<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43997
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Configure Orbit to enable debug logging for a limited window on agent
enrollment; enrolled hosts receive debug/verbose behavior while the
window is active and it is reflected in agent config.
* **Chores**
* Added database column to record per-host debug-until timestamps and
datastore support to extend it safely.
* **Tests**
* Added integration and unit tests covering validation, enrollment
stamping, config generation, and runtime debug toggling.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45367)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Closes#43673
## Changes
Sorts the `/software/titles` endpoint by display name (when set) instead
of the internal `software_titles.name` (often an installer filename).
**3 changes in `server/datastore/mysql/software_titles.go`:**
1. **Order key mapping** (line 24): `"name"` sort key now maps to
`COALESCE(NULLIF(stdn.display_name, ''), st.name)` — uses display name
when set, falls back to `st.name`. `NULLIF` ensures cleared display
names (empty string) are treated as unset.
2. **Secondary sort** (line 579): Same `COALESCE(NULLIF(...))`
expression for tie-breaking when sorting by a non-name column.
3. **LEFT JOIN** (line 635): Joins `software_title_display_names` so the
COALESCE expressions can resolve.
## Testing
### Manual testing
Inserted test software titles with display names that sort differently
from installer filenames. Confirmed:
- Before fix: sorted by internal `st.name` (installer filename)
- After fix: sorted by display name, with fallback to `st.name` when no
display name is set
- Verified with `order_direction=asc`, `desc`, and secondary sort via
`hosts_count`
### Unit tests
`server/datastore/mysql/software_titles_sort_test.go` — 5 subtests (no
MySQL required):
- Order key mapping uses `NULLIF` for empty display names
- Secondary sort uses `NULLIF` for empty display names
- Primary name sort doesn't add redundant secondary name sort
- SQL template includes `display_names` join
- Empty display name falls back to `st.name` in sort expression
SQL fixture (`select_software_titles_sql_fixture.gz`) regenerated to
match updated queries.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Software titles listing now sorts by team-specific display names when
present, falling back to default names; tie-breaking and overall sort
behavior refined for more consistent ordering.
* **Tests**
* Added tests validating display-name sorting, correct fallback for
empty names, secondary sort behavior, and generated query structure to
ensure consistent results.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44873)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Updated the link for the static SCEP challenge guide to the correct URL.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves
https://github.com/fleetdm/fleet/issues/30674
Uncomment the icon block for the Touch ID software entry in
it-and-security/fleets/workstations.yml so the icon path
(../lib/all/icons/touch-id.png) is active. This restores the UI icon for
the Security category entry without changing other fields.
## Problem
Android hosts show different timestamps for **Last seen** and **Last
fetched** on the host details page. For Android devices (which don't use
osquery check-in), both values should match because they're updated by
the same MDM sync operation.
Fixesfleetdm/fleet#43195
## Root Cause
`host_seen_times` is the table that powers the `seen_time` (Last seen)
value. For regular hosts, this is updated by osquery check-in. Android
hosts never populated this table, so `seen_time` fell back to
`hosts.created_at`, causing a mismatch with `detail_updated_at` (Last
fetched).
## Changes
- **`NewAndroidHost`** — after inserting the host, also insert into
`host_seen_times` with the same `detail_updated_at` value.
- **`UpdateAndroidHost`** — after updating the host, upsert
`host_seen_times` with the new `detail_updated_at`.
- **New test `AndroidLastSeenMatchesLastFetched`** — verifies
`host_seen_times.seen_time` matches `detail_updated_at` for both
`NewAndroidHost` and `UpdateAndroidHost` paths.
## Testing
- Added `testAndroidLastSeenMatchesLastFetched` covering both paths.
- Existing Android datastore tests should continue to pass.
---
*This PR was created with AI assistance.*
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Host list now shows "Last seen" in a platform-aware way; mobile hosts
display "Last seen: Not supported" instead of unreliable timestamps.
* Hostname entries now include platform info so last-seen display is
accurate across device types.
* Improved consistency in last-seen rendering across the hosts table.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44628)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Wahaj Ahmed <wahajahmed010@gmail.com>
**Related issue:** Resolves#44804
This does not bulk every sql command, for simplicity.
It does not bulk profiles with variables in them, those containing
$FLEET_VAR_* placeholders. These still use individual command INSERTs
per host.
Remove commands are also not bulk-inserted because each removal requires
computing activeLocURIs which varies per profile and can result in nil
commands that should be skipped.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Reconciler now pre-builds and bulk-inserts Windows MDM commands for
non-variable install profiles, reducing repeated writes and improving
batching/enqueue efficiency.
* Streamlined enqueue + host-profile upsert flow to handle pre-inserted
commands and batch host processing.
* **Tests**
* Added tests for bulk command insertion, duplicate-command handling,
and end-to-end enqueue/upsert behavior.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45401)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Include a 'Press Release' (PR) row in the paid/owned media naming
conventions table with example `2025_11-PR-Abc_launch`. This documents
the campaign prefix for press releases alongside existing Paid media,
Content syndication, and Email marketing entries.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45258
The change to zero time is conventionally consistent with the rest of
the codebase, and produces zero observable behavior differences anywhere
I could find except for the cleanup SQL (which is the bug being fixed).
Decided not to do a migration since we do not expect hosts to actually
stick around with the `1970-01-02` value, and we have not heard about
this issue from customers.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Resolved an issue where hosts were being automatically deleted and
re-enrolled repeatedly when host expiry cleanup was enabled.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45471)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44288
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new "Learn More About Apple Setup Assistant" link that directs
users to Apple's official support documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43984
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the setup experience "Users" card to explain automatic
creation of local accounts via identity provider credentials (PSSO),
improving clarity for admins.
* **Documentation**
* Added a learn-more link to PSSO local account documentation from the
Users card.
* **Style**
* Improved spacing and description layout within the Users card for
better readability.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45023)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
### Context
Fix typo in Fleet's docs
(https://fleetdm.com/handbook/company/communications#document-titles)
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Resolves#45220 (one of several PRs to achieve removing "testing"
package as dependency in production binary)
## Testing
- [x] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Switched many tests to use a dedicated MySQL test helper package and
consolidated test-only utilities for datastore setup, cleanup, ad‑hoc
SQL, certificate generation, and activity/aggregation helpers.
* Added expanded test utilities for replication, DB connections and test
data seeding to improve integration-test reliability.
* **Chores**
* No production behavior or user-facing APIs were changed.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45406)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#43294.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue where host team assignments were not persisting during
re-enrollment. Team assignments are now sticky and remain unchanged when
hosts re-enroll using a different team's enrollment secret, ensuring
consistent team ownership across re-enrollments.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45339)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes#44630
## Summary
- After a fresh Fleet install (`fleet prepare db` + `fleetctl setup`),
`enable_host_users` persisted as `false` despite the documented and
coded default being `true`.
- **Root cause**: During setup, `NewAppConfig` correctly saves
`enable_host_users: true`. However, the starter library then runs
`fleetctl gitops` with a template that has no `features` section. In
`DoGitOps`, when `features` is absent, an empty features map is created.
`enable_software_inventory` was explicitly defaulted to `true`, but
`enable_host_users` was not. The overwrite-mode PATCH then reset
`enable_host_users` to `false` (Go's bool zero value).
- Adds the same defaulting logic for `enable_host_users` as exists for
`enable_software_inventory`, in both the global and team config paths in
`DoGitOps`.
## Test plan
Reproduced locally before and after the fix with a Fleet server +
osqueryd agent (osquery 5.23.0):
**Before fix:**
1. Created a fresh database, ran `fleet prepare db`, started `fleet
serve --dev`, ran `fleetctl setup`.
2. Checked DB: `enable_host_users` was `false` (bug).
3. Enrolled a local osqueryd agent against the server.
4. Queried the host details API: `users` field was `null` (user
collection disabled).
5. Confirmed `features.enable_host_users: false` via `GET
/api/latest/fleet/config`.
**After fix:**
1. Same steps with the fixed binary.
2. Checked DB: `enable_host_users` was `true` (correct).
3. Enrolled a local osqueryd agent against the server.
4. Queried the host details API: `users` field contained 3 collected
users (root, sharonkatz, testuser) -- user collection working.
5. Confirmed `features.enable_host_users: true` via `GET
/api/latest/fleet/config`.
**Unit tests:**
- [x] `TestGitOpsFeatures` -- updated assertion to expect
`enable_host_users: true` when features are omitted from GitOps YAML
(was previously testing the broken behavior).
- [x] All `TestGitOps*` tests pass (`go test ./cmd/fleetctl/fleetctl/
-run TestGitOps`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
* Fixed default host user collection behavior on fresh Fleet installs.
Host user collection now correctly defaults to enabled, matching
documented settings and ensuring the host details page displays accurate
collection status information instead of incorrectly showing it as
disabled.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45393)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated version tracking metadata for maintained applications to align
with the latest available releases across macOS and Windows platforms.
Includes updates for Balena Etcher, Box Drive, Brave Browser, Cursor,
Docker Desktop, Loom, Rancher Desktop, Spotify, Tailscale, Webex, and
Zed. Metadata now reflects current stable versions.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45447)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
For apple mdm search terms
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Launched a dedicated Apple Device Management landing page with hero,
marketing sections, testimonials carousel, and bottom CTA.
* Added embedded video modal and client-side page behavior for
interactive presentation.
* Included page-specific styles and ensured the page is served at
/imagine/apple-mdm with updated route metadata.
* **Chores**
* Injected the new page bundle into the global layout.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45392)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
Enable strict shell flags and add a trap-based cleanup for DMG
mountpoints to ensure detach and removal on exit. Add explicit error
handling for hdiutil attach (fail fast with message) and reset
MOUNT_POINT after detach. Harden app quit/relaunch logic by using safer
variable assignments, providing fallbacks for osascript/stat, and
returning explicit status codes. Minor safety improvements (sudo cp, set
-euo pipefail) to make the installation script more reliable.
@eashaw, I also updated the intent signals for the receive-from-clay.js
to match create-historical-event.js
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Improvements**
* Expanded system support for tracking additional customer interaction
types, including training attendance, meetings, forms, account updates,
and marketing activities.
* Added new event type for swag requests.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45443)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds a new entry to the "Why this way?" handbook page explaining why
Fleet enforces `min-release-age` in `.npmrc` as a supply-chain security
measure.
- Covers the rationale (short delay catches compromised packages before
they're pulled), why the delay is intentionally short (30 minutes), and
why Fleet requires npm v11.10.0+ with policy-based compliance.
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/C071NNMSP2R/p1778605151595179?thread_ts=1778604726.978409&cid=C071NNMSP2R)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45405
The serial numbers are currently unused (they are only for debug), so we
are making a hard switch to hex without a migration.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Fixed Android agent certificate serial number reporting to use
hexadecimal format for proper Fleet compatibility.
* **Tests**
* Added test coverage to ensure certificate serial numbers are correctly
encoded as hexadecimal when reporting status.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45413)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated pricing features table with new capabilities including
enhanced zero-touch setup with break-glass account options, OS settings
enforcement using Fleet variables, GitOps-based application deployment
with version pinning, iOS passcode clearing for lock and wipe commands,
vulnerability exposure dashboard widget, expanded continuous scanning
coverage, API-only user creation with endpoint-scoped access, and new
certificate deployment options.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45426)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request improves the handling and installation of Docker
Desktop in Fleet, with a focus on addressing issues caused by leftover
`.back` app bundles after in-app updates. It also introduces a custom
installation script for Docker Desktop to ensure correct app replacement
and relaunch behavior. The test coverage and configuration for Docker
Desktop have been updated accordingly.
**Docker Desktop patch policy and installation improvements:**
* Updated the patch policy query for Docker Desktop in `ingester.go` to
ignore any `.back` app bundles, preventing false "out of date" patch
status when stale bundles are present after self-updates.
* Added a custom install script (`docker_desktop_install.sh`) that
safely quits Docker Desktop, removes `.back` bundles, moves the new app
into place, relaunches the app if it was running, and sets up CLI
symlinks.
* Linked the new install script in the Docker Desktop Homebrew input
JSON (`docker-desktop.json`).
* Updated the Docker Desktop output JSON to use the improved patch query
and reference the new install script.
**Test enhancements:**
* Expanded test coverage in `ingester_test.go` to include Docker
Desktop, verifying the correct patch and exists queries for this special
case.
[[1]](diffhunk://#diff-82958e1ecc7af4c2032fcb933320788e6f5e663eb18ee6cc83df106f4df960e0L90-R90)
[[2]](diffhunk://#diff-82958e1ecc7af4c2032fcb933320788e6f5e663eb18ee6cc83df106f4df960e0R123)
[[3]](diffhunk://#diff-82958e1ecc7af4c2032fcb933320788e6f5e663eb18ee6cc83df106f4df960e0R153-R164)
Resolves#41985
Fixed issue were hosts migrated from another MDM via the macOS Tahoe
end-user authentication flow had only the IdP email populated on host
details because the SCIM user mapping was never created at
OTA-enrollment ingest time.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated version metadata and installer checksums for 12 maintained
applications including Camtasia, Cavalry, Docker Desktop, draw.io,
Google Chrome, Google Drive, Intune Company Portal, Microsoft Teams,
Ollama, Visual Studio Code, Warp, and WhatsApp.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45395)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Resolves#45220 (one of many PRs)
## Testing
- [X] QA'd all new/changed functionality manually.
Smoke tested upload/download of software installers, upload/download of
bootstrap packages.
**Related issue:** Resolves#45220 (one of many PRs)
## Testing
- [X] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Test utilities moved into test-only files and removed from production
code, reducing runtime dependencies and tightening module boundaries.
* **Tests**
* Updated test setup to use internal test helpers and explicit Redis
test setup, improving test isolation and reliability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
to be published in landing page folder and not linked from the main
navigation
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an Autonomous Endpoint Management landing page with full
marketing content, capability highlights, autonomous patching workflow,
GitOps messaging, and demo CTA.
* Includes a scrollable testimonials section, responsive styles across
breakpoints, and an interactive video modal.
* Page is reachable via a new route and loads the required client script
and styles.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45342)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: johnjeremiah <jjeremiah@gmail.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
Remove unnecessary surrounding double quotes from the `resolution` field
in
it-and-security/lib/all/policies/npm-supply-chain-compromised-packages.yml.
This cleans up the YAML and prevents literal quote characters from
appearing in rendered output; no functional change to the resolution
text.
Delete the explicit 'platform: darwin,linux,windows' line from the
hosts-with-npm-package-inventory label so the dynamic label applies
regardless of OS. The label still uses the same query (SELECT 1 FROM
npm_packages LIMIT 1) and remains dynamic; this change prevents
unintentionally excluding platforms.
Second PR in the staged plan from
[#33370](https://github.com/fleetdm/fleet/issues/33370#issuecomment-4394807680).
Per [@getvictor's
confirmation](https://github.com/fleetdm/fleet/issues/33370#issuecomment-4421816049),
takes the package-level var approach so tests can swap `initFatal`
without terminating the test binary.
The new `TestGetTLSConfigInvalidProfile` covers `getTLSConfig`'s default
case (previously unreachable in tests because it calls `initFatal`)
**Related issue:** Part of #33370.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
## Database migrations
_N/A — no database migrations in this PR._
## New Fleet configuration settings
_N/A — no new configuration settings._
## fleetd/orbit/Fleet Desktop
_N/A — no agent code changes._
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Improved test coverage for TLS configuration error handling.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45343)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
