## What & why
The [role-based access
guide](https://fleetdm.com/guides/role-based-access) listed
custom-variables permissions that don't match what Fleet actually
enforces in `server/authz/policy.rego` (the "Secret variables" rules):
- **Write** (create/edit/delete) is allowed for global **Admin,
Maintainer, and GitOps** only — the guide incorrectly granted it to
**Observer, Observer+, and Technician**, and omitted **GitOps**.
- **Read** (view) is allowed for **all global roles, including GitOps**
— the guide omitted GitOps.
This updates the two rows in the global permissions table so they match
enforcement (and mirror the existing "queries" rows, which share the
same role logic).
### Source of truth
`server/authz/policy.rego` — Secret variables:
```rego
# Global admins, maintainers, and gitops can write secret variables.
subject.global_role == [admin, maintainer, gitops][_] # action == write
# Any global user can read secret variables.
subject.global_role == [admin, maintainer, gitops, technician, observer_plus, observer][_] # action == read
```
### Notes
- Found during a QA chaos-engineering review (originally reported
2026-03-25): the docs implied read-only roles like Observer could
create/edit/delete custom variables, which the UI/API don't allow.
- The separate "the RBAC guide calls the Reports page the Query page"
terminology cleanup is **not** included here — it overlaps the in-flight
Query → Report rename (#41419) and is better handled there.
- Docs/article-only change; no `changes/` entry needed.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated app metadata for MACE and Slicer on macOS to reflect newer
released versions.
* Refreshed download links and installer checksums so the latest
installers are referenced correctly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated package metadata for several maintained macOS apps, including
Acorn, BetterTouchTool, Brave Browser, Insomnia, opencode desktop,
Processing, and Signal.
* These updates point installers to the latest available versions and
refresh download checksums for safer installs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Extracts the `/api/` request timeout/body-size override middleware out
of `runServeCmd` and into `apiTimeoutOverrideHandler` in a new
`cmd/fleet/http_middleware.go`. Same pattern as the prior extractions on
this issue (#44929, #45343, #45583, #46166, #46421, #46517, #46742,
#46830, #46893, #47151, #47562). `runServeCmd` drops from ~1000 to ~900
lines, and `serve.go` from 1475 to 1373.
The middleware is the `~100`-line `rootMux.HandleFunc("/api/", ...)`
closure that applies per-route read/write deadline overrides for
endpoints that legitimately run long — synchronous script runs, large
software-installer and bootstrap-package uploads, the Android enterprise
signup SSE stream, and large MDM profile batch operations — and, for
package-upload routes, caps the request body and threads the configured
max installer size through the request context.
Behavior is preserved — the handler is moved verbatim and wired into
`rootMux` via a single `apiTimeoutOverrideHandler(apiHandler, config,
logger)` call, so the same routes get the same overrides and every
request still falls through to `apiHandler.ServeHTTP`. The now-unused
`scripts` and `installersize` imports drop out of `serve.go`.
On test scope: `TestAPITimeoutOverrideHandler` verifies the real
decision in this middleware — that package-upload paths thread the
configured max installer size into the request context (and non-upload
requests keep the default) — and that the wrapped API handler is always
invoked. The deadline overrides themselves go through
`http.ResponseController`, which a unit-test `ResponseRecorder` doesn't
support (the handler logs and proceeds, as in production), so those are
exercised by booting the server rather than asserted in a unit test.
**Related issue:** Refs #33370
# Checklist for submitter
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually (verified via local
server boot)
- Changes file: not applicable — internal refactor with no user-visible
behavior change
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved timeout handling for long-running operations across the API.
Script execution, file uploads, Server-Sent Event streams, and batch
operations now have optimized request timeouts and body size limits.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Refreshed the press kit comic illustration images with updated artwork
files.
* Adjusted illustration row spacing and improved accessibility text for
the illustrations.
* **UI Changes**
* Removed styling for the “continue” banner section, which may change
its appearance or how it’s presented on the page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated app metadata for multiple maintained apps across macOS and
Windows, including newer versions, download links, and checksums.
* Improved install status detection so the latest releases are
recognized correctly.
* Refreshed package entries for tools like Visual Studio Code, Vivaldi,
GitHub Desktop, Dropbox, Opera, Google Drive, PowerToys, and others.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** N/A
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Summary
Tightens validation in the conditional-access SCEP challenge middleware
to reject enrollment requests that use a secret outside the expected
scope. Adds unit test coverage for the middleware.
## Reproduction
The `challengeMiddleware` in `ee/server/service/condaccess/scep.go`
calls `ds.VerifyEnrollSecret()` but discards the returned secret (`_,
err :=`), so it only checks that *some* valid enroll secret exists. It
does not verify the secret's scope. Any valid secret from any scope
passes the challenge.
This was confirmed with a unit test using mock secrets scoped to
different teams. Before the fix, the middleware accepted all of them
indiscriminately. The server-side profile generation
(`server/service/conditional_access_idp.go`) only ever embeds a
global-scope secret as the SCEP challenge, so only global secrets should
be accepted.
## How it was tested
1. **Unit tests (`scep_test.go`)** - table-driven test with 5 cases
exercising the `challengeMiddleware` directly:
- Empty challenge -> rejected ("missing challenge")
- Unknown secret -> rejected ("invalid challenge")
- Team-scoped secret (team A) -> rejected ("invalid challenge") *[new
behavior]*
- Team-scoped secret (team B) -> rejected ("invalid challenge") *[new
behavior]*
- Global secret (team_id = nil) -> accepted, signer invoked, cert
returned
2. **Ran `go test -v ./ee/server/service/condaccess/`** - all tests
pass.
3. **Ran `make lint-go-incremental`** - 0 issues.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved validation for conditional access SCEP enrollment, including
rejecting team-scoped enrollment secrets.
* Updated challenge middleware behavior to better handle enrollment
secret verification outcomes and associated error messaging.
* **Tests**
* Added comprehensive coverage for conditional access SCEP challenge
validation, including cases for missing, unknown, team-scoped, and
global enrollment secrets, plus signer invocation expectations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Updates the claude backend rules to still allow some functions from the
server/ptr package. The constructor functions are deprecated but not all
the functions in the package are. For example: UintOrNilIfZero, Equal
and ValOrZero are still fine.
Updated healthcheck command to support TLS configuration. accompanying
env.example sets FLEET_SERVER_TLS=true by default but our default test
in docker-compose.yml tests to http. Causes test to fail.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Closes https://github.com/fleetdm/fleet/issues/46927
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated service health monitoring to correctly probe the health
endpoint over HTTPS when TLS is enabled, and over HTTP when it is not.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Closes#43673 (remaining issue reported by @getvictor
after PR #44873)
## Changes
The "My device" page / host details software tab sorts software by
`software_titles.name` (often an installer filename) instead of the
custom display name. PR #44873 fixed this for the global
`/software/titles` endpoint but missed the host-specific
`ListHostSoftware` query path.
**Fix:** Add a `LEFT JOIN software_title_display_names` to the outer
query wrapper in `ListHostSoftware`, and update
`hostSoftwareAllowedOrderKeys` to use
`COALESCE(NULLIF(stdn.display_name, ''), name)` so display names are
used for sorting when set.
**1 file changed:** `server/datastore/mysql/software.go`
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Dante Catalfamo <43040593+dantecatalfamo@users.noreply.github.com>
Update app name from 'kiro' to 'Kiro' in Homebrew input and generated
apps output to match proper app branding.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48182
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Fix handling of Fleet-maintained apps that share a macOS bundle
identifier (e.g. Firefox and Firefox ESR). Removed the blind rename from
UpsertMaintainedApp and added ReconcileMaintainedAppSoftwareNames: a
two-pass, idempotent reconciliation that (1) renames titles tied to a
single FMA via installer links and (2) heuristically renames by bundle
identifier only when the identifier maps to exactly one FMA name.
Updated team join logic to prefer matching by installer link and fall
back to bundle identifier, changed GetFMANamesByIdentifier to omit
ambiguous identifiers, added a call to reconcile during the
maintained-apps sync, and extended the datastore interface and mock
accordingly. Added tests and a manifest check for known shared
identifiers, plus a changelog entry.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42445
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
* Fixed an issue where macOS apps sharing a bundle identifier (e.g.,
Firefox and Firefox ESR) would incorrectly report each other as already
installed and could have their software titles unexpectedly changed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45641
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. In other subtask.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added support for tracking and displaying “ran custom MDM command”
activities across dashboard and host activity feeds.
* Added custom MDM command detail modals with status-aware messaging,
actor attribution, target host, and relative “time ago” updates.
* Improved command name rendering by shortening long request types for
cleaner display.
* **Bug Fixes**
* Enhanced command status handling for additional Apple and Windows
status formats so icons and verbs display correctly.
* **Tests**
* Added coverage for custom MDM command rendering and command-status
helper behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47348
Does two things:
- Removes the software_installers and software_titles joins. These could
be null, but we would still want to create software install records for
these installs even if the installer or title were deleted.
- Changes every case where a host_software_installs is deleted into
setting the canceled flag to 1 on that row.
It also updates some comments. `deletePendingSoftwareInstallsForPolicy`
had a comment that said it should be called _after_ deleting a policy,
but that seems wrong and was not actually reflected in the code even
when it was originally added. It should be called _before_ deleting the
policy so that the siua.policy_id column is still available before it
gets set to null by the FK constraint. Same for
`deletePendingHostScriptExecutionsForPolicy`.
Also removes the `NOTE(mna): ...` comment, because it seems like the
code works as intended and only the comments were wrong.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Prevented a 500 error when late software installation results are
reported after the related installer has been deleted.
* Pending software install entries are now preserved as **canceled**
(instead of being deleted) during installer, policy, and batch update
flows, keeping results consistent.
* Improved correctness of intermediate failure recording and
setup-experience deletion behavior, including distinguishing
**canceled** vs **removed** installs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes: https://github.com/fleetdm/fleet/actions/runs/28003942578.
New run: https://github.com/fleetdm/fleet/actions/runs/28026451929.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Improved test fixture logic for more reliable test execution.
**Note:** This release contains internal testing improvements with no
end-user-facing changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated GitHub review automation configuration, modifying approver
assignments for the handbook/marketing section and updating contributor
access for the website/views section.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
When creating a fleet or global policy from an existing query (via
query_id) load the referenced query and authorize ActionRead on it
before its fields are copied, in both fleet policies and global
policies.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Google Chrome macOS configuration to target version
`149.0.7827.197`, ensuring version checks and patched status indicators
align with the latest available build.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Chores
* Updated MacPacker to version 0.15.4
* Updated REAPER (Windows) to version 7.75
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated version metadata, installer URLs, and checksums for 24 managed
applications (including BetterTouchTool, Bruno, Claude, Cursor, Element,
Microsoft Office apps, PyCharm, Slack, and others) to support latest
releases and improve version detection accuracy.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Changes:
- Updated the custom `<ol>` marker we use in Markdown content to not
break onto multiple lines.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Fixed list numbering display across multiple pages (articles,
webinars, whitepapers, case studies, documentation, handbooks, and legal
pages) to prevent counter text from wrapping.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A — follow-up cleanup to #46406 (Add Hangar).
## What & why
Fleet Hangar is a macOS-only, GUI-only dev tool built natively, but the
Wails v3 project template left behind config for modes/platforms it
never uses. None of it was referenced by CI, scripts, or the documented
build flow (`dev` / `build` / `package` / `dist` / `sign`).
Removed:
- **Server-mode + Docker tasks** (`build:server`, `run:server`,
`build:docker`, `run:docker`, `setup:docker`) in the root and common
Taskfiles. They point at `build/docker/Dockerfile.{server,cross}`, which
don't exist, and there is no `server` build tag anywhere in the Go code.
- **Docker cross-compilation** in `build/darwin` (`build:docker`,
`CROSS_IMAGE`, the `build:universal` `lipo:go` fallback). `build:` and
`build:universal` now call the native macOS paths directly.
- **iOS tasks** (`ios:device:list`, `ios:run:device`) — no iOS project
exists.
- **`frontend:vendor:puppertino`** — fetched CSS into
`frontend/public/puppertino` and rewrote `index.html`; none of those
targets exist and no task called it.
- **`.gitignore`** lines for `build/linux` and `build/windows` (neither
dir exists).
- **`config.yml`** template placeholders (commented `ios` /
`fileAssociations` blocks, the `My Other Data` `other` entry).
The darwin signing vars (`SIGN_IDENTITY`, `KEYCHAIN_PROFILE`,
`ENTITLEMENTS`) are now declared as empty strings instead of comments,
so removing `CROSS_IMAGE` doesn't leave `vars:` as a null mapping (which
the Taskfile schema rejects). Behavior is unchanged — the `sign:`
preconditions still guard on non-empty values.
Net: **11 insertions, 280 deletions** across 5 files. No change to the
real build flow.
## Testing
- Verified with `task build` — exit 0, produces `bin/fleet-hangar`
(arm64 Mach-O).
- `task --list-all` parses all three Taskfiles with no schema errors and
no dangling task references.
## Checklist
- [x] QA'd manually (`task build`)
No changes file: `tools/hangar` is an internal dev tool, so this is not
a user-visible change.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Simplified build configuration by removing Puppertino CSS integration
and server/Docker/iOS build tasks.
* Updated development task with improved process management to prevent
orphaned processes.
* Streamlined macOS build process to native-only implementation,
removing cross-compilation support.
* Cleaned up build configuration files and project ignore patterns.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
**Related issue:** Resolves#36774
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Certificate templates now support additional variables for subject
names and SANs, including host platform and identity-provider-derived
fields such as username (local part), groups, department, and full name.
* **Bug Fixes**
* Improved validation and error handling for missing host or
identity-provider data during template variable substitution.
* **Tests**
* Expanded coverage for supported/unsupported variables, correct
placeholder replacement, caching behavior, and RFC 4514 escaping in
DN-related values.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated managed-app versions and installer metadata across macOS and
Windows, including cmux (0.64.17), Firefox (152.0.2), Granola (7.356.2),
Lens (2026.6.231104-latest), Power Automate (2.69.00217.26166), PreForm
(3.60.2.639), and Workflowy (4.3.2606230837), with refreshed download
links and verification checksums.
* Marked Adobe Acrobat Pro as frozen.
* **Bug Fixes**
* Improved Power Automate uninstall reliability by switching to the WiX
Burn bootstrapper-based uninstall flow.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
