Adds Tor Browser as a Fleet-maintained app for macOS only.
## Changes
- **macOS**: Homebrew cask `tor-browser`, DMG installer, bundle
identifier `org.torproject.torbrowser`
- Icon sourced from the official Tor Project GitHub at 128x128
- Added to `apps.json` catalog in alphabetical order
**Note:** Windows support was dropped. Tor Browser for Windows uses a
portable installer that installs to `%LOCALAPPDATA%` (not `C:\Program
Files`), which is outside the scope of what Fleet's CI validator and
Windows install validation can detect. macOS-only is the correct scope
for this app.
## Test plan
- [ ] Verify `go run cmd/maintained-apps/main.go
--slug="tor-browser/darwin"` produces valid output
- [ ] Confirm icon renders correctly in the software catalog UI
- [ ] Confirm macOS install/uninstall scripts work on a test device
## Summary
Adds [Charles Proxy](https://www.charlesproxy.com/) as a
Fleet-maintained app for macOS.
Charles is an HTTP proxy, monitor, and reverse proxy that lets
developers view all HTTP and HTTPS traffic between their machine and the
internet. It's commonly used for debugging, testing, and network
analysis.
- macOS: DMG installer via Homebrew cask `charles`, bundle ID
`com.xk72.Charles`
- Windows: Not included — the WinGet package (`XK72.Charles`) uses an
`appx` installer type, which is not supported by Fleet's winget ingester
## Test plan
- [ ] Install Charles on a macOS host via Fleet self-service and confirm
it installs to `/Applications/Charles.app`
- [ ] Confirm `SELECT 1 FROM apps WHERE bundle_identifier =
'com.xk72.Charles';` returns a result after installation
- [ ] Uninstall Charles via Fleet and confirm the app is removed
- [ ] Confirm the Charles icon appears correctly in the Fleet UI
software catalog
- [ ] Run `go run cmd/maintained-apps/main.go --slug="charles/darwin"
--debug` and confirm no errors
Adds Krita (free and open-source digital painting application) as a
Fleet Maintained App for macOS and Windows.
## Changes
- **macOS**: Homebrew cask `krita`, DMG installer, bundle ID
`org.kde.krita`
- **Windows**: WinGet `KDE.Krita`, NSIS EXE installer with custom silent
install/uninstall scripts
- Icon generated from KDE official icon (128x128 PNG), added to icon
index
- Both platforms added to `apps.json` alphabetically (after Keka, before
LastPass)
## Testing
- macOS ingester ran successfully: `go run cmd/maintained-apps/main.go
--slug="krita/darwin" --debug`
- Windows ingester ran successfully: `go run cmd/maintained-apps/main.go
--slug="krita/windows" --debug`
- Output files generated: `ee/maintained-apps/outputs/krita/darwin.json`
and `windows.json`
## Related issue
Add Krita FMA
## Summary
- Adds Arduino IDE (macOS only) as a Fleet maintained app using Homebrew
cask `arduino-ide`
- Bundle identifier: `cc.arduino.IDE2`, installer format: DMG, version
2.3.8
- Includes app icon, install/uninstall scripts, catalog entry, and icon
component
## Test plan
- [ ] Install Arduino IDE via Fleet on a macOS device and verify it
launches
- [ ] Uninstall Arduino IDE via Fleet and verify the app and user data
are removed
- [ ] Verify the Arduino IDE icon renders correctly in the software
catalog UI
- [ ] Confirm the entry appears alphabetically in the software catalog
(after Archaeology, before Asana)
Relates to #
Resloves: #41820
## Summary
- Adds `1.5rem` vertical margin to the GitOps mode info banner on the
**Software > Add Software > Custom Packages** page
- Uses an instance-level `className` prop
(`software-custom-package__gitops-banner`) and a page-scoped SCSS rule,
following existing codebase patterns for instance-specific spacing
- Does **not** modify the shared `InfoBanner` component styles
## Changes
-
`frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareCustomPackage/SoftwareCustomPackage.tsx`
— Added `className` prop to the GitOps `InfoBanner` instance
-
`frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareCustomPackage/_styles.scss`
— Added `&__gitops-banner` rule with `margin: 1.5rem 0`
---
Built for [Marko
Lisica](https://fleetdm.slack.com/archives/D0AFA3M07AP/p1773750050662559?thread_ts=1773749619.263099&cid=D0AFA3M07AP)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: RachelElysia <rachel@fleetdm.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41742
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed crashes on the "My device" page for Fleet Free instances when a
host is assigned to a team.
* Improved error handling to prevent application crashes when policy
data is unavailable.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#40138
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Installed:
```
go install golang.org/x/tools/cmd/goimports@latest
go install golang.org/x/tools/gopls@latest
go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
```
Validated:
```
osquery> SELECT * FROM go_packages;
+---------------+---------+-----------------------------------+-----------------------------------------------------+------------+----------------------------------+
| name | version | module_path | import_path | go_version | installed_path |
+---------------+---------+-----------------------------------+-----------------------------------------------------+------------+----------------------------------+
| goimports | v0.42.0 | golang.org/x/tools | golang.org/x/tools/cmd/goimports | go1.25.5 | /Users/josh/go/bin/goimports |
| golangci-lint | v1.64.8 | github.com/golangci/golangci-lint | github.com/golangci/golangci-lint/cmd/golangci-lint | go1.25.5 | /Users/josh/go/bin/golangci-lint |
| gopls | v0.21.1 | golang.org/x/tools/gopls | golang.org/x/tools/gopls | go1.25.5 | /Users/josh/go/bin/gopls |
+---------------+---------+-----------------------------------+-----------------------------------------------------+------------+----------------------------------+
```
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41652
Solution is to not pass `labels_include_any` to the payload of the PATCH
endpoint request.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
https://github.com/user-attachments/assets/7c825b92-0b03-448a-8e42-83e39a2acdf6
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41532
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved error messaging when deleting a certificate authority that is
referenced by certificate templates. Users now receive a clear,
user-friendly message instead of a generic database error.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#33714
Added alias `GET /api/v1/fleet/scripts/batch/abc-def/host_results` for
`GET /api/v1/fleet/scripts/batch/abc-def/host-results` for consistency
sake.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
This PR contains identical frontend changes to those currently in
`recovery-pw-feature` - this allows separate frontend review of the code
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41653
<img width="810" height="597" alt="Screenshot 2026-03-13 at 8 44 23 AM"
src="https://github.com/user-attachments/assets/b5e7feff-e576-4c0d-a9ee-b2ef1a17a7ea"
/>
- [x] Changes file added for user-visible changes in `changes/`
- [x] QA'd all new/changed functionality manually
Deletes a code file that's not referenced by anything and keeps causing
me merge conflicts.
JS linter and tests pass without it, which tells you everything you need
to know 🔪
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41391
# Details
This PR updates front-end API calls to use new URLs and API params, so
that the front end doesn't cause deprecation warnings to appear on the
server.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, should not be user-visible
## Testing
- [X] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
The biggest risk here is not that we missed a spot that still causes a
deprecation warning, but that we might inadvertently make a change that
breaks the front end, for instance by sending `fleet_id` to a function
that drops it silently and thus sends no ID to the server. Fortunately
we use TypeScript in virtually every place affected by these changes, so
the code would not compile if there were mismatches between the API
expectation and what we're sending. Still, spot checking as many places
as possible both for deprecation-warning leaks and loss of functionality
is important.
## Summary by CodeRabbit
* **Refactor**
* Updated API nomenclature across the application to use "fleets"
instead of "teams" and "reports" instead of "queries" in endpoint paths
and request/response payloads.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40538
This is the initial iteration of CSP functionality, currently gated
behind FLEET_SERVER_ENABLE_CSP. If disabled, no CSP is served. Nonces
are still injected into pages however a dummy nonce is used and has no
effect.
With this setting turned on things break and will be addressed by mainly
frontend changes in https://github.com/fleetdm/fleet/issues/41577
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
---------
Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
## Issue
Closes#39983
## Description
This is so long because installation details are within 3 modals and so
all 3 had to be updated:
- SoftwareInstallDetailsModal
- Updated variables and naming for readability
- Added icons to tests
- `shouldShowInventoryVersions` will show if
`overrideFailedMessageWithInstalledMessage` (bug fix)
- SoftwareIpaInstallDetailsModal
- Updated variables and naming for readability
- Added icons to tests
- Use reusable component `IconStatusMessage`
- Added pre-4.57 "pending" case just in case to match VPP
- Override icon to success icon if
`overrideFailedMessageWithInstalledMessage || isInstalledManual` (bug
fix)
- `shouldShowInventoryVersions` will show if
`overrideFailedMessageWithInstalledMessage` (bug fix)
- VPPInstallDetailsModal
- Updated variables and naming for readability
- TODO: Create tests to add icons to
- Use reusable component `IconStatusMessage`
- Override icon to success icon if
`overrideFailedMessageWithInstalledMessage || isInstalledManual` (bug
fix)
- `shouldShowInventoryVersions` will show if
`overrideFailedMessageWithInstalledMessage` (bug fix)
## Screenshots
### BEFORE
https://github.com/user-attachments/assets/3472daef-47bd-4dbb-9ce9-afbf3d13302b
### AFTER
https://github.com/user-attachments/assets/c3212f58-6172-4437-9d60-76c42b98f451
## Testing
- [x] Added/updated automated tests
Tests already exist, ensured they still passed
- [x] QA'd all new/changed functionality manually
## Issue
Closes#41548
## Description
- Improve string util we use for matching icons
> Note: Lots of retros how this came about
## Screenshot of fix
Arc vs. Archaeology
<img width="522" height="595" alt="Screenshot 2026-03-12 at 4 42 13 PM"
src="https://github.com/user-attachments/assets/9f805678-c08a-4959-ab6a-3b29c4b1f382"
/>
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38669 Unreleased bug/Misunderstood
requirements
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* End User Authentication and lock end-user info settings now
synchronize correctly when one is updated without explicitly setting the
other.
* Validation error messages now clearly state that end-user
authentication must be enabled before locking end-user info.
* **Tests**
* Expanded test coverage for MDM configuration handling and related
scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40607
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38585
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed Microsoft NDES CA selection to work immediately after deleting
an existing NDES CA without requiring a page refresh.
* Added validation preventing multiple NDES CAs from being added, with a
tooltip message explaining the limitation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds Backblaze (data backup and storage service) as a new
fleet-maintained app with **macOS** support via Homebrew cask
(`backblaze`).
- Backblaze uses a manual installer (`Backblaze Installer.app`) inside a
DMG, so custom install and uninstall scripts are provided following the
same pattern as Adobe Creative Cloud.
- The install script mounts the DMG, locates `Backblaze Installer.app`,
and runs the `bzinstall_mate` binary with the `-nogui` flag for silent
installation.
- The uninstall script stops launchctl services
(`com.backblaze.bzbmenu`, `com.backblaze.bzserv`), removes app bundles,
preference pane, diagnostic reports, package data, and per-user
preferences.
### Files added/changed
| File | Description |
|------|-------------|
| `ee/maintained-apps/inputs/homebrew/backblaze.json` | macOS input
definition |
| `ee/maintained-apps/inputs/homebrew/scripts/backblaze_install.sh` |
Custom install script (DMG mount + manual installer execution) |
| `ee/maintained-apps/inputs/homebrew/scripts/backblaze_uninstall.sh` |
Custom uninstall script (launchctl cleanup + file removal) |
| `ee/maintained-apps/outputs/backblaze/darwin.json` | Generated macOS
output manifest |
| `ee/maintained-apps/outputs/apps.json` | Updated with Backblaze entry
and description |
### Windows support note
Windows support via WinGet (`Backblaze.Backblaze`) is not included in
this PR because the Backblaze package has never been successfully merged
into the [winget-pkgs
repository](https://github.com/microsoft/winget-pkgs). All submission
attempts were rejected due to the installer failing WinGet's unattended
installation validation. Windows support can be added once Backblaze is
available in winget-pkgs.
### Checklist
- [x] macOS input file follows Homebrew input schema
- [x] Custom scripts follow existing patterns (Adobe Creative Cloud)
- [x] Output manifest matches expected format
- [x] `apps.json` updated with description following sentence casing
format
- [x] Entry sorted alphabetically in `apps.json`
- [ ] Icon generation (requires macOS host with Backblaze installed)
- [ ] Validation on macOS host
---
Built for [Mitch
Francese](https://fleetdm.slack.com/archives/D0AG92RJGHY/p1773172809438909?thread_ts=1773163736.129729&cid=D0AG92RJGHY)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Mitch Francese <2227948+tux234@users.noreply.github.com>
## Summary
- Adds Ollama as a fleet-maintained app (FMA) with support for both
macOS and Windows platforms
- Ollama is a popular tool to get up and running with large language
models locally
## Changes
### macOS (Darwin)
- **Input**: `ee/maintained-apps/inputs/homebrew/ollama.json` — uses
Homebrew cask `ollama-app`
- **Installer format**: `zip`
- **Bundle identifier**: `com.electron.ollama`
- **Output**: `ee/maintained-apps/outputs/ollama/darwin.json` —
generated via `go run cmd/maintained-apps/main.go --slug="ollama/darwin"
--debug`
### Windows
- **Input**: `ee/maintained-apps/inputs/winget/ollama.json` — uses
WinGet package `Ollama.Ollama`
- **Installer type**: `exe` (Inno Setup)
- **Installer scope**: `user`
- **Custom scripts**: `ollama_install.ps1` and `ollama_uninstall.ps1`
with Inno Setup silent flags (`/VERYSILENT /SUPPRESSMSGBOXES
/NORESTART`)
- **Output**: `ee/maintained-apps/outputs/ollama/windows.json` —
generated via `go run cmd/maintained-apps/main.go
--slug="ollama/windows" --debug`
### App catalog
- Added Ollama entries (darwin + windows) to
`ee/maintained-apps/outputs/apps.json` with description
## Notes
- Icon generation and frontend integration (`tools/software/icons`)
still need to be done separately per the FMA contributing guide
- Category: `Developer tools`
Built for [Mitch
Francese](https://fleetdm.slack.com/archives/D0AG92RJGHY/p1773163983187599?thread_ts=1773163736.129729&cid=D0AG92RJGHY)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Mitch Francese <2227948+tux234@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#39781
- [x] Changes file added for user-visible changes in `changes/`
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually - TODO with wip
backend work
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
## Summary
- Adds Sequel Ace (free, open-source MySQL/MariaDB database manager for
macOS) as a fleet-maintained app
- Includes input JSON, generated output, app icon, and apps.json entry
- macOS only (zip installer format, cask: `sequel-ace`)
## Test plan
- [ ] Verify `sequel-ace/darwin` output JSON has correct installer URL
and SHA256
- [ ] Verify icon renders correctly in the software page
- [ ] Verify apps.json entry is in correct alphabetical order with
description
#41229
## Summary
- Adds Warp terminal as a Fleet maintained app for macOS (darwin)
- Uses direct CDN URL (`releases.warp.dev`) instead of Homebrew's URL
which requires `User-Agent: Homebrew` header
- Single `WarpDirectInstaller` enricher: overrides URL, sets `sha256:
no_check`, strips `.stable_` from version string
- Version: `0.2026.02.25.08.24.01` (latest stable)
## Validation checklist
- [ ] App can be downloaded using manifest URL
- [ ] App installs successfully on macOS host using manifest install
script
- [ ] App exists in software inventory after install
(`dev.warp.Warp-Stable`)
- [ ] App uninstalls successfully using manifest uninstall script
## Notes
Supersedes #37901 (branch had corrupted git history from a rewrite; this
is a clean branch off main).
**Related issue:** Resolves#39996
This adds a new flow where the user is asked to navigate and dowload the
enrollment profile in safari for ios and ipados devices.
This fixes an issue where the enrollment profile was not downloaded
correctly on browsers other than Safari.
https://github.com/user-attachments/assets/20304389-4b36-445b-9b8f-d4b9bfbff143
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Simplified modal structures across multiple dialog components for
improved code maintainability.
* Enhanced modal component's flexibility to support broader content
types.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Tim Lee
