<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48566
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. Coming in bigger backend story.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for tracking Apple declaration assets, including a new
asset record and a link table for associating assets with declarations.
* Added a new timestamp on declarations to reflect the latest asset
update time.
* **Bug Fixes**
* Strengthened database constraints to prevent duplicate asset entries
and enforce valid asset/declaration references.
* Improved delete behavior so referenced declarations clean up related
links automatically.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Refreshed installer metadata for many maintained apps on macOS and
Windows, including AdGuard, Firefox, Docker Desktop, Notion, Zotero, and
others.
* Updated version checks, download links, and package hashes so the
latest app releases are recognized and installed correctly.
* Improved cleanup behavior for a few apps’ removal flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Closes: https://github.com/fleetdm/fleet/issues/48142
Changes:
- Added two new attributes to the website's platform record:
`workshopDetails`, an array containing formatted event details to be
used on the /workshops page, and `workshopDetailsLastUpdatedAt`, a JS
timestamp representing when workshop event details were last retrieved
from the EventBrite API
- Update the website's bootstrap configuration to create a platform
record
- Updated the view action for the workshops page to load workshop event
details from the database if they were updated less than two hours ago.
**Related issue:** Resolves#46057
Authorize `GetVPPTokens` against `VPPApp` instead of admin-only
`AppleCSR`, so maintainer/technician roles no longer get a 403 that
broke the App Store picker.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed the “Add software > App Store” picker so maintainer and
technician roles no longer encounter access errors when browsing VPP
tokens.
* Improved VPP token visibility for team-scoped users by restricting
listings to teams they can read, while including “all teams” tokens and
excluding unassigned/unauthorized ones.
* Ensured users without appropriate access receive the correct
authorization response instead of broader token listings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46193
Adds a client-side check for duplicate patch policies, similar to the
existing policy name and label duplicate checks.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
Adding two patch policies for the same fma slug results in this error:
```
Error: 1 error occurred:
* Couldn't add multiple policies with type "patch" for "fleet_maintained_app_slug": "google-chrome/darwin".
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added validation to GitOps application checks to prevent multiple
patch policies from targeting the same app slug.
* Improved error reporting when patch policy slugs are duplicated or
missing from the configured app list.
* **Bug Fixes**
* Prevented duplicate patch policies from being silently accepted,
reducing the risk of one policy overwriting another.
* Existing valid combinations, such as different patch slugs or certain
mixed policy types, continue to work as expected.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for several new Windows applications to
the maintained apps catalog, primarily by introducing new JSON manifest
files for each app and, in some cases, associated PowerShell
install/uninstall scripts. These additions expand the catalog's coverage
of productivity, developer, utility, and communication tools, and
include detailed installation and uninstallation logic for certain apps.
**New application manifests:**
* Added JSON manifests for a variety of applications, including but not
limited to: Adobe AIR, Agent Ransack, AIMP, Air Explorer, alfaview,
Allway Sync, Amazon Corretto (versions 8, 11, 17), Amazon Redshift ODBC
Driver, AnyBurn, AnyDesk, AVS Image Converter, AVS Media Player, AWS
Session Manager Plugin, Azure Functions Core Tools, CutePDF Writer, and
iTunes. Each manifest specifies installation parameters, categories, and
(where applicable) custom install/uninstall scripts.
[[1]](diffhunk://#diff-891e1b685eea289f7535f5cb3e80299b2d53d22f1ecb4123a6db873b4715d5d3R1-R13)
[[2]](diffhunk://#diff-33d1963698285631553094360f1dab939589c853b20b13046aeed9c36b484120R1-R12)
[[3]](diffhunk://#diff-48b51963ae1bc8ce2e6d2aa494c7db8df854a0a6f392df70528dc80efb0d4341R1-R12)
[[4]](diffhunk://#diff-8177fe092e9e1cc91dd1582d1e4c01b05176d36dbad36ca16397a681aef7c4a5R1-R13)
[[5]](diffhunk://#diff-c1fd695df858d34d29653fb1db79c04123bbfcf432726f9356d893c7bc4e4b16R1-R11)
[[6]](diffhunk://#diff-4024c71281805493b749ec7aa95819583015483d652481954a3dd4d2ba3803e4R1-R10)
[[7]](diffhunk://#diff-8ab1198cecc28b2b9b77a8668355fd505524a59d414eb7623e9676794c03511eR1-R11)
[[8]](diffhunk://#diff-d8534d1ac84c02c1f87dae2798feae0d03fdb332d19a03fd780c9664c337ce41R1-R11)
[[9]](diffhunk://#diff-375f7eb8d9daf96d4952a5f834a4ba5fa272c034ff808b3f21dbd33cf57b7b7eR1-R10)
[[10]](diffhunk://#diff-0710c7d70ff8eb04379932f0ffd0b754626381372ef6a747858eb7b51c230723R1-R10)
[[11]](diffhunk://#diff-ce4007e90efa1fdfff5c1ca96c8dded2108642a522f30baddcefd9327c23c980R1-R13)
[[12]](diffhunk://#diff-9a7ba8c0afb32ab31c2950a4a95847fa1293411416302cd6698dc2bcb519fbfdR1-R13)
[[13]](diffhunk://#diff-02ae7cdbe54f1736023e830b66036c6f32e5eec642d888f51c6dcfbbb0bf12d0R1-R14)
[[14]](diffhunk://#diff-4d3d9fbb9e19bdf5269ff241fc1549a17b9045a04b0358c988fb81ceb03512e1R1-R14)
[[15]](diffhunk://#diff-c22a0370648cd85f36926d2412d10cb46d3f3da4a623ad4595c115496ac6cd41R1-R13)
[[16]](diffhunk://#diff-5dfe747ae19dfa1572611d72dc109a8cbfe8b379410c4154627e9d1c699670d1R1-R12)
[[17]](diffhunk://#diff-4afa6cde8c52e27d865f759ab7f2aabf5f60522cb8bfe120637a4a954194a237R1-R13)
[[18]](diffhunk://#diff-d5ad3e810b587a379fdb2722806be5a0c47eebefad540077db86d356cfd30e17R1-R12)
**Custom installation and uninstallation scripts:**
* Added PowerShell scripts for silent installation and uninstallation of
Adobe AIR, including logic to extract and execute the correct uninstall
command from the Windows registry, ensuring a clean and unattended
removal process.
[[1]](diffhunk://#diff-75bb214bff0533824521c36d0f6ff369ac7848554824f5f44faadc7c7c3225ffR1-R30)
[[2]](diffhunk://#diff-e10832f9465648bd3c3055d3ab2bde1d4cb3170db6ede0de0b0dc347ab3077f3R1-R58)
These changes improve the breadth and automation capabilities of the
maintained apps catalog, especially for environments that require silent
and reliable software deployment and removal.…esk, iTunes, Azure
Functions Core Tools
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
**Related issue:** N/A
## Summary
- Add Okta Verify as a Windows Fleet-maintained app using the
`Okta.OktaVerify` winget package.
- Add custom install/uninstall scripts for the machine-scope WiX Burn
installer.
- Generate the Windows output manifest and add the Windows catalog entry
to `apps.json`.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented, and untrusted data interpolated into shell
scripts/commands is validated against shell metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually
- Installed and uninstalled Okta Verify on a Windows host successfully.
Validated with:
- `python3 -m json.tool
ee/maintained-apps/inputs/winget/okta-verify.json`
- `python3 -m json.tool
ee/maintained-apps/outputs/okta-verify/windows.json`
- `python3 -m json.tool ee/maintained-apps/outputs/apps.json`
- `go test ./cmd/maintained-apps/... ./ee/maintained-apps/...`
- `GOOS=windows go build -o
/private/tmp/fleet-maintained-apps-validate.exe
./cmd/maintained-apps/validate/`
Additional verification:
- Verified the winget manifest for `Okta.OktaVerify` version `6.10.2.0`.
- Downloaded the Okta Verify installer and confirmed its SHA-256 matches
winget:
`065c6ad3ffc8551a29459d6cae4d06cd95a083ef716c18eb2e1215720a6b400a`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for installing and uninstalling **Okta Verify** on
Windows.
* Included app metadata so it appears in the maintained apps catalog.
* **Bug Fixes**
* Added safer install/uninstall handling, including silent execution,
better exit-code handling, and fallback cleanup when standard uninstall
entries are missing.
* Improved detection of existing installations and out-of-date versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A — part of the Windows Fleet-maintained apps
catalog expansion.
Adds two new Windows Fleet-maintained apps (the "digit" batch of the
Windows FMA workstream):
| App | winget package | Installer | Notes |
|-----|----------------|-----------|-------|
| 4K Video Downloader+ | `OpenMedia.4KVideoDownloaderPlus` | EXE (WiX
burn bundle), machine scope, x64 | Bundle registration extracted from
the installer: ARP `DisplayName` "4K Video Downloader+", `Publisher`
"InterPromo GMBH" (differs from the winget locale publisher "Open Media
LLC", so `program_publisher` is set). Registers TWO ARP entries with the
same DisplayName (the bundle and its chained MSI). The uninstall script
prefers the bundle entry and normalizes msiexec args when only the MSI
entry is present (validator-confirmed). Exact DisplayName matching keeps
it from touching the non-plus product. |
| 3DF Zephyr Free | `3Dflow.3DFZephyr.Free` | EXE (Inno Setup), machine
scope, x64 | Registry DisplayName is versioned ("3DF Zephyr Free version
8.038"), so the input uses `fuzzy_match_name: true`. The paid edition
registers as "3DF Zephyr version X" (no "Free") and is not matched.
Standard Inno silent switches. |
Also considered from this batch but **not** added:
- **4K Video Downloader** (`OpenMedia.4KVideoDownloader`, the classic
4.x app): verified and validated successfully, but intentionally dropped
— it's in maintenance mode and 4K Video Downloader+ is the actively
developed successor, so we're offering only the + app.
- **3DxWare 10** (`3Dconnexion.3DxWare.10`): the vendor bootstrapper
hung for 10 minutes and exited 1 with no output in the validator's
headless SYSTEM session (driver install), so it was dropped after the
first validation run.
- **3CX Desktop App** (`3CX.Softphone`): MSIX with an unversioned
`InstallerUrl` (`.../3CX.msix`) — the file at that URL is already a
newer build (20.0.1162.0) than the manifest's pinned version/SHA
(20.0.1102.0), so installs would fail hash validation. Can be revisited
with `ignore_hash` plus Windows-App-style MSIX provisioning scripts.
Installer SHAs in the outputs were verified against the winget
manifests. Icons generated via `tools/software/icons/generate-icons.sh`;
icon component names were adjusted to valid JS identifiers
(`ThreeDfZephyrFree`, `FourKVideoDownloaderPlus`) following the
`ZeroOneZeroEditor`/`FourK*` precedent.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [ ] QA'd all new/changed functionality manually (relying on the FMA CI
validator for Windows install/uninstall validation)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48685
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
- Tested `ShouldSendStatistics` method manually against our DB, which
covers all our changes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added anonymous usage statistics for the number of macOS and Windows
hosts currently enrolled in Fleet’s MDM.
* **Bug Fixes**
* Improved statistics accuracy by counting only actually enrolled,
non-server macOS and Windows hosts that are using Fleet’s MDM.
* **Tests**
* Updated and extended statistics tests to verify the new enrollment
counts are computed and reported correctly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for Apple declarative management declarations on both
System and User channels.
* User-scoped declarations are now delivered, reconciled, and
acknowledged independently from device-scoped declarations.
* **Bug Fixes**
* Prevented scope-mixing so declaration items and status updates no
longer affect the wrong channel.
* Tightened reconciliation behavior for scope changes and missing user
channels.
* **Tests**
* Expanded coverage for channel isolation, payload scope
parsing/validation, and correct delivery payload behavior (including
stripping the payload-scope field from delivered JSON).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48633
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Prevented duplicate profile enqueueing for hosts that share the same
hardware UUID.
* Reconcile processing now consistently picks the highest matching host
record when duplicates exist.
* Duplicate enrollment IDs are now filtered out before queueing,
reducing repeated work and avoiding queue conflicts.
* **Tests**
* Added regression coverage for duplicate-host and duplicate-enqueue
reconcile scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA — resolves high-severity code-scanning alerts in
`tools/`
Bumps the outdated `golang.org/x/net` and `golang.org/x/crypto` indirect
dependencies in the four `tools/` Go modules to clear 39 high-severity
code-scanning (SCA) alerts on `main`. Target versions match the root
Fleet
module.
| Module | x/net | x/crypto |
| --- | --- | --- |
| `tools/dibble` | v0.53.0 → **v0.55.0** | v0.50.0 → **v0.52.0** |
| `tools/hangar` | v0.53.0 → **v0.55.0** | v0.50.0 → **v0.52.0** |
| `tools/terraform` | v0.48.0 → **v0.55.0** | v0.46.0 → **v0.52.0** |
| `tools/github-manage` | v0.38.0 → **v0.55.0** | — |
CVEs cleared:
- **x/net v0.55.0**: CVE-2026-25681, -27136, -33814, -39821, -42502
- **x/crypto v0.52.0**: CVE-2026-39827, -39828, -39829, -39830, -39832,
-39835, -42508, -46595, -46597
All four modules `go mod verify` clean and build. Dependency-only change
to
internal dev tooling — no product code, no user-visible behavior.
> The remaining 8 high-severity alerts in `tools/` are OpenSSF Scorecard
> "Binary-Artifacts" findings for embedded dibble seed installers; those
are
> tracked separately and not addressed here.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated several bundled Go dependencies across internal tooling to
newer versions.
* This includes refreshes to common networking, cryptography, text, and
system packages, plus one added telemetry-related dependency.
* No user-facing features or behavior changes were introduced.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The original implementation (#8206) explicitly disabled this for offline
hosts until MDM command queueing was supported. That work has since been
completed, so offline macOS hosts now behave the same as iOS/iPadOS: the
unenroll command is queued and delivered when the device comes back
online.
**Related issue:** Resolves#25217
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* The "Turn off MDM" action is now enabled for offline macOS hosts.
Unenroll commands can be queued while a device is offline and will be
delivered automatically when it reconnects, matching the behavior for
iOS and iPadOS.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#38874
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added macOS enrollment details in the “Add hosts” flow, including a
clearer choice between **Personal (BYOD)** and **Company-owned**
devices.
* Shows a copyable macOS enrollment URL when MDM is configured, updating
the URL based on the selected device type.
* Keeps the macOS setup experience aligned with the enrollment method,
including packaging guidance when MDM isn’t enabled.
* **Tests**
* Added coverage for macOS enrollment URL rendering and device-type
switching in the “Add hosts” modal.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#40410
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`. See
[Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated (webhook Destination URL is now
validated on blur, matching the other URL fields in the app).
## Testing
- [x] QA'd all new/changed functionality manually
[qa-40410.webm](https://github.com/user-attachments/assets/eefdddf0-a6dd-47d0-b819-89e9ac99c6f1)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved “Destination URL” validation by checking the URL when the
field loses focus and surfacing invalid webhook URLs immediately.
* Validation and error display are now suppressed when vulnerability
automations are disabled or when GitOps mode is enabled, preventing
confusing blur-time errors.
* **Tests**
* Added automated coverage for blur-time URL validation, including
typing/clearing behavior, valid vs empty states, and GitOps mode
scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#31294
osquery-perf changes only
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added a certificate inventory simulation to the performance tool,
including stable shared certificates and per-host generated
certificates.
* Enhanced macOS and Windows rendering to better match expected
certificate query output (including user vs machine scope formatting).
* **Bug Fixes**
* Improved per-host certificate cache behavior with realistic
refresh/churn.
* Added support for duplicated certificate identities across different
scopes.
* **Chores**
* Updated linting configuration to suppress gosec findings for the new
certificate simulation workload.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48349, as well as a few other minor issues
found during dev (such as canonical LocURI, ensuring we delete the CSP
version actually on the device, etc.).
Load tested the fix.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Windows profile edits and deletions now handle large environments more
reliably, with faster processing and no size-based timeouts.
* Removed profile content is now cleaned up asynchronously, improving
the responsiveness of profile changes.
* **Bug Fixes**
* Fixed Windows profile edits so removed settings are deleted correctly
even when profiles are updated instead of fully removed.
* Improved matching for Windows configuration targets, making cleanup
more consistent across profile versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The #48760 fix is an orbit/fleetd change, so its changelog entry belongs
under orbit/changes/ rather than the server changes/ directory.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48760
**Related issue:** Resolves#48614
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
*Note: this is a frontend-only change; no backend endpoints, database
schema, or configuration settings were modified.*
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* On the **My device** page, the self-service category filter now hides
categories that have no installable software available for the host.
* Valid category selections are preserved during mid-load, and any
category from a shared link is only applied if it exists in the
currently available set.
* Category matching remains case-insensitive and supports both
package-based and app store software.
* **Tests**
* Expanded coverage for category filtering and dropdown rendering
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48746
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added a CI workflow to run build and race-enabled tests for dibble
changes.
* Included a dependency consistency check to ensure dibble’s Go module
files stay tidy.
* Configured CI concurrency to cancel in-progress runs for newer
changes.
* Updated dibble’s Go dependencies (indirect) to newer versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#48528
Follow-up to #48783, which changed the Fleet-maintained apps "items"
count from per-platform entries to per-app, dropping it from 1,263 to
1,023. This restores the count to `COUNT(DISTINCT fma.id)`: macOS and
Windows entries are separately installable (each its own Add button), so
each counts (1,263 / 960 macOS / 303 Windows). The token-based
row-combining and pagination from #48783 are kept.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected available-app counts in listings so pagination totals now
match what users can actually add.
* Improved pagination consistency for apps with multiple platform
variants, reducing confusion where totals did not align with visible
entries.
* Updated team-based filtering so already-added apps are excluded more
accurately from available results.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A
# Checklist for submitter
- [x] N/A: this is a `.claude/skills` addition (Claude Code tooling),
not a user-visible product change. No `changes/` entry, tests,
migrations, config settings, or fleetd/orbit changes apply.
## Summary
Adds a `fleet-guide-formatting` skill that captures the concise,
step-by-step structure established across Fleet's best how-to guides
(`articles/` with `category: guides`): short problem statement,
prerequisites, inline gotcha callouts, task-based or numbered steps,
optional verify/troubleshoot sections, and endmatter. It gives:
- A skeleton and checklist for writing new guides.
- An audit checklist for retrofitting existing guides, including a
litmus test for content mistagged as `guides` when it's structurally an
article (no prerequisites, no concrete steps).
- A fill-in `references/template.md` to start new guides from.
- A `references/canonical-examples.md` breakdown of the structural
choices made in several existing guides.
This is scoped to structure only. Voice, grammar, and word choice remain
the responsibility of the existing `content-style` skill;
`content-types.md`'s "Guides and tutorials" section now points to this
skill for the full skeleton and audit checklist.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48486
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Apple MDM devices manually re-enrolled during a pending SCEP renewal
are now handled as a fresh enrollment, so enrollment steps run
correctly.
* Renewal and re-enrollment flows are now better distinguished, reducing
cases where profile or app setup could be skipped.
* Enrollment certificates now carry clearer markers to help the system
apply the right lifecycle behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Relates to #43544
The Fleet MCP server runs multi-host live queries by creating an ad-hoc
campaign via `POST /api/v1/fleet/reports/run`, but that route is missing
from the API endpoints catalog. An api-only user restricted to a
specific endpoint allowlist therefore cannot be granted it and receives
a 403, so multi-host live queries fail under a least-privilege setup.
This adds the route to the catalog so it can be granted; it stays gated
by observer_plus RBAC and does not match any allowlist-bypass blocklist
rule.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for an asynchronous live report run endpoint.
* API-only users on restricted allowlists can now be granted access to
run reports.
* **Changes**
* Updated the live report endpoint path and display name to reflect the
async behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Follow up PR for community PR:
https://github.com/fleetdm/fleet/pull/45712.
- [X] QA'd all new/changed functionality manually
<img width="1574" height="827" alt="Screenshot 2026-07-06 at 1 54 44 PM"
src="https://github.com/user-attachments/assets/672d7b84-155f-4dab-8246-fe88e391e416"
/>
<img width="1235" height="827" alt="Screenshot 2026-07-06 at 1 54 01 PM"
src="https://github.com/user-attachments/assets/51df3344-b002-45df-9cda-afa573652944"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* OS settings and disk-encryption views now correctly include Zorin
devices in Linux-related results.
* Host filtering counts now account for Zorin alongside other supported
Linux platforms.
* Updated related checks so Zorin devices are handled consistently in
status and encryption reporting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#48077
Removes the admin/maintainer role gate from the "Show managed account"
host action so observers see it too. The backend
(`GetHostManagedAccountPassword`) authorizes any user who can read the
host, so observers can already retrieve the managed local account
password via the API — the UI gate only hid the action.
`canShowManagedAccount` now matches the other "show secret" host actions
(disk encryption key, Recovery Lock password), which are not role-gated;
the premium / macOS / connected-to-Fleet-MDM / ADE-enrollment /
managed-account-status conditions are unchanged.
Before (global observer, ADE-enrolled macOS host with a verified managed
account):
<img
src="https://raw.githubusercontent.com/raju249/fleet/screenshots-48077/before.png"
width="900" alt="Before: observer's Actions menu without Show managed
account" />
After (same host, same observer):
<img
src="https://raw.githubusercontent.com/raju249/fleet/screenshots-48077/after.png"
width="900" alt="After: observer's Actions menu with Show managed
account" />
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests — two cases in the existing "Show
managed account action" block asserting the action renders for a global
observer and a team observer (they fail against the old gate).
- [x] QA'd all new/changed functionality manually — ran a local server
with a seeded ADE-enrolled macOS host carrying a verified managed local
account row; logged in as a global observer: the action was absent
before the change and present after (screenshots above), and opening the
modal shows the managed account credentials, matching what the API
already returns to observers.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Expanded access to the **Show managed account** action for users with
observer-level host read permissions.
* The managed account option now appears correctly for global observers
and team observers when other eligibility checks are met.
* Improved consistency between what the interface shows and what backend
permissions allow.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41056
Follow-up documentation change for #41056. The unused Windows MDM STS
auth endpoint (`/api/mdm/microsoft/auth`) was removed in #48734, so this
removes it from the "what API endpoints to expose to the public
internet" guide:
- The "endpoints to expose" bullet in the Windows section, along with
its now-orphaned MS-MDE2 section 3.2 reference.
- The entry in the "these endpoints don't use mTLS" list.
Supersedes #41058, which removes the same two references but leaves the
section 3.2 sub-bullet dangling under `/api/mdm/microsoft/tos`.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually (verified no remaining
`/api/mdm/microsoft/auth` references in the article and that the
surrounding lists render correctly).
Documentation-only change: no code, automated tests, database
migrations, Fleet configuration settings, or fleetd/orbit/Fleet Desktop
impact.
[Slack
thread](https://fleetdm.slack.com/archives/C072L58U878/p1783362669331309?thread_ts=1783362528.927249&cid=C072L58U878)
for context.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the `Get /learn-more-about/uninstall-fleetd` redirect to send
visitors to the new uninstall guide location.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48760
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
Note: changes are Windows only; only verified/tested these items for
Linux and Windows
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue where some Windows MDM enrollment sessions could stay
queued or fail to start on certain devices.
* Improved detection of active Windows MDM enrollment, helping commands
run more reliably when enrollment is already present.
* **Tests**
* Added coverage for Windows enrollment detection to prevent
regressions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated app installation metadata for several maintained apps on macOS
and Windows, including AWS VPN Client, Beekeeper Studio, Discord, Loom,
MacWhisper, and Superwhisper.
* Improved version detection and download references so supported app
records point to the latest available releases.
* Refreshed package checksums to match the updated installers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Changes:
- updated the URL for the /gitops-workshop page to be /workshops, and
added a redirect
- Updated the workshops page to render cards for "Apple administrator
workshop" events
- Updated the content and layout of the /workshops page to match the
latest wireframes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Launched a new **Workshops** page with a refreshed hero and
carousel-driven experience.
* Updated upcoming workshops to label event type (e.g., GitOps vs Apple
administrator) and display event details with correct links.
* **Bug Fixes**
* Updated routing so the new Workshops page is the primary destination.
* Kept the old workshop URL working by redirecting it to the new page
(and ensured the page remains accessible without needing to be signed
in).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
Follow-up to #48817 (Gemini → Google Gemini rename).
Renames MacPaw's Gemini maintained app to "Gemini 2" (matching the
actual app, which installs as `Gemini 2.app`) and fixes the app icons
for both Gemini apps:
- `ee/maintained-apps/inputs/homebrew/gemini.json` and
`ee/maintained-apps/outputs/apps.json`: name and description updated to
"Gemini 2". The slug/token stays `gemini`.
- The existing `Gemini.tsx` frontend icon and the website's
`app-icon-gemini-60x60@2x.png` were actually Google's sparkle icon, so
MacPaw's app showed the wrong icon, and after #48817 "Google Gemini"
matched no icon key and fell back to the generic package icon.
- `Gemini.tsx` is renamed to `GoogleGemini.tsx`, and a new `Gemini2.tsx`
(generated from MacPaw's app bundle via
`tools/software/icons/generate-icons.sh`) is added.
- Icon map now resolves: `"gemini 2"` → MacPaw icon (FMA list + host
inventory), `"google gemini"` → Google sparkle (FMA list), `gemini` →
Google sparkle (host inventory, since Google's app installs as
`Gemini.app`).
- The website PNG for the `gemini` slug is replaced with MacPaw's icon;
`app-icon-google-gemini-60x60@2x.png` was already correct.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the app listing to show **Gemini 2** instead of Gemini.
* Added support for the new Gemini 2 branding across app icons and
display labels.
* **Bug Fixes**
* Improved icon matching so Gemini-related entries display the correct
artwork and naming.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48102
Changes:
- Renames `ExtractIPAMetadata` to `ExtractZIPMetadata` because the magic
bytes for zip based installers (.ipa, .msix, .zip, etc) are the same so
any zip file reaches it. If the zip does not contain an `Info.plist`
file it will now fail with `ErrInvalidType`.
- Did **NOT** make typeFromBytes return "zip" instead of "ipa" because
meta.Extension is set from that which has downstream effects.
- Added test files
The actual error message is still just "invalid file type".
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- Tested adding a valid `.ipa`, a macos FMA that uses a .zip file
(alt-tab/darwin), and a windows FMA that uses a .zip file
(vnc-server/windows).
- Tested an msix file (renamed or not) cannot be uploaded or edited for
an existing msi installer
- Also tested the same things via GitOps
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved installer type detection so ZIP-based packages are less
likely to be misidentified.
* Fixed an error message that incorrectly referred to the wrong file
type when detection fails.
* MSIX packages are now reported more accurately when they don’t match
IPA parsing rules.
* **Refactor**
* Cleaned up installer metadata handling for ZIP-based archives.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#47977
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the checkerboard chart so all future-timeframe cells render
with the “No data” styling, and their outlines align with the intended
visual treatment (including partially populated future slots).
* Ensured accessibility labels and tooltip/context for non-graded future
slots no longer suggest they are graded data.
* **Tests**
* Added regression coverage to verify “No data” styling and labeling for
the current “now” slot and the final future slot.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Updates the maintained app name from "Gemini" to "Google Gemini" in both
the input config and generated apps.json output, including the app
description.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated app release metadata for Cursor, Hive, OpenCode Desktop,
Postman, and Wavebox to reflect the latest available versions, download
links, and checksums.
* Adjusted installation status checks so these apps are detected
correctly after upgrading.
* Refreshed uninstall handling for Docker Desktop and Nova to use the
latest removal instructions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#43518
Adds a cross-platform alias `FLEET_MDM_ENABLE_DISK_ENCRYPTION`
(`mdm.enable_disk_encryption`) for the existing
`FLEET_MDM_ENABLE_CUSTOM_FILEVAULT` server configuration. When either
option is set, Fleet allows both custom Apple MDM profiles for FileVault
and custom Windows configuration profiles for BitLocker. Behavior
matches FileVault: no special conflict handling between Fleet's built-in
disk encryption controls and a custom profile. The setting remains Fleet
Premium only.
Both the single-add API/UI path and the batch/GitOps path are covered.
The existing `FLEET_MDM_ENABLE_CUSTOM_FILEVAULT` name continues to work
for backward compatibility.
Demo: https://www.youtube.com/watch?v=5naGaZKLZ8o
Docs: https://github.com/fleetdm/fleet/pull/48738/changes
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [x] Setting(s) is/are explicitly excluded from GitOps
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a cross-platform disk encryption setting that can enable custom
management for both macOS FileVault and Windows BitLocker profiles.
* **Bug Fixes**
* Windows BitLocker profile uploads are now accepted when custom disk
encryption is enabled.
* Startup now disables custom disk encryption management when the
license does not support it, and logs a warning.
* **Tests**
* Added coverage for BitLocker profile handling with custom disk
encryption enabled and disabled.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48805
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Preserve a user’s BYOD selection through IdP authentication so it no
longer gets lost mid-flow.
* Enrollment redirects to IdP SSO now retain the correct enrollment
query settings (including BYOD and fully managed) for consistent
enrollment behavior.
* **Tests**
* Added coverage to ensure the SSO initiation redirect preserves the
expected query parameters and returns the correct redirect response.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Magnus Jensen
