## Summary
- `pkg/patch_policy/GenerateQueryForManifest` now wraps the
caller-supplied exists query in an inner set of parentheses before
appending the trailing `AND version_compare(...) < 0` clause. Without
the wrap, any `OR` in the exists body binds *after* the appended `AND`
(SQL precedence: `AND` > `OR`), producing an incorrect `patched` query.
The bug is currently only observable on `codex-cli` (uses `path = ... OR
path LIKE ...`) but would silently break any future FMA whose exists
query contains `OR`.
- All FMA outputs regenerated via `cmd/maintained-apps`. For AND-only
exists queries (the vast majority of existing FMAs), the new patched SQL
is semantically identical to the previous form — just with extra parens
around the WHERE body. `codex-cli/windows.json`'s OR clause is now
correctly grouped.
- `docker-desktop` is unchanged: its patched SQL is constructed inline
in the homebrew ingester at
[ingester.go:198-201](https://github.com/fleetdm/fleet/blob/claude/compassionate-merkle-afbd8a/ee/maintained-apps/ingesters/homebrew/ingester.go#L198-L201)
and bypasses the generator.
### Heads-up: upstream version drift bundled in
The regeneration also pulled in a handful of upstream version bumps that
landed since the last FMA run. These are real upstream changes, not
generator artifacts:
| App | Platform | Old → New |
|---|---|---|
| Figma | windows | 126.3.12 → 126.4.9 |
| GoLand | darwin | 2026.1.1 → 2026.1.2 |
| IntelliJ IDEA | darwin | 2026.1.1 → 2026.1.2 |
| RubyMine | darwin | 2026.1.1 → 2026.1.2 |
| Zed | darwin | 1.2.5 → 1.2.6 |
If you'd prefer these isolated from the paren-only change, let me know
and I'll split the PR.
### Code changes
- [pkg/patch_policy/patch_policy.go](pkg/patch_policy/patch_policy.go):
added `(` to `templateStart` and `)` to `templateEnd{Darwin,Windows}` so
`GenerateQueryForManifest` emits `... NOT EXISTS ((<before>) AND
version_compare(...) < 0);`.
-
[pkg/patch_policy/patch_policy_test.go](pkg/patch_policy/patch_policy_test.go):
updated existing expectations and added an OR-precedence case mirroring
codex-cli's exists query.
-
[ee/maintained-apps/ingesters/homebrew/ingester_test.go](ee/maintained-apps/ingesters/homebrew/ingester_test.go):
updated the generic `Patched` assertion (docker-desktop's hardcoded
expectation is unchanged — it bypasses the generator).
- 282 regenerated files under `ee/maintained-apps/outputs/**/*.json`.
## Test plan
- [x] `go test ./pkg/patch_policy/...` passes (incl. new OR case).
- [x] `go test ./ee/maintained-apps/...` passes.
- [x] `go vet ./pkg/patch_policy/... ./ee/maintained-apps/...` clean.
- [x] `cmd/maintained-apps` runs end-to-end with no errors against the
live Homebrew/winget APIs (with `NETWORK_TEST_GITHUB_TOKEN` set).
- [x] `git diff` audited: every diffed `patched` line on
`outputs/**/*.json` is a paren-only delta; non-`patched` deltas confined
to the 5 upstream version bumps listed above.
- [x] `docker-desktop/darwin.json` unchanged after regeneration.
- [ ] CI green.
Changes:
- Moved the files for four pages (linux-management, basic-comparison,
deployment, and gitops-workshop) out of the landing pages folder.
- Added policies for the moved pages
- Updated the URLs for pages in the landing pages folder to be prefixed
with /lp/, and added redirects that preserve query strings when
redirecting users.
- Created a section in the routes configuration for landing pages
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Implemented /lp/* landing-page paths with 301 redirects from legacy
URLs (query strings preserved).
* Added public access exceptions so selected marketing pages are
reachable without login.
* **Refactor**
* Reorganized routing and page templates to move several pages out of
the previous landing-pages area into dedicated page paths.
* Updated included page scripts and style imports to match the
reorganized pages.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45632)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added comprehensive support for managing Codex CLI (OpenAI's coding
agent) on Windows systems, including automated installation,
uninstallation, and verification that installed binaries match expected
versions
* Integrated Codex CLI icon component into the software interface for
improved visual identification and enhanced user experience when
managing this application
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/42397)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38785
- UI changes per Figma and latest product guidelines
- Do not cancel setup experience during BYOD (when critical software
install fails)
- Allow a host to rerun setup experience even if it has been in Fleet
for over 24 hours
- This fixes a bug where a host is wiped but not deleted from Fleet, and
then it doesn't run setup experience.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved Windows re-enrollment detection to better handle BYOD
scenarios, preventing unintended cancellation of pending setup steps for
recently re-enrolled devices.
* Added a fallback lookup for unlinked Windows enrollments to improve
enrollment matching.
* **Bug Fixes**
* Clarified cancellation activity messages to note when users are asked
to restart after install failures.
* Updated Windows install copy and tooltips based on enrollment status.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45331)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Luke Heath <luke@fleetdm.com>
- **Adding vpp users table**
- **Adding ManagedAppleID to HostMDM tables to pull when installing vpp
apps to a BYOD user enrolled device**
- **Adding user create vpp apis**
- **Updating install application to support user enrolled devices**
- **Handling already installed gracefully**
- **Adding provision user logic**
- **Adding logic to associate assets on install**
- **Add license managemnt logic**
- **Adding self service ui**
- **Adding setup experience support**
- **Adding setup experience flow**
- **Fix issue with fleet's docker image in k8s environments (#44373)**
- **Changing how the appleid is captured to use idp mdm users**
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Account-based User Enrollment (iOS/iPadOS) supports VPP and in‑house
.ipa installs, including self‑service installs.
* Enrollment now applies the selected Setup experience automatically for
user‑enrolled hosts.
* Installs and license associations are scoped to account user
associations (user‑scoped installs).
* **Bug Fixes**
* Improved error messaging for license/association failures (including
per‑user device cap cases).
* Mobile UI: self‑service now shows user‑enrolled iOS/iPadOS apps.
* “Already installed” install results are treated as acknowledged
successes.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45202)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves https://github.com/fleetdm/confidential/issues/15906
Rewrite README to align with Fleet's current positioning.
Key changes:
- Rewrote "What's it for?" to lead with MDM, remove company names, and
avoid osquery terminology
- Moved "Is it any good?" above "Lighter than air" so readers see
production credibility and capabilities before philosophy
- Restructured "Is it any good?" subsections to reflect top buying
reasons and align with
[why-fleet?](https://fleetdm.com/docs/get-started/why-fleet)
- Consolidated Chat section with link to fleetdm.com/support
- Removed Twitter/X Follow badge from Contributing
- Removed "The landscape of IT and cybersecurity" tagline from
Contributing
- Toned down "What's next?" opener
- Moved tagline below the image
- ~6% shorter overall, while adding substance (741 → ~720 words)
Resolves#45220 (one of many small PRs, we are close)
## Testing
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Refactored test infrastructure for scheduling components to use
centralized test utilities.
---
**Note:** This release contains no user-facing changes. All
modifications are internal testing and code organization improvements.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45609)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45330
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
so many
- [X] QA'd all new/changed functionality manually
- [X] was able to set gitops mode to enabled via `fleetctl gitops`
- [X] attempting to set gitops mode w/out repository_url in `fleetctl
gitops` failed w/ helpful error
- [X] attempting to set gitops mode w/ invalid repository_url in
`fleetctl gitops` failed w/ helpful error
- [X] attempting to set gitops exceptions in `fleetctl gitops` failed w/
helpful error
- [X] was able to unset gitops mode via `fleetctl gitops`
- [X] leaving `gitops:` blank in `fleetctl gitops` left the mode
untouched (it would retain its previous value)
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
it is not, but it's not a requirement here and leaving it out is a no-op
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
it is not, nor should it be, as that would clear gitops mode on every
customer currently using it
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
n/a, you still need to be able to do gitops mode in the UI
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* GitOps mode and repository URL can now be set via GitOps YAML.
* **Bug Fixes**
* Server preserves existing GitOps settings during config updates;
requires repository URL when enabling and rejects unsupported exceptions
in GitOps YAML.
* **Tests**
* Added tests covering apply behavior, YAML validation, activity
emission on mode changes, and license-restricted rejection on free tier.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45537)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Improve Camtasia uninstall handling by updating trash() to glob-expand
target paths (using compgen), iterate matches (preserving spaces), and
move each found file/symlink to the user's Trash with unique
timestamp+rand+index suffixes. If no matches are found the script now
reports the path doesn't exist. Also update darwin.json to point to the
new uninstall script ref (252f6f0e) and include the updated script
content in the refs section.
Clarify attribution framework and SFDC implementation: fix typos and
wording, distinguish first-touch vs converting-touch behavior, and add
detailed SFDC field mapping for Contact/Lead and Opportunity records.
Document the automation flow that derives L1/L2 from campaign codes,
stamps first-touch, adds campaign members, and copies Most Recent values
into Opportunity Converting fields on creation. Also standardize
campaign examples/naming, correct table headers (Psystage legacy) and
picklist name (Marketing_Email_Status__c), and tidy miscellaneous
examples and status definitions.
Register XCreds as a maintained app: add Homebrew cask (Casks/xcreds.rb)
and API/input JSON, add app metadata
(ee/maintained-apps/inputs/homebrew/xcreds.json), and include outputs
(apps.json and outputs/xcreds/darwin.json) with installer/uninstall
scripts and checks. Also add frontend icon component and asset
(XCreds.tsx, app-icon-xcreds-60x60@2x.png) and wire the icon into the
icons index mapping.
Resolves#45220 (one of several PRs, we are very close)
## Testing
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Improved test infrastructure for the CLI: consolidated and renamed
test helpers, added a dedicated in-process CLI test helper, and updated
many test cases to use the new helpers.
* Tightened several test assertions and standardized output/error
validation across unit and integration tests to improve reliability.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45585)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Reviewed with Mike T - colors are ok for landing page.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Launched the "Open Source" landing page with hero, CTAs, terminal
install snippet, feature sections, handbook callout, FAQ (with JSON‑LD),
interactive visuals and client-side page wiring.
* **Styles**
* Added comprehensive responsive styles across desktop and mobile
breakpoints.
* **UX**
* Testimonials are now reordered using a prioritized list to surface key
contributors.
* **Routing**
* New public route exposes the landing page and includes page metadata.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45453)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
Typo fix in confirm and celebrate changes from "Up the requester" to "Up
to the requester"
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
