This pull request introduces support for several new Windows
applications in the maintained apps catalog by adding their Winget
manifest JSON files and corresponding install/uninstall PowerShell
scripts. The main focus is on developer tools (DBeaver variants, Fork,
DB Browser for SQLite) and productivity software (Notion Calendar), with
scripts tailored to each application's installer type and uninstallation
method.
**New Application Manifests and Scripts:**
*Developer Tools:*
- Added manifests and install/uninstall scripts for `DBeaverEE`,
`DBeaverLite`, and `DBeaverUltimate`, handling silent installs and
registry-based uninstalls for NSIS installers.
[[1]](diffhunk://#diff-eaf4a46578aab1439f63fd34568a31a8af80686564126b42d35b58aa7f2c62e3R1-R13)
[[2]](diffhunk://#diff-e7f92237e92e146682aa31bba2adcb94960064cccbcba0aa4824d30fdb1db809R1-R13)
[[3]](diffhunk://#diff-c4cbef61403a529f50d498830989eb0eb45a0469d4c6a74731ba3404ec9a20b4R1-R13)
[[4]](diffhunk://#diff-7935ee0b5330d4aeaf7b86d764ec34df77d70906e4d15539b344a4ad26e2ce3dR1-R27)
[[5]](diffhunk://#diff-2f030daf30f518d6e45834242eff2f74ba59bcb11e7a266c37d227ccadaf2a5eR1-R75)
[[6]](diffhunk://#diff-76b88cbae2c5985490eb0fe76f3203db20fb0bf1b0de618923b23038112c1468R1-R27)
[[7]](diffhunk://#diff-1405c92b884320fb2c48b8c45d435a974db35b7eeceb1e9886a4adcb56416502R1-R75)
[[8]](diffhunk://#diff-e2284ea6c00f43ae37ac61c30a4787e77b7051df0fb91ae876662fbc6642e8f7R1-R27)
[[9]](diffhunk://#diff-ff8ec9020bc37f1350b45454e2e813aae39db842f30518d6ca0c31e67c4300e6R1-R75)
- Added manifest and install/uninstall scripts for `Fork`, supporting
silent Squirrel-based user installs and registry-based uninstalls.
[[1]](diffhunk://#diff-6e3b6ab0a68025636437cae06486a8037b30c8d67c6d64da78f5c2b5fcbad036R1-R12)
[[2]](diffhunk://#diff-58cf478f6b085152e55505765e959f3e2f251087edacb241ec8317a775934d95R1-R27)
[[3]](diffhunk://#diff-8affe7197066170c48e2badc36cedd32f0fa0229afbc2fd49fa844eadb84e25cR1-R69)
- Added manifest for `DB Browser for SQLite` with basic package
metadata.
*Productivity:*
- Added manifest and install/uninstall scripts for `Notion Calendar`,
supporting silent NSIS installs and registry-based user uninstalls.
[[1]](diffhunk://#diff-ec8fec2849c5d87cf4c21b1ba8f4aefd025cd9528590595c9d635699f85a5aecR1-R12)
[[2]](diffhunk://#diff-1d1b021f465f1417abc47475dabae2098f2b460cb9b46a649ef820517427440cR1-R27)
[[3]](diffhunk://#diff-54998d5d631d60bcb24503ba509beb0a3b760939476ecc12019b8960a877a9a4R1-R75)
*Other Installers:*
- Added install script for `Wacom Tablet Driver`, handling silent
InstallShield installs and special exit codes for reboot requirements.
Changes:
- Replaced the dropdown comparison switcher with tabs on the homepage
desktop comparison table.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Replaced the dropdown selector with a horizontal tabs interface in the
"Moving to Fleet?" comparison table, enabling users to easily switch
between vendor options. The tabs feature a visual indicator for the
active selection. Added responsive styling that adapts seamlessly to
smaller screen sizes, maintaining readability and usability across all
devices.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46407?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves https://github.com/fleetdm/confidential/issues/16119
- Re-orders and removes rows
- Replaces platform icons for easier-to-scan checkmarks
- Adds additional context in tooltips
I decided against adding tabs. They added visual weight without enough
benefit. The dropdown is clear enough on its own, and it's already the
second-most-clicked button on the page.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated product comparison tables (desktop and mobile) with reordered
rows and clearer layout
* Added distinct "Complete device inventory" and "Cloud or self-host"
entries with competitor-specific outcomes
* Renamed and clarified features: "Software updates"; "Configuration,
scripting, and diagnostics"; "Single API"; "Infrastructure as code"
* Revised competitor status displays and tooltip copy, including
standardized timing labels and outcome mappings
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46319?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#43456
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Android MDM profiles now include content checksums; devices are
re-synced only when profile content changes, reducing unnecessary
deliveries.
* **Migrations**
* Database schema updated to add and backfill checksum fields for
Android configuration and host profiles.
* **Tests**
* Added and updated tests to validate checksum generation, backfill, and
behavior in profile delivery scenarios.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46276?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41683
Updated frontend for Android commands along with additional changes in
the backend. Did full QA testing with test plan.
# Checklist for submitter
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Android MDM: added Clear passcode action, Unenroll behavior, and
refined BYO vs COBO action visibility and confirmations.
* Optimistic pending states and Android-specific success/error messages
in Lock/Wipe/Clear flows; modals require confirmations for Android.
* **Bug Fixes**
* More robust clearing of stale Android device actions during
re-enrollment and Pub/Sub flows to keep UI state accurate.
* **Tests**
* Expanded Android MDM tests for action visibility, pending states, and
end-to-end state transitions.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46174?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes#43030
## Summary
- Batches title IDs in `getDisplayNamesByTeamAndTitleIds` (chunks of
32,000) to avoid exceeding MySQL's 65,535 prepared statement placeholder
limit
- Uses the existing `BatchProcessSimple` utility, matching the pattern
already used in `software_titles.go`
## Root cause
When `GET /api/v1/fleet/software/versions` is called without a
`per_page` parameter, `DefaultPerPage` (1,000,000) is used.
`ListSoftware` collects all `titleIDs` from the paginated results and
passes them to `getDisplayNamesByTeamAndTitleIds`, which builds an `IN
(?)` clause that exceeds MySQL's 65,535 placeholder limit.
## Manual testing
1. Started a local Fleet server with MySQL via `docker compose up` and
`fleet serve --dev`
2. Seeded the database with 70,000 software titles, software entries,
and software_host_counts records
3. **Before the fix**: `GET /api/latest/fleet/software/versions` (no
`per_page`) returned HTTP 422 with `"Prepared statement contains too
many placeholders"`
4. **After the fix**: the same request returns HTTP 200 with all 70,000
results
5. `GET /api/latest/fleet/software/versions?per_page=20` continued to
work correctly in both cases
## Test plan
- [x] Manual reproduction and verification (see above)
- [x] `make lint-go-incremental` passes
- [x] `go build ./server/datastore/mysql/...` compiles cleanly
- [ ] CI passes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed `GET /api/v1/fleet/software/versions` endpoint to prevent errors
when returning results from large software inventories.
* **Tests**
* Added test coverage for high-volume display name queries.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45737?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add a new Claude skill at .claude/skills/new-fma/SKILL.md that documents
the end-to-end workflow for adding Fleet-maintained apps (FMA) for macOS
(Homebrew) and Windows (winget). The skill emphasizes verifying
installer metadata with real tools (msiinfo, PlistBuddy), provides
inspection/toolkit commands, installer mapping, common pitfalls, and a
pre-ship checklist. Also update ee/maintained-apps/README.md to
reference the new skill for users to follow the automated guidance and
gotchas.
Resolves the following issue:
4.86.0 had:
```
...
20260527215817_AddHostCertificatesOriginDeletedAtIndex.go
```
main had:
```
...
20260522195236_AddMDMAndroidCommands.go
20260522195237_AddContinuousAutomationsEnabledToPolicies.go
20260527215817_AddHostCertificatesOriginDeletedAtIndex.go
```
So we have to move `AddMDMAndroidCommands` and
`AddContinuousAutomationsEnabledToPolicies` to be after
`AddHostCertificatesOriginDeletedAtIndex`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Android remote command support for Mobile Device Management.
* Introduced a "continuous automations" toggle for security policies to
enable automated enforcement and responses.
* **Chores**
* Updated database schema/migration state to include the new Android
commands table and policy field.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46384?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46226
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Add CA certificate rollover CLI to renew MDM CA certs with an
extend-years option while preserving the private key and certificate
properties.
* **Improvements**
* Decryption logic updated to accept previously-rolled CA certificates
so escrowed disk-encryption keys can be decrypted after rollover.
* **Tests**
* Expanded tests and mocks to cover rollover and decryption scenarios.
* **Chores**
* Updated ignore rules and added a changelog entry for the rollover
process.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46226?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
After ADE enrollment with enable_disk_encryption: true, hosts reported
as unencrypted with the disk-encryption policy failing and no recovery
key escrowed until the user logged out/in or restarted.
## Root cause
Fleet's shared macOS disk-encryption probe was:
```
SELECT 1 FROM disk_encryption
WHERE user_uuid IS NOT "" AND filevault_status = 'on' LIMIT 1
```
On the osquery disk_encryption table, filevault_status and user_uuid
are populated from independent sources: filevault_status from
`fdesetup status`, user_uuid from `diskutil apfs listCryptoUsers`
(the UUID of a user with SecureToken authority to unlock the volume).
In the post-ADE window, even with ForceEnableInSetupAssistant=true,
SecureToken propagation can lag — filevault_status='on' but
user_uuid='' for a brief period that resolves on a session event.
When the predicate failed, the query returned 0 rows and three
downstream behaviors broke in lockstep:
- host_disks.encrypted flipped to false ("unencrypted")
- the built-in "Full disk encryption enabled (macOS)" policy failed
- mdm_disk_encryption_key_file_*_darwin returned encrypted=0,
gating the PRK ingest and leaving the recovery key un-escrowed
The predicate originated in groob's standard query library entry
from 2021 as a strict compliance check ("is the host actually
protected, with a user able to unlock it?"). When the disk-encryption
status feature shipped in Nov 2022 (PR #8526, issue #3906), the
same string was reused verbatim and later extracted into
usesMacOSDiskEncryptionQuery — never revisited for whether the
SecureToken gate made sense outside the compliance-policy context.
**Related issue:** Resolves#45369
Closes#42249
Supersedes #42247 (stale draft with merge conflicts)
## Summary
- Hides the "Rotate password" button entirely in the Recovery Lock
password modal when the user has the Observer role (`canRotatePassword`
is false), instead of showing a disabled span with a tooltip
- Removes unused `TooltipWrapper` import and orphaned SCSS styles for
the disabled state
- Consistent with the existing pattern in `ManagedAccountModal` which
already hides the button for observers
## Changes
- `RecoveryLockPasswordModal.tsx`: Return `null` when
`!canRotatePassword` instead of rendering disabled tooltip
- `_styles.scss`: Remove `__rotate-button--disabled` styles
- Added `RecoveryLockPasswordModal.tests.tsx` with two tests covering
button visibility based on role
## How I tested
- Added unit tests (following the `ManagedAccountModal.tests.tsx`
pattern) that verify:
- The "Rotate password" button is **not rendered** when
`canRotatePassword={false}` (Observer role)
- The "Rotate password" button **is rendered** when
`canRotatePassword={true}` (Admin/Maintainer role)
- Both tests pass locally
- ESLint passed clean on all changed files
- Webpack build succeeded; verified the built bundle no longer contains
the old tooltip text or disabled-button CSS class
## Test plan
- [ ] Log in as an Observer, navigate to a macOS host with Recovery
Lock, open the Recovery Lock password modal, and confirm the "Rotate
password" button is not visible
- [ ] Log in as an Admin/Maintainer and confirm the "Rotate password"
button still appears and works
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* The "Rotate password" control in the Recovery Lock Password modal is
now hidden when password rotation is unavailable (e.g., for Observer
role) instead of being shown as a disabled control.
* **Tests**
* Added tests verifying the rotate-button visibility behavior based on
rotation availability/permissions.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45649?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves # Unreleased bugfix in
https://github.com/fleetdm/fleet/issues/31138
We are setting the email on users Fleet creates via the API. We decided
to remove the existing logic we were using to try and link VPP Users
back to Fleet users if they get removed from the DB but by setting the
email we can follow up(later) with a tool that can query the Apple APIs
and list all users by their emails and we can insert them into the VPP
users table
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* VPP app installation failures now report immediately without automatic
retry or recovery attempts
* Improved error transparency for Apple app provisioning failures
* **Refactor**
* Simplified VPP user management and error handling logic
* Removed redundant user lookup and retry mechanisms from app
distribution workflows
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46382?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Power BI Desktop (Windows) added to the app catalog with automated
install/uninstall support, including graceful shutdown and robust
cleanup of leftover installations and registry entries.
* New package input definition for Windows package management to enable
automated deployments.
* Added a Power BI icon in the software management interface for easier
identification.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46284?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
**Related issue:** Resolves#46009.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Resolved an authorization issue preventing users from viewing past
host activities on hosts that contained user-initiated operations such
as lock, wipe, run script, or install software.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46362?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Adds detection and mitigation for YellowKey (CVE-2026-45585), an
unpatched BitLocker bypass affecting Windows 11, Server 2022, and Server
2025. This PR provides:
1. **Detection via osquery extension**: A policy that ensures the
`windows_yellowkey` extension is loaded, enabling daily reporting on
host exposure status
2. **Daily report**: Surfaces per-host YellowKey verdict (not affected,
mitigated, mitigated via WinRE disabled, BitLocker off, or exposed)
3. **Mitigation script**: Implements Microsoft's official mitigation by
stripping `autofstx.exe` from WinRE's `BootExecute` registry chain
4. **Installation script**: Downloads and registers the upstream
`windows_yellowkey` osquery extension from
`allenhouchins/fleet-extensions`
The user-facing article is tracked in a separate issue and will land in
its own PR. The `docs/solutions/all/queries/` → `reports/` directory
migration will also be done in a separate PR.
## Changes
### New files
- `docs/solutions/windows/scripts/mitigate-windows-yellowkey.ps1` —
PowerShell script that mounts WinRE, loads the offline SYSTEM hive,
strips `autofstx` from every ControlSet's `BootExecute`, verifies via
read-back, unmounts with commit, and re-seals the BitLocker measurement
chain via `reagentc /disable` + `/enable`. Writes
`HKLM\SOFTWARE\Fleet\YellowKey\BootExecMitigated = 1` on success. Exit
codes: 0 (done), 3 (OS not affected), 4 (failed).
- `docs/solutions/windows/scripts/install-yellowkey-extension.ps1` —
Wrapper that fetches and executes the upstream installer from
`allenhouchins/fleet-extensions/main`. The upstream script handles
download, PE-header validation, service stop/restart, ACL hardening, and
loader registration. This wrapper exists only because Fleet's GitOps
`run_script` requires a file on disk.
-
`docs/solutions/windows/policies/windows-yellowkey-extension.policies.yml`
— Policy that checks `osquery_registry` for the `windows_yellowkey`
table. Passes when loaded; failing hosts run the installer.
- `docs/solutions/windows/reports/windows-yellowkey.reports.yml` — Daily
report querying the extension's `state`, `state_reason`, `needs_action`,
`winre_enabled`, `tpm_only`, and `mitigated` columns.
## Design notes
- **No opt-in gate**: Microsoft's `autofstx` strip is safe on every
affected host, so the mitigation script runs unconditionally.
- **One-way mitigation**: No unmitigate path. When Microsoft ships a
patch, apply it and clear the marker.
- **Extension sourcing**: The extension binary and installer live
upstream in `allenhouchins/fleet-extensions/windows_yellowkey`. Allen's
CI republishes on every push to `main`. The installer always pulls from
`releases/latest/download`, so no edits to this repo are needed when the
binary updates.
- **Loader path**: The installer writes to `C:\Program
Files\osquery\extensions.load` (osquery's compiled default), not to
orbit's directory, avoiding conflicts with TUF-managed extensions.
- **Hive and mount cleanup**: Mount, hive load, edit, and unmount all
run inside a single try/finally block to ensure cleanup even on
exception.
- **Read-back verification**: Each ControlSet's `BootExecute` is
verified after the strip to confirm.
https://claude.ai/code/session_016QZzDFsd1hTrYkQukGon6Y
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Windows YellowKey BitLocker bypass vulnerability detection and
reporting capabilities
* New policy to verify security extension installation and status on
Windows hosts
* New report surfaces vulnerability exposure and state across Windows
fleet
* Added automated remediation for vulnerable hosts, including extension
installation and bypass mitigation procedures
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46358?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude <noreply@anthropic.com>
Changes:
- Updated the `<scrollable-tweets>` component to set a toggleable max
height on cards with longer quotes. Users can click the "see full quote"
button beneath the truncated quote to expand the card and view the full
quote.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a "Show full quote" link to expand tweet quotes that exceed the
display area.
* **Style**
* Gradient fade for overflowing quote content with an expanded state to
reveal full text.
* Refined video link appearance for improved visual consistency.
* **Bug Fixes**
* Improved overflow detection on initial load and window resize for more
reliable quote truncation/expansion behavior.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46343?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds initial configuration files for a variety of
popular Windows applications to the `ee/maintained-apps/inputs/winget`
directory. Each file defines metadata and installation details for a
specific application, supporting automated installation and
categorization. The changes expand the catalog of supported apps,
especially in the categories of developer tools and productivity.
**New application configurations added:**
* Developer tools:
- Added configurations for JetBrains IDEs (`clion.json`,
`datagrip.json`, `goland.json`), DBeaver, MySQL Workbench, MongoDB
Compass, JetBrains Toolbox, GitKraken, Bruno, Insomnia, Lens, and
balenaEtcher, including install/uninstall scripts where applicable.
[[1]](diffhunk://#diff-3e4e7adc4b239327cc5d40ac702d757e156e016aec1c7c5f94c071a75fe3c4a3R1-R13)
[[2]](diffhunk://#diff-7c80111fa8fde96fcce98662a233200fd288ce0d43d590382e294746cfdccb80R1-R13)
[[3]](diffhunk://#diff-1b9a892edfa9f0d5a6a9bedfcfb05f5f81c28b8b8eb24b7af1f69fcf365faa95R1-R13)
[[4]](diffhunk://#diff-c4bd792a8985240e9c56c8a8b0ad42e494cb2f66243c9c003367b97b6281b8ebR1-R13)
[[5]](diffhunk://#diff-9aca1279003b064f238c0d041a20cdd5ae1d739c4d82e76cde9c53fa19f6b385R1-R11)
[[6]](diffhunk://#diff-b04e68ea6589d16110da5a46758373bdb4de968ec40d4c87e818a9deb1cf038eR1-R10)
[[7]](diffhunk://#diff-7118d8f25ce533ac6ff68996ef77f1414c40e1303e594a914c5ba8f38ec64276R1-R12)
[[8]](diffhunk://#diff-0ead97641d521188d580d83b60dea688638944ef1a757a779e433cff169059b4R1-R12)
[[9]](diffhunk://#diff-bf104e3d22035060f71605438fceffe9f706146eed7d8d30c3d2abf6a5ee5cefR1-R10)
[[10]](diffhunk://#diff-b3eda4fb883851adf2c082f4b59cd8b1a7202ba4259e62bc34b048896567e766R1-R12)
[[11]](diffhunk://#diff-223a89b91fd09d840a1d66037849717db5b28a6a811462e564e1006bd0ad171aR1-R13)
[[12]](diffhunk://#diff-0081626467bacfa7b6e2399e7aeb2daec0b4592e4de1d0b48d5f1a9f484ec1eeR1-R12)
* Productivity:
- Added configurations for Audacity, Bitwarden, Dropbox, draw.io, Loom,
Miro, and calibre, with relevant metadata and scripts for installation
management.
[[1]](diffhunk://#diff-17343e25b14845b33ccdd21e083514798da3d2060828a99f6a437bb7390982ecR1-R13)
[[2]](diffhunk://#diff-e5698c640f9ea28bea0dcae73b24da580297f52098f5f626551729463489e944R1-R12)
[[3]](diffhunk://#diff-cc13e4338596d6f03fe506a885309dd2073394d3213c289aea5b269ce9f872feR1-R10)
[[4]](diffhunk://#diff-8d8db7aa83e73313721dcdf3a9dad437a9b448cdd235d8e04e1287b16c0484aeR1-R12)
[[5]](diffhunk://#diff-277c3efb81a8d39babfc3c72cac751c85ba399f2ae0f2005cd5c5fc24e952e6eR1-R12)
[[6]](diffhunk://#diff-1e495b3b54ed010a6f44538f7269880065e9736f56b36603d43c6676528b2988R1-R12)
[[7]](diffhunk://#diff-b6459d15c09716fbe644e8cb949cf012953b556044eacbd1a8447f1d39dedadfR1-R11)
* Communication:
- Added configuration for Dialpad, including install and uninstall
scripts.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added Windows application support for 35+ popular tools and apps
including productivity (Dropbox, Loom, Obsidian), development (JetBrains
IDEs, GitKraken, Insomnia, Rancher Desktop), security (Bitwarden,
NordPass, NordVPN), and utility applications (Audacity, draw.io,
Signal).
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46313?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
## Summary
- Comments out the Product Designer role in
`handbook/company/open-positions.yml`, removing it from the active open
positions listing.
- Follows the same commenting pattern (`# ` prefix) used for other
previously closed positions in the file.
---
Built for [Isabell
Reedy](https://fleetdm.slack.com/archives/D0AEGJCGJR0/p1779970760392299?thread_ts=1779970746.073209&cid=D0AEGJCGJR0)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Add WinSCP to maintained apps: introduce winget input metadata
(winscp.json) and add installer/uninstaller PowerShell scripts
(winscp_install.ps1 uses Inno Setup silent flags; winscp_uninstall.ps1
locates UninstallString/QuietUninstallString from registry and runs it
with silent args). Update outputs: add app entry in apps.json and add
winscp/windows.json with version, installer URL, checksums and embedded
script refs. Add frontend icon component and image, and register the
icon in the icons index.
