version 6.7.1.
* Updated OnlySwitch for macOS to version 2.7.2.
* Updated Reqable to version 3.2.15 on macOS and Windows.
* Updated Visual Studio Code for Windows to version 1.130.0.
* Refreshed installer links and verification data for each release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated AnyDesk for macOS to version 9.7.3.
- Updated Elgato Control Center for macOS to version 1.9.
- Updated Firefox Nightly on macOS and Windows to newer builds.
- Updated Marked, Notepad, PureVPN, Rize, Syncovery, and Zettlr for
macOS.
- Updated Zettlr for Windows to version 4.7.0.
- Refreshed download links and verification checksums for applicable
installers.
- Updated installed-version detection so devices correctly recognize the
latest releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated macOS and Windows installation metadata for Kiro, including
version 1.0.228 installers and checksums.
* Updated macOS installation metadata for Notepad to version 1.5.8.
* Updated Firefox Nightly macOS installer metadata to a newer build.
* **Bug Fixes**
* Improved uninstall cleanup for Antigravity IDE, DevKnife, Dot,
IsThereNet, Jellyfin, QLMarkdown, and RetroArch by correcting cleanup
targets and Trash handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
Switches the dogfood "Collect Windows 11 hardware readiness" report from
`logging: differential` to `logging: snapshot`, so each run reports the
full current state of every host rather than only rows that changed
since the last run.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated Windows 11 hardware readiness reports to use snapshot logging,
ensuring each report captures a complete current-state view.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated the Franz macOS app to version 6.5.2.
* Updated the Ollama Windows app to version 0.32.4.
* Refreshed download links and verification checksums for both
applications.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added the latest available releases for numerous maintained apps
across macOS and Windows, including ClickUp, OBS Studio, WeChat, Ollama,
Arc, GoLand, and others.
* Updated download packages and verification data so installations use
the correct release artifacts.
* **Bug Fixes**
* Improved upgrade detection for updated app versions.
* Refined cleanup behavior for CapCut and Pastebot during
uninstallation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** N/A
## Summary
Adds a new osquery report to Fleet's own dogfood GitOps config
(`it-and-security/`) that recreates the Microsoft Endpoint Analytics
Windows 11 hardware readiness check directly via osquery, instead of
relying on Intune's Graph summary.
- New file:
`it-and-security/lib/windows/reports/collect-windows-11-hardware-readiness.yml`
- Registered under the global `reports:` list in
`it-and-security/default.yml`, so it applies across all fleets (not
scoped to a single team)
- Scoped to `platform: windows` only, since `tpm_info`, `secureboot`,
and `logical_drives` are Windows-only osquery tables
The report evaluates per-host pass/fail against Microsoft's minimum
requirements: 64-bit CPU, 2+ cores, 1GHz+ clock speed, 4GB+ RAM, 64GB+
storage, TPM 2.0 enabled, and Secure Boot enabled, plus an overall
`win11_hardware_baseline` ready/not-ready column.
## Known gaps (carried over from the source query)
- No osquery equivalent for Microsoft's approved-CPU-family allowlist
check — `cpu_model` is surfaced for manual cross-reference instead.
- `secure_boot` / `tpm_enabled` reflect current firmware state, not
hardware capability — a host with TPM disabled in firmware or running
legacy BIOS will fail even though it may be fixable without new
hardware.
- If `boot_partition` doesn't populate reliably on some hosts, the disk
subquery may need a fallback to `WHERE device_id = 'C:'`.
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually (validated YAML parses
correctly and the query text round-trips unchanged; will be exercised
for real by the dogfood-gitops workflow on merge)
## New Fleet configuration settings
- [x] Setting(s) is/are explicitly excluded from GitOps (N/A — this is a
GitOps config change itself, not a new server setting)
**Related issue:** N/A — part of the ongoing Windows Fleet-maintained
apps (FMA) parity workstream (letter I).
## What this does
Adds **17** Windows Fleet-maintained apps for the letter-I batch.
apps.json descriptions follow the house `"<Name> is a …"` convention.
**IBM Semeru Runtime Open Edition (Java) — 8 apps** (MSI, machine, x64):
JDK 8/11/17/21 and JRE 8/11/17/21. Per-major detection follows the
Eclipse Temurin pattern — `name LIKE 'IBM Semeru Runtime Open Edition
(JDK|JRE)%' AND publisher = 'Semeru' AND version LIKE '<major>.%'` — so
majors and JDK/JRE never cross-match. All 8 share the IBM Semeru logo.
**Other apps (9):**
- **IronPython 3** — MSI; fuzzy `IronPython 3%` (excludes the EOL v2)
- **ImageGlass** — dual-scope MSI, custom `ALLUSERS=1` install
- **install4j** — install4j installer (bundled JRE), `-q`
- **IrfanView** — custom installer `/silent /allusers=1`; versioned+arch
name → fuzzy `IrfanView%`
- **iMazing HEIC Converter**, **IsoBuster**, **ImpExpPro** — Inno Setup
(`/VERYSILENT`)
- **Infix PDF Editor** — Inno, x86
- **Ibis Calculeren voor Bouw** — InstallShield wrapper; uninstall via
the MSI UpgradeCode (`uninstall_type: msi`)
## Dropped from this batch (recorded in the workstream tracker)
- **IBM Aspera Connect** — MSI installs per-user by default
(`ALLUSERS=2`/`MSIINSTALLPERUSER=1`, no machine switch in the manifest)
+ a rolling `/latest/` URL that 404s on the next release.
- **IcedTea-Web** (Azul and AdoptOpenJDK) — both declare a hard,
unbundled JRE dependency; it's a JNLP launcher that's dead-on-arrival
without Java the FMA won't install (AdoptOpenJDK variant is also
archived).
- **IronPython 2** — EOL (Python 2). **install4j 9** — legacy 2022
build. **IrfanView PlugIns** — add-on that drops DLLs with no
independent ARP entry (undetectable) and depends on the base app.
- **Intermedia Unite** and its **Teams Desktop Plugin** — both use
non-versioned "latest" URLs (winget-bot auto-updated; the pinned SHA
rots each release); the plugin also depends on Teams + Unite.
## Notes
- **Ibis Calculeren voor Bouw**, **ImpExpPro**, and **Infix PDF Editor**
ship without a catalog icon — no clean ≥256px first-party logo exists
for these niche apps (they fall back to the generic icon).
- **Ibis** carries some risk: its DisplayName couldn't be verified
offline (compressed InstallShield payload) and its installer URL is
non-versioned — flagging for the validator; will drop if
detection/version fails.
- **IsoBuster** uses a non-versioned URL that currently matches the
pinned 5.8, so no `ignore_hash`; winget re-ingestion tracks future
drift.
- Verification (installer type/scope/arch, ProductCode/UpgradeCode,
dependencies, silent switches, URL stability, en-US locale) was done per
the `new-fma` skill against the winget-pkgs manifests, with several
DisplayNames confirmed via `innoextract`/`msitools`.
## Testing
- [ ] FMA CI validator (install → detect → uninstall) on the
SYSTEM-context Windows runner — pending.
- Generated outputs verified locally: all 17 produce valid manifests;
per-major Semeru queries and MSI UpgradeCode uninstalls confirmed; all
apps.json descriptions present and convention-compliant.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated managed app installers and metadata to the latest available
versions for AWS CLI, Brave Browser, ChatGPT, Fellow, Granola, Microsoft
Edge, OpenCode Desktop, and Visual Studio Code.
* Refreshed download links and integrity checksums to match the new
installer packages.
* Updated version detection to recognize the latest releases across
Windows and macOS.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Closes: https://github.com/fleetdm/fleet/issues/49885
Changes:
- Replaced the icon shown when hovering over headings on pages built
from Markdown.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated heading link hover icons across article and legal pages to use
the green link icon for improved visual consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/47653
Changes:
- Updated the contact page to only display the "Talk to us" form if a
user visits it with a `?talkToUs` query string.
- Updated all "Get a demo" buttons to go to `/contact?talkToUs`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a dedicated “Talk to us” contact experience.
* Updated “Get a demo,” “Talk to sales,” and “Talk to an engineer” links
across the site to open the appropriate contact form directly.
* **Bug Fixes**
* Improved contact form selection so the requested form displays
consistently across supported pages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Updated the delete-android-device, get-android-device,
issue-command-on-android-device, and modify-android-device actions to
return a `deviceNotFound` response to Fleet servers when the Android
management API returns a 404 response.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved Android device management error handling.
- Device deletion, retrieval, command issuance, and modification now
clearly report when the requested device cannot be found.
- Prevents missing devices from being reported as generic errors.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#49805, Resolves#48719
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
---
## Context
A customer (~2,500 hosts, v4.89.1) had their DB writer slammed with
`DELETE FROM host_software_installed_paths` statements carrying 30,000+
IDs each. These never completed, required repeated manual intervention,
and the table grew from 14.5M to 14.8M rows in 2 days. This is #49805.
While investigating, Victor linked #48719, a related `software_titles`
INSERT lock convoy issue seen in load tests. Both are in the same
software ingestion code path (`server/datastore/mysql/software.go`), so
this PR fixes both.
## Root cause
### #49805: Unbatched DELETEs on `host_software_installed_paths`
When a host's software changes, Fleet computes a delta and deletes stale
rows from `host_software_installed_paths`. The function
`deleteHostSoftwareInstalledPaths()` issued a **single** `DELETE FROM
host_software_installed_paths WHERE id IN (?)` with all IDs expanded by
`sqlx.In()`. With 30,000+ IDs and 14.8M rows in the table, these massive
statements held row locks for minutes, timed out, and never completed.
On the next agent check-in, the same (or larger) DELETE was retried,
creating a feedback loop where the table grew unboundedly.
Notably, the INSERT function for the same table
(`insertHostSoftwareInstalledPaths`) already batched at 500 rows. The
DELETE simply lacked the same treatment.
### #48719: INSERT IGNORE lock convoys on `software_titles` (related)
When a host reports software that Fleet hasn't seen before,
`preInsertSoftwareInventory()` runs `INSERT IGNORE INTO software_titles
(...)` inside a `withRetryTxx` transaction. For homogeneous fleets (many
hosts sharing the same software catalog, typical for imaged corporate
Windows machines), hundreds of concurrent goroutines try to INSERT
IGNORE the same title rows simultaneously.
Even though `INSERT IGNORE` is a no-op when the row already exists,
InnoDB still acquires row/gap locks on the unique index for the duration
of the enclosing transaction. With many goroutines holding or waiting on
the same index locks, the DB enters a "lock convoy" where sessions
serialize on locks they don't actually need. In load tests (40 Fleet
instances, 100K hosts, 141 identical Windows software items), this
produced 690 average active sessions on the writer and 85s fleet-wide
p99.
The existing read-first check
(`getIncomingSoftwareChecksumsToExistingTitles`) prevents the convoy at
steady state. But on cold start (empty `software_titles`, e.g. after
cleanup purges orphaned titles), the check finds nothing and all
goroutines race to INSERT the same titles.
## How I reproduced it
Started MySQL via `docker compose up -d mysql_test`, created a git
worktree.
### #49805
`TestHostSoftwareInstalledPathsDeleteExplosion`: Created a host with 500
software items and installed paths, then replaced all software with an
entirely new set. This triggers `deleteHostSoftwareInstalledPaths()`
with all 500 old IDs in a single unbatched DELETE statement. At 500 IDs
the local test completes quickly, but the structure confirms the
problem: at 30K+ IDs on production Aurora with 14M rows, these never
finish.
### #48719
`TestSoftwareTitlesInsertIgnoreLockConvoy`: Created 50 hosts, each
reporting 100 identical software items (simulating a homogeneous fleet).
Used a barrier to release all 50 goroutines simultaneously, then
measured two phases:
1. **Cold start** (empty `software_titles`): All 50 hosts concurrently
call `ds.UpdateHostSoftware()`.
2. **Steady state** (titles exist): Same 50 hosts re-ingest.
**Before fix:**
| Metric | Cold start | Steady state |
|--------|-----------|-------------|
| Wall time | 3.0s | 38ms |
| Avg per-host | 1,981ms | 29ms |
| **Convoy factor** | **79x** | |
The 79x slowdown confirms the lock convoy.
## How I fixed it
### #49805: Batch the DELETE at 500
Changed `deleteHostSoftwareInstalledPaths()` from a single `DELETE ...
WHERE id IN (all IDs)` to a loop that processes 500 IDs per batch,
matching the existing INSERT batching pattern in the same file.
### #48719: Three-layer defense against lock convoys
**Layer 1 - Move title INSERT IGNORE outside the transaction.**
Previously, `INSERT IGNORE INTO software_titles` ran inside
`withRetryTxx`, so locks were held for the full transaction duration.
Now each title INSERT is executed via `ds.writer(ctx).ExecContext()`
outside any transaction, auto-committing independently and holding locks
for microseconds.
**Layer 2 - singleflight per title key.** Added a `singleflight.Group`
on the `Datastore` struct. For each title, only one goroutine actually
executes the INSERT; concurrent goroutines wait and share the result.
**Layer 3 - In-process cache (`sync.Map`).** After a title is inserted,
its key is stored in `knownSoftwareTitleKeys`. Subsequent ingestions
check the cache first and skip the INSERT entirely.
`CleanupSoftwareTitles` clears the cache when it deletes orphaned
titles.
The three layers work together: the cache handles the common case (title
already known), singleflight handles the cold-start race (only one
INSERT per title), and auto-commit ensures even the winning INSERT holds
locks for microseconds.
## How I tested that it works
### New reproduction tests
- `TestSoftwareTitlesInsertIgnoreLockConvoy`: 50 concurrent hosts, 100
identical software items. Measures cold-start convoy factor and verifies
all 100 titles are created.
- `TestHostSoftwareInstalledPathsDeleteExplosion`: Full software
replacement path with 500 items per host, including concurrent hosts.
### Existing test suite
Ran all existing software tests including:
- `UpdateHostSoftware`, `UpdateHostSoftwareDeadlock`,
`PreInsertSoftwareInventory`
- `SoftwareTitleUpgradeCodeDriftMatch`,
`UpdateHostSoftwareSameBundleIDDifferentNames`
- `CleanupSoftwareTitles` (validates cache invalidation works correctly)
- `SaveHost`, `SyncHostsSoftware`, and ~80 other subtests
All pass.
### After-fix measurements
| Metric | Before fix | After fix |
|--------|-----------|-----------|
| Cold-start wall (50 hosts) | ~3.0s | ~1.4s |
| Cold-start avg per-host | ~1,981ms | ~594ms |
| Steady-state wall | ~38ms | ~7ms |
| Titles created correctly | 100/100 | 100/100 |
The remaining cold-start time is from other pipeline operations (`INSERT
IGNORE INTO software`, host_software linking), not from
`software_titles`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Performance Improvements**
- Improved software inventory ingestion under large, concurrent
workloads, including more efficient handling of repeated software-title
inserts.
- Reduced lock contention when many devices report the same titles at
the same time.
- Batched deletions of installed software-path records to speed up large
updates.
- **Bug Fixes**
- Ensured deterministic, collation-safe software-title deduplication to
prevent incorrect or stale title mapping.
- Strengthened orphan cleanup behavior so caches are cleared when orphan
titles are removed.
- **Tests**
- Added stress/regression tests for software-title insert contention and
large installed-path delete workloads.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Chef Workstation for Windows to version 25.14.2.1.
* Updated Firefox Nightly for Windows to build 155.2607.2409.0.
* Updated Prisma Access Browser for Windows to version 150.49.8.187.
* Refreshed installer download links and verification checksums for each
application.
* Updated version detection so the latest releases are correctly
recognized as installed and current.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46242
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a convenient redirect from the device and user scope information
link to the relevant Custom OS Settings guide section.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated LibreOffice’s Windows download source for version 26.2.4.2.
* Updated Miro to version 0.11.164.
* Updated Mullvad Browser to version 15.0.19.
* Updated Proxyman to version 6.14.0, including improved removal
cleanup.
* Updated Reqable to version 3.2.14.
* Updated Vivaldi to version 8.1.4087.58.
* Refreshed installer links, checksums, and version detection for each
updated application.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved SQL generation for certain migration updates to avoid a
self-referencing subquery issue.
* Updated the generated query flow to select the target row first, then
apply the update more reliably.
* Aligned the version lookup query formatting with the revised condition
handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45524
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
No changes file as this is purely workflow/release changes
## Testing
Will be testing this on github as that's the only way and since this
requires testing with a tagged build I'll have to merge to main, tag,
then manually trigger
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Introduced an automated macOS Fleet Desktop release workflow for
version-tagged releases.
* Publishes the installer plus accompanying `meta.json` download
metadata, including SHA256 checksums.
* **Bug Fixes**
* Added stronger pre-release validation (tag/version match and immutable
release enforcement).
* Verifies the downloaded package and metadata against the expected
SHA256 to ensure the published artifacts are consistent.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
## Issue
Closes#47290
Also implements the "Cap free-text `maxLength` to the backend column
length" pattern established in [#49041 (patterns.md
thread)](https://github.com/fleetdm/fleet/pull/49041/files#r3572648691).
## Description
Fleet name inputs had no `maxLength` cap and no service-layer length
check, so a name >255 chars failed with a raw MySQL `Data too long`
error, and several UI surfaces didn't handle long names gracefully. This
PR fixes all four manifestations called out in the bug, plus a related
label-overflow case on the host details page, and hardens adjacent name
inputs across the app.
**Frontend fixes for #47290:**
- Create/Rename fleet name inputs now cap at 255 characters (matches
`teams.name varchar(255)`).
- Fleets table Name column uses `LinkCell` with `tooltipTruncate` +
`className="w400"` so long names truncate with an ellipsis and full-name
tooltip instead of overflowing across the Hosts/Users columns.
- Fleet-detail page header (`.team-details__team-header`): h1 gets
`overflow: hidden; text-overflow: ellipsis; white-space: nowrap;`,
`__team-details` gets `min-width: 0; flex: 1`, and `.action-buttons`
gets `flex-shrink: 0` + `white-space: nowrap` on buttons so *Manage
enroll secrets / Rename / Delete* no longer wrap to a second line when
the fleet name is long.
- Manage enroll secrets modal body — `__description` gets
`overflow-wrap: anywhere; min-width: 0` so a long `<b>{fleet name}</b>`
wraps within the modal instead of spilling out the right edge.
**Backend fixes for #47290:**
- New `fleet.MaxTeamNameLength = 255` constant.
- `NewTeam`, `ModifyTeam`, and `ApplyTeamSpecs` now return
`fleet.NewInvalidArgumentError("name", "may not exceed 255 characters")`
instead of surfacing a raw `Data too long` MySQL error. Covers UI, API,
and GitOps entry points.
**Broader consistency pass (per [#49041
thread](https://github.com/fleetdm/fleet/pull/49041/files#r3572648691)):**
- New shared `MAX_ENTITY_CHAR_LENGTH = 255` constant in
`frontend/utilities/constants.tsx`.
- Refactored 8 existing files that had ad-hoc `NAME_MAX_LENGTH = 255` /
`MAX_LABEL_NAME_LENGTH = 255` locals to use it.
- Slotted it into 16 additional `InputField` name/description inputs
that were missing a cap (API user, custom variable, certificate, label
name + description, pack name + description, and all 5 CA forms —
CustomEST, CustomSCEP, Smallstep, Digicert, Hydrant).
- Pruned dead FE length validators that can no longer fire now that the
DOM cap enforces the limit (certificate modal, custom variable modal,
both label helpers, both category modals). Unusual/shorter caps (e.g.
`varchar(64)`, custom business rules) still keep their inline validators
— silent truncation is only appropriate for the common 255-char norm.
**Bonus:** fixed the long-label overflow on the host details Labels card
by capping the pill button `max-width` at 300px.
## Screenrecording
https://github.com/user-attachments/assets/b917b72e-7437-4d0c-a1a1-c49b4b1c28bahttps://github.com/user-attachments/assets/3a3efbb2-09d8-4f47-9fd4-f158b3453b9ehttps://github.com/user-attachments/assets/73e5e022-dc93-4381-82b3-be9549d050e6
Latest - max width 300px long label:
<img width="1106" height="262" alt="Screenshot 2026-07-23 at 11 29
24 AM"
src="https://github.com/user-attachments/assets/741fddbd-f78d-4578-a025-bddf64a81c25"
/>
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Test coverage:
- `CreateFleetModal.tests.tsx`, `RenameFleetModal.tests.tsx` — new case
per file asserting the name input's `maxLength === 255`.
- `AddCertificateModal.tests.tsx`, `Variables.tests.tsx` — the existing
"shows too-long error when pasting 256 chars" tests are now unreachable
via the DOM cap; converted to `maxLength === 255` assertions.
- `ee/server/service/teams_test.go` — `TestNewTeamNameValidation`,
`TestModifyTeamNameValidation`, and `TestApplyTeamSpecsNameValidation`
each get two new cases (accepts at the limit, rejects one over with the
expected error message).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Limited fleet, team, and other user-entered names and descriptions to
255 characters.
* Replaced database errors for oversized names with clear validation
messages.
* Prevented long fleet and label names from overflowing tables, headers,
modals, and host details.
* Improved modal and dropdown layouts for long text.
* **Tests**
* Added coverage for character limits, boundary values, and multibyte
names.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated the Firefox Nightly macOS installer to the latest build and
refreshed its verification details.
* Updated the LibreOffice macOS installer to version 26.2.5, including
its download link and verification details.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Replaces a dead link for the conditional access table entry on the
pricing page
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the “Conditional access” feature link to point to the current
guide.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
VerifyEnrollSecret matched by exact string, so an empty enroll_secret
matched any stored empty secret and issued a valid node key. Guard the
shared chokepoint: reject empty/whitespace secrets before matching,
closing all enrollment paths (osquery, Orbit, Apple MDM, Android). Add a
migration to delete pre-existing empty secrets.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves unreleased bug with Fleet dropdown not
working
https://github.com/user-attachments/assets/6460efe2-2181-48bc-9ca0-67f64241a3e9
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. Unreleased
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved fleet selection behavior so dropdown interactions work
reliably without overriding built-in menu handling.
* Selecting a fleet now correctly updates the displayed fleet and closes
the dropdown menu.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Refreshed maintained application releases across Windows and macOS,
including BrowserStackLocal, Bruno, Canva, ChatGPT, Claude, CLion,
Cursor, Draw.io, Dropbox, GOG GALAXY, GoLand, Google Chrome, Kitty,
Downie, and Splice.
- Updated installer download links and integrity checksums where
applicable.
- Improved release detection so systems recognize the latest versions
and apply updates correctly.
- Updated Dropbox’s uninstall handling for its new installer release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves: N/A
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected `software_title_id` filtering for hosts so software title
details are strictly scoped to the current team and never backfill
mismatched or out-of-scope data.
* Removed unintended debug output and ensured software title details
remain unset when the title isn’t accessible.
* **Tests**
* Added an enterprise integration test verifying cross-team
`software_title_id` behavior.
* Updated existing integration expectations for team-scoped visibility.
* Added datastore coverage for team-scoped software title name lookup
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48914
## Description
The success toast shown after editing fleet assignments for an Apple
Business Manager (ABM) organization read:
> Successfully updated fleets for AB token.
The trailing "AB token" made the message unclear. It now names the
organization instead, matching the modal's title:
> Successfully updated fleets for `<org name>`.
The organization name (`token.org_name`) was already available in the
component (it's used as the modal title), so this is a copy-only change
with no new data plumbing.
Note: the issue's expected behavior left the exact wording to Product
("TODO — Product to decide"). This implements Product's written
suggestion (`Successfully updated fleets for {org name}`) so the awkward
wording isn't blocking; the string is trivial to adjust if
Product/design prefer different phrasing in review.
## Testing
- Manually QA'd in the UI: with a configured ABM organization, edited a
fleet assignment and confirmed the toast now shows the org name.
- Existing unit tests for the modal's helpers (`getOptions`,
`getSelectedTeamIds`) still pass; no test asserts the toast string.
- `eslint` and `prettier` pass on the changed file (added
`token.org_name` to the `useCallback` dependency array to satisfy
`react-hooks/exhaustive-deps`).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the success notification shown after fleet teams are saved to
include the associated organization name.
* Ensured the notification always reflects the currently selected
organization.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47535
## Description
`DeleteMDMAppleDeclaration` re-ran the upload-time validator
(`ValidateUserProvided`) on the delete path. That validator enforces
*upload-admission* rules — forbidden declaration types
(`ForbiddenDeclTypes`) and the `AllowAllDeclarations` config flag — so
any declaration that was accepted at upload time became **undeletable**
through the API once the accepted set later shrank. Two ways this
happens in practice:
- A server config flag that had been enabled at upload time is later
disabled (the original customer report, prod 4.86.1).
- A declaration type is added to `ForbiddenDeclTypes` in a later
release, after declarations of that type were already uploaded.
In both cases the UI showed "Couldn't delete. Please try again." and the
API returned `400` with an upload-validation message on a *delete*
request.
Whether a declaration is Fleet-managed (and therefore protected from
deletion through this endpoint) is already determined by the Fleet
reserved-name check that runs immediately above the offending block.
This PR removes the upload-time validation from the delete path and
relies solely on that reserved-name check, so:
- A user can delete any declaration they previously uploaded, regardless
of whether the current validator config would still accept it on upload.
- Fleet-managed declarations (reserved names) remain protected from
deletion.
The `AllowAllDeclarations` flag and `ValidateUserProvided` are unchanged
on the **add/upload** path — admission control still happens where it
belongs.
## Testing
Extended `TestMDMConfigProfileCRUD` (replacing the pre-existing `//
TODO: Add tests for create/delete forbidden declaration types?`) with
two cases:
- A declaration whose type is in `ForbiddenDeclTypes` can be deleted
(regression guard — fails before this change, passes after).
- A declaration with a Fleet-reserved name remains protected from
deletion (guards the reserved-name check that is now the sole
Fleet-managed gate — a boundary that was previously untested).
Manually verified end-to-end in the UI: reproduced the stuck declaration
(upload a forbidden type with `FLEET_MDM_ALLOW_ALL_DECLARATIONS=true`,
restart without the flag), confirmed the pre-fix `400`, then confirmed
deletion succeeds after the fix with the flag off.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Apple MDM declaration deletion to avoid re-running
upload-time validation during the delete flow.
* Declaration deletion checks now rely on Fleet management status and
reserved naming, preserving protection for Fleet-managed declarations.
* Added/adjusted deletion behavior for restricted and Fleet-reserved
declaration types.
* **Tests**
* Added regression coverage for Apple declaration profile deletion via
the configuration profile delete endpoint, including strict-mode
scenarios and cleanup behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated macOS and Windows release metadata for Insomnia to version
13.1.0.
* Updated macOS releases for Kiro (1.0.212), Melodics (5.0.871),
Microsoft Edge (150.0.4078.96), and Wispr Flow (1.6.224).
* Updated Firefox Nightly’s minimum eligible patched build.
* **Bug Fixes**
* Updated installer download links and checksums to match the latest
application releases, improving installation and update reliability
across supported platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the maintained Kiro for Windows package to version 1.0.212.
* Refreshed the installer reference and verification details for the new
release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated AWS CLI for Windows to version 2.36.7.
- Updated BetterTouchTool for macOS to version 6.663.
- Updated Box Drive for macOS to version 2.53.219.
- Updated Google Chrome for Windows to version 150.0.7871.187.
- Updated Telegram Desktop’s download source for version 7.0.5.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated maintained app installers to the latest versions for Beeper,
ChatGPT, FreeCAD, Kiro CLI, Ollama, Pastebot2, Remote Desktop Manager,
Superhuman, and Thunderbird.
* Refreshed download links, compatibility checks, and verification data
for each update.
* Improved Ollama and Pastebot2 macOS uninstall cleanup behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added frozen status to Pritunl package configurations, preventing
automatic version changes.
* **Updates**
* Refreshed maintained application packages across Windows and macOS,
including Firefox, Bitwarden, Postman, Arc, Granola, PhpStorm, WebStorm,
Bruno, and others.
* Updated download links and integrity checks to match the latest
available installers.
* Improved version detection so upgrades are recognized correctly for
each refreshed release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added/updated managed release definitions for many applications on
both macOS and Windows.
* Updated the Mozilla VPN installer script to better handle MSI installs
in automation.
* Marked Typora for frozen behavior in winget to prevent unintended
updates.
* **Bug Fixes**
* Refreshed download links and integrity checksums across updated app
versions.
* Improved version detection for newly released builds.
* **Improvements**
* Enhanced uninstall behavior for select apps (additional
cleanup/services and improved media handling for ONLYOFFICE macOS).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49705
Verified fix with 100k host Windows load test.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Improved host certificate deduplication and automated self-healing
when duplicate certificate records are ingested.
* Updated source reconciliation to only change what’s stale, preventing
unnecessary rewrites of unchanged source entries.
* Ensured certificate sources consistently associate to the newest
canonical certificate record for each certificate hash.
* Improved certificate listing accuracy by returning a deduplicated set
of certificate/source pairs with correct usernames.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- @noahtalerman: Noah: Met w/ Product Designers + Luke and we realized
that "fast draft" v. "full draft" is confusing...the only difference, in
practice, between fast and full draft is that fast skips user story
review + T-shirt size.
- So, we think the best improvement (instead of the above) is actually
to remove the separate "fast" v. "full" swim lanes to simplify the
process.
- Instead it's up to Product Designer to decide, during drafting, if we
do user story review + T-shirt size.
- @noahtalerman: Also, bring back the user story review ritual as it's
own call
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A
Bumps `websocket-driver` to `0.7.5`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated a package resolution override for improved dependency
compatibility.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49750
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. (Already a part of something else, this is just
further solidifying the current behaviour)
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added coverage to verify the command sequence during Apple device
enrollment.
* Ensures the fleet management agent installation happens first,
followed by the bootstrap package, and then configuration profile and
management commands.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves
https://fleetdm.slack.com/archives/C02A8BRABB5/p1784765147322239?thread_ts=1784727509.435919&cid=C02A8BRABB5https://github.com/user-attachments/assets/e6bdeeb9-9ec3-4ba6-9669-6ea18ec8362d
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a danger variant for checkboxes, with red styling for default,
hover, and active states.
* Updated release and wipe confirmation checkboxes to clearly indicate
destructive actions.
* Added Storybook controls for checkbox values and variants.
* **Bug Fixes**
* Standardized checkbox values to use boolean states only.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48340
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enabled enhanced database performance monitoring for load-testing
environments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48340
Windows only. The fix is to use a rollup status table instead of
recalculating the host profile summary on demand.
Verified the fix in load test with 100k Windows MDM hosts. Note that
this does not improve the host details page filtered by OS settings,
which will be handled by the follow up
https://github.com/fleetdm/fleet/issues/48996
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Windows fleet configuration profile status summaries to avoid
timeouts on large fleets.
* Kept per-host Windows profile statuses accurate after profile updates,
resends, certificate changes, cleanup, unenrollment, and host deletion.
* Added automatic reconciliation to correct stale or orphaned status
data.
* **Data Integrity**
* Improved Windows profile status reporting, including profile and
BitLocker summaries, for more reliable results.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#49682
Mozilla Firefox and Firefox ESR are distinct Fleet-maintained apps that
share the macOS bundle identifier `org.mozilla.firefox`, so they resolve
to one software title. Adding both to a fleet previously gave a generic
conflict error (or no error at all). This adds a clear message — "Only
one of Mozilla Firefox or Mozilla Firefox ESR can be added to the same
fleet." — on both the single-add and GitOps/batch paths. The check is
general (any two FMAs sharing a bundle identifier), with the app names
filled in dynamically.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Prevented adding both Mozilla Firefox and Firefox ESR to the same
fleet when they share a bundle identifier.
- Updated the UI to show a specific conflict message explaining that
only one of the two can be added.
- Ensured existing workflows still work for adding new versions of the
already-selected app.
- **Tests**
- Added backend and frontend test coverage for the new conflict
detection and error-message formatting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
