Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated maintained app metadata for the latest releases of 3DF Zephyr,
ChatGPT, Claude, Cursor, Discord, Evernote, Fastmail, Fing, JetBrains
Toolbox, Kiro CLI, Miro, Notepad.exe, Opera, Portfolio Performance,
Rocket.Chat, Signal, Slicer, Tailscale, Tower, Visual Studio Code,
Vivaldi, WebCatalog, and Zen Browser.
* Refreshed installer download links, version detection thresholds, and
integrity checks to match the new releases.
* Updated Fing’s installer format to use ZIP artifacts.
* Corrected Mimestream’s uninstall configuration to point to the right
script reference.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Relates to #38806
Extend host name templates beyond the three host-identity variables to
also accept the IdP end-user variables, and re-enqueue the rename when a
referenced variable's value changes.
Re-enqueue on value change:
- An IdP data change (SCIM user/group create/update/delete) re-queues
only the affected hosts whose template uses the changed IdP variable —
IdP values are per host, so the scope is the specific hosts mapped to
that user/group.
- A custom (secret) value change re-queues every eligible host in each
team / "No team" whose template references the changed secret — secret
values are global, so the scope is the whole team/No-team.
Built-in variables intentionally NOT supported:
- Certificate/CA variables — $FLEET_VAR_NDES_SCEP_CHALLENGE,
_NDES_SCEP_PROXY_URL, _CUSTOM_SCEP_CHALLENGE_*,
_CUSTOM_SCEP_PROXY_URL_*, _SMALLSTEP_SCEP_CHALLENGE_*,
_SMALLSTEP_SCEP_PROXY_URL_*, _DIGICERT_DATA_*, _DIGICERT_PASSWORD_*,
_SCEP_WINDOWS_CERTIFICATE_ID, _CERTIFICATE_RENEWAL_ID (and legacy
_SCEP_RENEWAL_ID), _PSSO_DEVICE_REGISTRATION_TOKEN. These resolve to
one-time SCEP challenges, proxy URLs, base64 PKCS12 cert data, or
Fleet-minted tokens — meaningless as a device name, and resolving them
has side effects (issuing certificates, consuming one-time challenges)
and would leak secrets into a name that's broadcast on-device, in
osquery, and in the UI.
- Legacy $FLEET_VAR_HOST_END_USER_EMAIL_IDP — deprecated ("avoid in new
replacements") and not a documented built-in variable, so it's excluded
in favor of the supported IDP_USERNAME variables.
**Related issue:** N/A
## Summary
Adds a reusable Claude Code skill (`/aikido-tickets`) that automates
creating GitHub issues from Aikido pen test PDF reports. The skill:
- Reads findings from an Aikido detailed auditor report PDF
- Creates properly formatted issues in the confidential repo with attack
path, fix recommendations, and full Aikido details in a collapsible
section
- Assigns to the correct team project board and sets status to Ready
- Supports all Fleet engineering teams (Orchestration, S&C, MDM,
Software, First Impressions)
- Handles batch creation using parallel agents for efficiency
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] QA'd all new/changed functionality manually
Resolves#34311.
It's not urgent because:
- Orbit uses a fallback mechanism to fetch the device UUID (using
SMBIOS):
https://github.com/fleetdm/fleet/blob/d3092bbc640ebd8e92c13476f0ca8772b98d425e/orbit/pkg/platform/platform_windows.go#L354-L359
- Only used by the `mdm_bridge` table implementation. Which is only used
by CIS policies (not for critical MDM functionality).
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] QA'd all new/changed functionality manually
Tested on both a Windows 11 VM with 25H2 and real Windows 11 device with
23H2. The extracted UUID matches the UUID reported by osquery.
## fleetd/orbit/Fleet Desktop
- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [X] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [X] Verified that fleetd runs on macOS, Linux and Windows
- [X] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Updated Windows device identification to obtain the system UUID using
COM-based WMI querying instead of relying on the deprecated WMIC
utility.
- Removed the WMIC dependency from the MDM bridge table implementation.
- Improved cross-platform UUID handling by removing unused non-Windows
UUID placeholder logic and related constants.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#35075
- Added vulnerability (CVE) reporting for Android OS versions.
- Folded the Android security patch level into the host's OS version.
---------
Co-authored-by: Konstantin Sykulev <konst@sykulev.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46077
Newly created or updated reports (formerly "queries") did not appear in
the host details page's "Live report" modal, or in the standalone
reports list, until a hard refresh. This happened because the
reports-list query cache was never invalidated after a create/update,
and the host details modal additionally disabled refetch-on-mount, so it
kept serving stale cached data even when reopened.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
Premium license:
https://github.com/user-attachments/assets/b045b8da-b7d6-4ba6-b18d-b944208c75d2
Free license:
https://github.com/user-attachments/assets/974106e5-e620-4c46-b3ec-a74c955fe26d
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Newly created or updated reports now appear immediately in the host
details “Live report” modal and reports list without requiring a hard
refresh.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
We missed a space under Controls > Setup experience > Users > End user
authentication.
Before:
<img width="846" height="207" alt="Screenshot 2026-07-09 at 14 56 09"
src="https://github.com/user-attachments/assets/ef0e0022-aba4-4087-84ad-6657af77ec93"
/>
After:
<img width="861" height="205" alt="Screenshot 2026-07-09 at 14 56 04"
src="https://github.com/user-attachments/assets/8eeff380-4616-4621-b06c-88fc748329d0"
/>
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the spacing in the “Lock end user info” help text so the
highlighted field names now display more clearly in the UI.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#37972
This also fixes the sort order of fleets for flee-level users.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the user menu to show the correct settings sections based on
account type and access level, with clearer separation between sections.
* **Bug Fixes**
* Fixed fleet sorting for fleet-level users.
* Corrected top navigation behavior so the menu only shows
role/tier-appropriate items.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45729
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Self-service software table on My device page now shows both installed
and available version columns for each app, making it easier to see
current and updateable versions at a glance.
* **Tests**
* Added/updated tests covering installed and available version display
scenarios, including cases with missing installed versions and when both
versions are present to ensure correct UI rendering.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated Windows installer metadata (versions, download URLs, and
checksums) for AWS CLI, Fellow, Google Drive, Logi Options+, MongoDB
Compass, Ollama, Signal, TablePlus, TextExpander, and Zed to match the
latest releases.
* **Bug Fixes**
* Improved Google Drive uninstall handling by treating common
success/reboot exit codes as successful outcomes, ensuring non-zero
codes don’t get recorded incorrectly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Refreshed Windows and macOS app packages to their latest available
versions, including browsers, developer tools, productivity apps,
security software, and utilities.
* Updated installer download locations and integrity checks to match the
refreshed releases.
* Improved installation and removal support for select applications with
updated package handling.
* Updated version detection so available upgrades are accurately
identified across supported platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49260
This fix is based on direct discussion with Apple and consultation of
the Apple docs. We are not currently sure if this is actually issue the
customer is running into but we have identified it as an issue with our
enrollment process.
As far as testing my iPad running 18.7 gets prompted to update every
time now when I enroll it with updates turned on. If I back up and don't
take the upgrade and try to enroll again I get an error but I believe
this is an Apple bug which we've been told was fixed in 26+
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue during Android Device Enrollment where devices assigned
a mandatory software update could incorrectly show a failure status.
* Resolved cases where the required software update was not displayed
correctly.
* Improved Apple device enrollment update details by reporting the
operating system version consistently.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49329
## What & why
Fresh **Windows 11 25H2** (build 10.0.26200) devices failed Microsoft
Entra / Autopilot MDM auto-enrollment during OOBE with error
**80180006**. The device advertises an MS-MDE2 discovery
`RequestVersion` of `"9.0"`, and Fleet's `IsValidDiscoveryMsg()`
rejected it via an exact-match allow-list (`{"4.0","5.0","6.0","7.0"}`)
that could only be changed by rebuilding the server.
The discovery **response** already pins the protocol to
`EnrollmentVersionV4` (`"4.0"`) and the client negotiates down, so the
exact-match check was the only blocker. This PR implements the issue's
preferred fix: **accept any `RequestVersion >= 4.0`**, which is
forward-compatible with future Windows version bumps.
- `server/mdm/microsoft/syncml/syncml.go`: replaced the
`SupportedEnrollmentVersions` allow-list var with a
`MinSupportedEnrollmentVersion` constant.
- `server/fleet/microsoft_mdm.go`: added `enrollmentVersionAtLeast`
(numeric component-wise compare, so `"10.0" > "9.0"`) and changed
discovery validation to accept any version at or above the minimum.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed MDM enrollment failures on fresh Windows 11 25H2 and other
recent builds.
* Discovery requests now accept supported MDE2 `RequestVersion` values
at or above the minimum supported version (instead of requiring an exact
match).
* Invalid or outdated discovery versions now return more specific
validation errors.
* **Tests**
* Added unit test coverage for minimum, equal, newer, and invalid
enrollment version comparisons.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
**Related issue:** Resolves#28108
Adds support for uploading multiple custom packages (up to 10) for the
same software title on a team — so IT admins can deploy different
versions or architectures (for example, Arm vs. Intel builds or staged
rollouts) to label-scoped hosts instead of splitting them across teams.
The software title keeps a single first-added `software_package` for
backwards compatibility, and first-added-wins resolves overlaps
consistently across self-service, manual install, policy automation, and
setup experience.
Feature branch combining the sub-PRs: migration (#48596), packages[] API
and add/edit/delete-package endpoints (#48607), install-time precedence
and setup experience (#48708), GitOps (#48710), Library and
Add/Edit/Delete modals (#48520), secondary UI — policy automation, setup
experience, and install-details hash (#49079), and the host
install-result `hash_sha256` field (#49085).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Support up to 10 custom packages per software title, with
package-scoped deploy/install settings and package-specific edit/delete.
* Policy automation can pin “Install software” to a specific package.
* GitOps generation now outputs repeatable multi-package YAML per title.
* Software install details now display the package SHA-256 hash (when
available) with a copy-to-clipboard action.
* **Bug Fixes**
* Improved deterministic “first-added” precedence for installs,
listings, setup experience, and policy dispatch when multiple packages
match.
* Fixed installer targeting and per-package metadata persistence
(including installer-specific activity details).
* **Accessibility/UX**
* Added optional `aria-label` support for dropdowns.
* Info banners can now render a leading icon with configurable color.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44954
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Custom Host Vitals management (create/edit/delete, search) with
copyable variable tokens and per-host values.
* Show Custom Host Vitals on host details, including role-based editing.
* Enabled Custom Host Vitals in host-vitals labels and the activity
feed.
* Extended GitOps to manage global Custom Host Vitals declaratively
(including dry-run behavior).
* Split Controls → Variables into Global Variables and Custom Host
Vitals, including routing updates.
* **Bug Fixes**
* Improved validation and expansion of Custom Host Vital references
across scripts, profiles, installers, and deployments, with clearer
failures when values are missing or invalid.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Use platforms (macOS) instead of hardware (Mac) to be consistent with
other spots in UI
- Include Windows and Linux
- Just say "online" instead of "check in and count as online". Reduce
word count. We're looking at the "Hosts online chart" anyways.
Context is in [this Slack
thread](https://fleetdm.slack.com/archives/C084F4MKYSJ/p1783370095727719).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the uptime explanation text to better reflect how “online”
status varies by platform when devices are locked vs. unlocked.
* Clarified wording for iOS/iPadOS, macOS/Windows/Linux, and Android to
match actual check-in behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Steven Palmesano <3100993+spalmesano0@users.noreply.github.com>
**Related issue:** Resolves#49234
Editing a software installer to a new version failed with "The selected
package is for different software" when the title's stored
(osquery-reported) name differed from the installer's extracted name.
The edit now validates by software identity (bundle identifier / upgrade
code / name) instead of an exact name match.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
**Related issue:** N/A — CI improvement for the FMA validation
workflows.
## Summary
Restructures the Windows and macOS Fleet-maintained app validation
workflows around a cheap Linux detect/shard job, with Windows apps
additionally routed to a CI runner whose native architecture matches the
app's installer.
**Both platforms:**
- Change detection and sharding run on `ubuntu-latest`. Expensive
Windows/macOS runners only spin up when their platform actually has
changed apps — e.g. a Windows-only letter-batch PR no longer boots a
macOS runner just to discover there's nothing to do (and vice versa) —
and they check out at depth 1 instead of full history.
- A new `.github/scripts/partition-fma-apps.sh <windows|darwin>` emits
the job matrix; validation steps move unchanged into reusable workflows
(`test-fma-windows-validate.yml`, `test-fma-darwin-validate.yml`).
- Large PRs shard into parallel jobs (Windows: 25 apps/shard, macOS:
30), and the manual full-run workflows gain a `shard_size` input
(Windows default 20 → ~20 shards over 384 apps; macOS default 25 → ~39
shards over 961 apps). Neither full run could previously finish:
hundreds of sequential installs blow the 6-hour job limit.
- Pre-installed app handling is computed per shard from that shard's
slug list — Windows removals (Chrome, 7-Zip, Firefox, Node.js,
PowerShell, R, Git) and macOS steps (Chrome, Xcode for Icon Composer,
the Fleet Desktop MDM config stub) only run on the runner validating
that app. This also brings the full-run workflows to parity with the PR
gates (they previously only removed Chrome).
- Stable summary jobs (`test-fma-pr-only`, `test-fma`) aggregate the
dynamic matrix results so branch protection / PR gating keeps a fixed
check name.
**Windows arch routing:**
- Each changed `<name>/windows` slug's `installer_arch` is read from
`ee/maintained-apps/inputs/winget/<name>.json`: `arm64` apps →
`windows-11-arm`, x64/x86/neutral apps → `windows-latest` (x64). Missing
input files default to x64 with a warning. This fixes installers that
check the native OS architecture and abort under Prism emulation on the
ARM runner (Inno Setup `ArchitecturesAllowed=x64` — GOG Galaxy, Reqable
— and Docker Desktop). Future arm64 FMAs need no workflow change —
`installer_arch: arm64` in the winget input is enough.
- macOS needs no arch matrix: `macos-latest` is arm64 and x86-only casks
run under Rosetta 2, which matches how customer Macs run them.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually
Manual QA:
- Partition script is shellcheck-clean and tested against the real repo
for both platforms: empty input, mixed-platform slug lists, x86/neutral
routing to the x64 runner, single-slug arrays, missing input file
fallback, arm64/x64 split with sharding (via a synthetic arm64 input),
invalid platform/shard-size rejection, and full-catalog partitions (384
Windows apps → 20 shards, 961 darwin apps → 39 shards, all slugs
accounted for, matrix outputs well under the 1 MB job-output limit).
- All six workflows pass `actionlint` and zizmor 1.25.2 (with the repo's
`.github/zizmor-gate.yml` config) with no findings.
- The rewritten Windows PR gate ran on this PR itself: the Linux detect
job correctly found no changed Windows apps, skipped the Windows
runners, and the `test-fma-pr-only` summary check passed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added sharded validation for maintained macOS and Windows apps to run
tests in parallel.
* Added configurable `shard_size` for manual validation runs.
* Introduced reusable validation workflows for Darwin and Windows.
* Improved Windows testing to be architecture-aware (ARM64 vs x64).
* **Bug Fixes**
* Improved pull request gating to validate only changed apps and report
results more reliably.
* Workflows now gracefully handle scenarios where no matching apps are
found (avoid unnecessary failures).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47922https://github.com/user-attachments/assets/d3cfa329-10bb-45c6-911a-fbe84f1dcffb
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue where symbols in input fields could unexpectedly change
height depending on nearby characters.
* Improved text rendering consistency in input and textarea fields.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Refreshed managed application releases across macOS and Windows,
including Affinity, Android Studio, Badgeify, Beeper, Chrome Remote
Desktop Host, Cursor, Discord, Docker, Dropbox, Git, Microsoft 365 apps,
Raycast, Reqable, and others.
* Updated installer links, checksums, and version detection for newly
released builds.
* Improved Dropbox and Microsoft app installation or removal handling to
support their latest packages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Relates to #38806
Host name templates previously accepted only built-in $FLEET_VAR_*
variables and rejected custom $FLEET_SECRET_* (secret) variables. Allow
secret variables so admins can embed an org-wide custom value in an
Apple host's name.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
**Related issue:** Resolves#49208
Host software details now show the status and install details for the
installer scoped to the host, for titles with multiple packages.
No `changes/` file: this is an unreleased bug fix, and the
multiple-packages feature PR carries the changes entry.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Related to: https://github.com/fleetdm/fleet/issues/41908
Changes:
- Updated Android proxy endpoints (`create-android-enrollment-token`,
`create-enterprise-webapp`, `delete-android-device`,
`get-android-device`, `get-android-devices`,
`get-enterprise-applications`, `issue-command-on-android-device`,
`modify-android-device`, `modify-android-policies`, and
`modify-enterprise-app-policy`) to send requests to the Android
Management API without verifying that an enterprise is still managed by
Fleet with the getIsEnterpriseManagedByFleet helper, and to return a
`enterpriseNotAccessible` (notFound) response to Fleet servers if the
Android management API returns a 403 response.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Android management flows to handle authorization failures
more consistently.
* Requests now return a clearer “not accessible” response when access to
an Android enterprise is denied.
* Several Android device, app, policy, and enterprise actions now
surface this response instead of falling back to generic errors.
* Streamlined Android enterprise operations by removing an extra
pre-check, letting the API response determine the final outcome.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated webhook sender classification to reflect the current list of
recognized bot and maintainer accounts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** NA
## What & why
The FMA validator (`cmd/maintained-apps/validate`) downloads each app's
installer with a hardcoded 2-minute context timeout. Large installers
can't finish in that window — e.g. Android Studio (Windows) is ~1.39 GB,
which needs ~12.4 MB/s sustained to complete in 2 minutes. When the
runner is slower, the download aborts with `context deadline exceeded`,
failing validation with a misleading error that looks URL-related.
This bumps the validator timeout from 2 to 5 minutes. (For reference,
the production download path already uses `InstallerTimeout = 15 *
time.Minute`.)
# Checklist for submitter
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Increased the installer download timeout to five minutes, improving
reliability for slower downloads.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45320
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Summary
`filterExtensionsForHost` (called on every Orbit config fetch, ~30s per
host) had an N+1 query pattern: it called `HostMemberOfAllLabels` once
per extension in a loop, issuing a separate DB query for each.
This PR replaces the N queries with a single batch query via a new
`HostMembershipForLabels` datastore method that returns which labels
(from a given list) the host belongs to. Extension filtering then
happens in-memory.
### Changes
- **New datastore method** `HostMembershipForLabels(ctx, hostID,
labelNames) -> map[string]bool` -- single `SELECT l.name FROM labels l
JOIN label_membership` query
- **Updated `filterExtensionsForHost`** in `server/service/orbit.go` --
collects all unique label names across extensions, calls the new method
once, filters in-memory
- **No API, UI, CLI, agent, or schema changes** -- purely server-side
internal optimization. Full backward compatibility: old agents work with
new servers and vice versa (no protocol change).
## Benchmark
Ran a local end-to-end benchmark against the live `POST
/api/fleet/orbit/config` endpoint to measure the real-world impact.
**Setup:**
- MacBook (Fleet server + Docker MySQL 8.0 + Redis, all localhost)
- 50 enrolled Orbit hosts (darwin), 5 label-scoped extensions, all hosts
members of all 5 labels
- 500 requests at concurrency 10, cycling through all 50 orbit_node_keys
- Built Fleet binary from `main` (before) and this PR branch (after),
same database and test data
**Results:**
| Metric | Before (main) | After (this PR) | Improvement |
|--------|:---:|:---:|:---:|
| Avg latency | 25.33 ms | 17.46 ms | **-31%, 1.45x faster** |
| P50 latency | 24.55 ms | 16.52 ms | **-33%, 1.49x faster** |
| P95 latency | 34.42 ms | 27.53 ms | **-20%, 1.25x faster** |
| Throughput | 390.6 req/s | 564.2 req/s | **+44%** |
### Extrapolation to 100,000 hosts
At 100k hosts with a 30-second check-in interval (3,333 req/s steady
state):
| Metric | Before | After |
|--------|--------|-------|
| Server host capacity (measured MacBook) | 11,718 | 16,926 (+44%) |
| Label-check DB queries/sec | **16,665** (5/req) | **3,333** (1/req) |
| **DB queries eliminated** | | **13,332/sec (80% reduction)** |
The improvement scales linearly with extension count:
| Extensions | DB queries eliminated/sec | Reduction |
|:---:|---:|:---:|
| 5 | 13,332 | 80% |
| 10 | 29,997 | 90% |
| 15 | 46,662 | 93% |
| 20 | 63,327 | 95% |
> **Note:** These are conservative localhost numbers. In production,
where each DB round-trip includes real network latency, the per-request
latency improvement would be more pronounced because each eliminated
query saves a network hop.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
### Automated
- New `testHostMembershipForLabels` MySQL integration test covering:
empty input, full membership, partial membership, nonexistent labels,
nonexistent host, host with no memberships
- Existing `testHostMemberOfAllLabels` unchanged and unaffected
### Manual QA
1. Fleet Premium instance with 2+ Orbit-enrolled hosts
2. Configure 3+ osquery extensions with different label scoping
3. Verify each host receives only the extensions whose label
requirements it meets
4. Verify extensions with no label scoping are included for all hosts
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Performance**
* Improved Orbit configuration loading by batching host label membership
checks into a single query for extension label filtering.
* **Behavior**
* Extension availability and filtering behavior remains the same, with
more efficient processing when multiple extensions use labels.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#48448.
These should help with reviewing the XAR and BOM implementations:
- https://claude.ai/code/artifact/60a78c1d-2fc9-45da-9471-1517fe77adb4.
- https://claude.ai/code/artifact/1c759a32-02f7-4a41-8611-04d7358367d7.
The darwin only tests (bom_darwin_test.go) have been executed on my
workstation.
Goal is to make sure to run the tests on macOS Github runners in
https://github.com/fleetdm/fleet/issues/33371.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* macOS package builds now use an internal, built-in implementation
instead of external packaging tools.
* `.pkg` installer creation no longer depends on Docker for macOS
packaging.
* **Bug Fixes**
* Improved packaging reliability by reducing platform-specific build
steps.
* Packaging test coverage was streamlined to better match the supported
build environment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Link to a working profile instead of telling the user how to create
one. It's easier
- ~~This is assuming the configuration profile works. @kc9wwh is
currently testing the profile and running into issues...~~
- UPDATE: We confirmed the profile works
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for contacts associated with the “Event - 2026-07 PSU
MacAdmins” source.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A — part of the ongoing Windows Fleet-maintained
apps (FMA) parity workstream (letter G).
## What this does
Adds **19** Windows Fleet-maintained apps for the letter-G batch. Each
app has a winget-sourced input, generated output manifest, and (where a
cleanly-licensed ≥256px icon was found) a catalog icon.
**MSI (clean, upgrade-code uninstall):**
- Gadwin PrintScreen, Gadwin PrintScreen Pro, Gadwin ScreenRecorder —
free + the two paid editions are distinct products (separate
ProductCodes/UpgradeCodes), so each matches by exact ARP name to avoid
cross-matching
- GitHub CLI, Go, gsudo, grepWin
- GeoGebra Classic — the machine MSI; the winget manifest's top-level
`Scope: user` forced `installer_scope: user` in the input + custom
machine-MSI install/uninstall scripts
- Google Ads Editor — dual user/machine WiX MSI; custom install forces
`ALLUSERS=1`
**MSI (custom uninstall):**
- GoodSync — `ignore_hash` (non-versioned "latest" URL drifts from the
manifest version/SHA, Chrome/TeamViewer pattern); process-stopping
uninstall for its tray app + sync service
**NSIS / exe (custom install + uninstall):**
- Google Web Designer, Gpg4win (x86-only; versioned ARP name → fuzzy
match), GoAnywhere OpenPGP Studio (install4j `-q`), GoldenDict-ng
(maintained fork; name-only exists query), Graphviz
- Streamlabs Desktop — electron-builder `/S /allusers` +
process-stopping uninstall (versioned ARP name → fuzzy match)
**WiX burn / electron (custom install + uninstall):**
- Garmin BaseCamp, Garmin Express (`ignore_hash` — rolling URL +
self-updating app), Galaxy Modeler (`/S /allusers`)
## Dropped from this batch (recorded in the workstream tracker)
- **Genesys Cloud Background Assistant** — WiX burn bootstrapper with a
hard `VCRedist 2015+ x86` dependency Fleet won't resolve, x86-only,
non-standard burn uninstall.
- **GoldenDict.GoldenDict** — stale original, superseded by the
actively-maintained `xiaoyifang.GoldenDict-ng` fork (shipped instead).
- **GeoGebra GraphingCalculator + Geometry** — user-scope-only exe
installers (no machine option); shipped GeoGebra Classic (MSI) instead.
- **Garden Gnome Package Viewer** — `ggnome.com` download URLs sit
behind a Cloudflare `cf-mitigated: challenge` and return 403 to all
automated requests (even with the Chrome UA), so Fleet's downloader
can't fetch it.
## Notes
- **Gadwin ScreenRecorder** and **Garmin Express** ship without a custom
catalog icon — no cleanly-licensed ≥256px source was found (they fall
back to the generic icon).
- Verification (winget manifest identity, installer type/scope/arch,
ProductCode/UpgradeCode, silent switches, URL stability) was done per
the `new-fma` skill against the winget-pkgs manifests and, where needed,
the real installers.
## Testing
- [ ] FMA CI validator (install → detect → uninstall) on the
SYSTEM-context Windows runner — pending.
- Generated outputs verified locally: all 19 produce valid manifests;
MSI apps carry the correct UpgradeCode-based uninstall; exists/patched
queries reviewed for name + publisher correctness.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added maintained Windows software catalog entries for 13 applications
(Gadwin PrintScreen/Pro/ScreenRecorder, Galaxy Modeler, Garmin BaseCamp,
GeoGebra Classic, Go, GoAnywhere OpenPGP Studio, GoldenDict-ng, Google
Ads Editor, Google Web Designer, Graphviz, grepWin).
* Enabled silent install/upgrade detection and automated uninstall
behavior for the newly supported apps.
* Added app icons and expanded software-name keyword matching for
improved identification in the catalog.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Changes
Adds a new "Generate a customer quote" section to the Go-To-Market
operations handbook page. This documents the workflow for generating
quote PDFs with custom terms in Salesforce:
1. Navigate to the approved quote record.
2. Populate the **Terms** field with the full general terms plus any
custom language.
3. Generate the PDF using the "Promises or custom terms" template.
4. Review and submit to Zay Hanlon for approval before sending to the
customer.
This section follows the existing "Create a quote" section and provides
the next step in the quoting workflow.
---
Built for [Sam
Pfluger](https://fleetdm.slack.com/archives/C08BTMFTUCR/p1784074821847739?thread_ts=1784057153.990589&cid=C08BTMFTUCR)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
Update the x86 Windows Zoom Workplace label query to use a LIKE pattern
match instead of an exact match. This allows detection of different Zoom
Workplace versions and variants beyond just 'Zoom Workplace (X64)'.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Update `it-and-security/default.yml` to include
`windows_entra_client_ids` with `$DOGFOOD_ENTRA_CLIENT_ID` alongside the
existing Entra tenant ID setting. This ensures default Windows Entra
configuration includes both required identifiers for migration/auth
setup.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Configuration**
* Added support for supplying the Entra client ID in the Windows Entra
integration configuration.
* Updated the deployment workflow to pass the configured client ID
through automatically.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for the latest installers across a broad range of macOS
and Windows applications.
* Updated application catalog entries with current release versions,
download locations, and verification checksums.
* **Bug Fixes**
* Improved upgrade detection so outdated installations are correctly
identified.
* Updated installation and removal behavior where required for newer
application releases.
* **Maintenance**
* Refreshed metadata for applications including Blender, Chrome Remote
Desktop, Docker Desktop, Firefox, GitHub Desktop, Notion, Postman, and
many others.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
RachelElysia