**Related issue:** Resolves#48368
# Before / After
- Before: "Old tooltip for Windows/Linux"
<img width="591" height="278" alt="image"
src="https://github.com/user-attachments/assets/c413c8a0-4c3b-489c-a046-c65d03452c44"
/>
- After: "Updated tooltip for Windows/Linux"
<img width="629" height="283" alt="image"
src="https://github.com/user-attachments/assets/b9e99430-5d63-470d-801e-2d4c060c112d"
/>
- for Mac and Apple-related OS stays unchanged.
<img width="583" height="273" alt="Screenshot 2026-06-28 at 5 52 50 PM"
src="https://github.com/user-attachments/assets/cac7990d-6212-4b69-9467-73d6a3f7d733"
/>
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the “installed during setup” tooltip to clarify installation
order rules.
* The tooltip now specifies ordering by software name (0–9, then A–Z).
* Added clearer policy sequencing: software without an install policy is
installed before software with a policy.
* Android setup messaging remains unchanged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#38504
**Constituent PRs (merged into this feature branch):**
- #47682 — Fleet UI: APRF Software title details page Library/Inventory
layout
- #47808 — Extend update software installer API to support FMA version
pinning
- #47944 — Fleet UI: APRF library item accordion component
- #48081 — Versions modal, multi-row Library, pinned state
- #48098 — Add `pinned_version` to `edited_software` activity
- #48123 — Auto-update FMA cron
- #48144 — Download a newly-published FMA version when pinned to it
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or
`ee/fleetd-chrome/changes`. See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates
to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Fleet-maintained app version pinning (Latest, exact, and major)
via a new Versions modal.
* Introduced premium auto-updates for maintained apps with pin-aware
promotion and rollback-safe caching.
* Added expandable library version rows and a Policies modal.
* **Bug Fixes**
* Improved pin handling, cache/manifest hydration, and safer update
behavior on per-app failures and deduplication.
* **UI/UX**
* Refreshed the Software title details experience with new
accordion/list patterns, redesigned details widget/tooltips, and updated
installer presentation.
* **Documentation**
* Expanded Storybook component/page coverage and adjusted Storybook
canvas padding.
* **Tests**
* Added/updated unit and integration tests for pinning, auto-update
flows, and new modal/UI behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#48297
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected MDM command labeling in host details so only commands run
through the custom MDM command API appear as “custom MDM command.”
* Improved command details display for MDM items to show the appropriate
label instead of applying the custom label broadly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Visual polish for the unreleased Vulnerability
Exposure chart filter (part of #47674 / #44746)
Left-aligns the "Advanced options" reveal toggle in the chart filter
modal's Software tab so it matches the design. Previously the toggle
stretched to the full width of the column-flex container and its content
was centered; this adds `align-self: flex-start` so it hugs the left
edge.
## Before / After
- **Before:** "Advanced options" toggle centered in the panel.
<img width="400" alt="image"
src="https://github.com/user-attachments/assets/b4cbe5fc-832e-415b-af31-bfd3ca14085d"
/>
- **After:** Left-aligned, matching the Figma design.
<img width="400" alt="CleanShot 2026-06-26 at 12 20 50@2x"
src="https://github.com/user-attachments/assets/6204bc50-eb1a-4abc-bee6-45f6bb161bb2"
/>
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
<!-- Frontend-only CSS alignment fix on an unreleased feature —
DB/config/orbit/changes-file sections below are N/A and removed per
template instructions. -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Adjusted the alignment of the “Advanced options” toggle in the
software filters panel for a cleaner layout.
* **Bug Fixes**
* Improved the positioning of the toggle button so it aligns
consistently within the filter section.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#47246
On the host details policies tab and the device user self-service
policies page, clicking a policy while on any page other than the first
reset the list back to page 1. To fix this, Memoize the data set so its
reference stays stable across re-renders that don't change the policies.
**Related issue:** Resolves#48334
The software title response now returns a per-version `filename` in
`fleet_maintained_versions`, and the Library version rows render each
version's own filename instead of the active installer's. Previously,
every cached-version row showed the active installer's filename because
the array didn't include one.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48192
- Deleted `refetchOnWindowFocus: false` so that users get fresh data if
they navigate away and come back to the report results page (IMHO this
should be the behavior across all Fleet's UI).
- Set a refetch interval of 5s when no report results are available.
^ is gated to the report bringing back results (i.e. `discard_data =
false` and `logging = snapshot`).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
https://github.com/user-attachments/assets/13513f37-8634-4c22-95cc-c0b2e9128058https://github.com/user-attachments/assets/ae30640a-d0cb-4d93-a0f3-058650895959https://github.com/user-attachments/assets/54a46634-fbca-4a7a-a75e-36b73370c9a0
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Report results now refresh automatically when you return to the
browser window.
* Empty report results are checked again every 5 seconds until data
appears.
* **Bug Fixes**
* Improved handling of report caching settings so refresh behavior is
skipped when caching is disabled.
* The empty-state view now stays in sync with whether report caching is
available.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Relates to #38670
Fix padding issue around automation icons and
add missing automation icons.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44325 (follow-up to #47861 and #48009)
## Summary
Follow-up to #47861 and #48009 (both merged) for #44325. Those left
several GitOps-mode "Manage in YAML" tooltips still misaligned. This
makes the wrapper hug its content so the tooltip centers on the disabled
control instead of drifting to the full form width.
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<img width="1280" height="860" alt="1_bootstrap_advanced"
src="https://github.com/user-attachments/assets/403cabb4-3d24-4ece-91f5-4887efd0da05"
/>
<img width="1280" height="860" alt="2_install_software"
src="https://github.com/user-attachments/assets/2f9b2130-0fd6-4744-9603-1a31aebd773e"
/>
<img width="1280" height="860" alt="3_fleet_action_rename"
src="https://github.com/user-attachments/assets/180f3e8d-1dee-404c-b13d-14124bc3509b"
/>
<img width="1280" height="860" alt="4_fleet_action_enroll"
src="https://github.com/user-attachments/assets/9378b6fb-5b1e-45e0-80e5-61d4996b49e0"
/>
<img width="1280" height="860" alt="5_fleet_checkbox"
src="https://github.com/user-attachments/assets/dcec8992-5407-452a-8b4c-5d4e8dc27d10"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved tooltip positioning and width behavior in setup forms so
tooltips align more consistently with the visible control.
* Input and dropdown fields now keep their full-width behavior, while
other controls are centered more naturally.
* Updated the macOS and Windows software requirement options to show
tooltips beside the control for better readability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Update maintained app metadata and frontend mapping to reflect RealVNC
rebrand and package changes. Renamed app entries for macOS and Windows,
bumped macOS version to 8.4.2, updated bundle identifier checks and
patch queries to account for both legacy and new bundle IDs, and
replaced installer URL, checksums, and install/uninstall script refs.
Marked the Homebrew input as frozen. Also updated frontend icon mappings
to include the new "realvnc connect viewer" name (and kept a mapping for
the legacy name).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the app label to **RealVNC Connect Viewer** across supported
platforms, including catalog/manifest entries.
* Added/updated icon mappings for **RealVNC Connect Viewer** and
**RealVNC Viewer**.
* **Bug Fixes**
* Updated the macOS viewer deployment to **version 8.4.2**.
* Improved upgrade/uninstall behavior to replace the legacy viewer,
relaunch the updated app, and clean up previous remnants.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#47623
## Summary
Wires up the Fleet-maintained app version-pinning UI on the software
title details page:
- **Versions modal** — opened from Actions ▾ → Versions or the active
row's version badge. Choose *Automatically update to latest*, pin to an
exact version, or pin to a major version; pre-selected from the current
pin, and Save is disabled with a tooltip in GitOps mode.
- **Multi-row Library** — one accordion row per cached version; the
active/pinned row is badged (Latest / Pinned / Major version) and older
versions are dimmed.
- Adds `pinned_version` to the software-package interface and a
`version` field to the installer `PATCH` request.
Frontend only; targets the `feat/38504-auto-update-pin-rollback-fma`
feature branch (backend, layout, and accordion already merged there).
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
https://github.com/user-attachments/assets/f9822cfa-57d2-4f0c-9918-c5ee914f0431
**Related issue:** Resolves#45641
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. In other subtask.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added support for tracking and displaying “ran custom MDM command”
activities across dashboard and host activity feeds.
* Added custom MDM command detail modals with status-aware messaging,
actor attribution, target host, and relative “time ago” updates.
* Improved command name rendering by shortening long request types for
cleaner display.
* **Bug Fixes**
* Enhanced command status handling for additional Apple and Windows
status formats so icons and verbs display correctly.
* **Tests**
* Added coverage for custom MDM command rendering and command-status
helper behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#46921.
Before and after screens below.
Correct wording for scripts:
<img width="343" height="148" alt="Screenshot 2026-06-04 at 11 52 36"
src="https://github.com/user-attachments/assets/2f56dc01-0eb5-4fdd-9d9a-c4055b823bc9"
/>
<img width="309" height="129" alt="Screenshot 2026-06-04 at 11 55 07"
src="https://github.com/user-attachments/assets/99347a18-1304-451a-9d0d-d12a64acb9a7"
/>
Prefer human-readable software names:
<img width="659" height="146" alt="Screenshot 2026-06-04 at 09 41 03"
src="https://github.com/user-attachments/assets/f12a4f2b-a3d3-4860-a98d-8e0bd6145131"
/>
<img width="645" height="145" alt="Screenshot 2026-06-04 at 09 41 12"
src="https://github.com/user-attachments/assets/638cfef0-afb5-41a8-a37f-a412b055d76c"
/>
<img width="614" height="133" alt="Screenshot 2026-06-04 at 11 50 51"
src="https://github.com/user-attachments/assets/24c016c2-693e-4256-b7d2-bef057df16f3"
/>
<img width="622" height="114" alt="Screenshot 2026-06-04 at 11 55 32"
src="https://github.com/user-attachments/assets/8a06f0f1-01fa-498b-908d-2e8a81f03e9f"
/>
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Improved host software empty-state tooltips with human-friendly
software/package naming (preferring display name) and context-specific
messaging.
* Corrected script vs non-script action wording: “Run” for script
packages and “Install” for non-scripts, including matching CTA and verb
text.
* Updated App Store self-service tooltip phrasing to include the app
name when available.
* **Tests**
* Adjusted tooltip expectations to match the updated placeholder and App
Store text.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#48064
Adds a new default self-service software category, rendered as **🛟
Support**, alongside the existing six defaults (Browsers, Communication,
Developer tools, Productivity, Security, Utilities).
## What changed
**Backend (Go)**
- `server/fleet/software.go` — added `🛟 Support` to
`DefaultSelfServiceCategoryNames` (seeds new fleets) and `"Support": "🛟
Support"` to `LegacySoftwareCategoryNames` (so GitOps/FMA manifests can
reference the non-emoji `Support`).
- New migration `20260619120000_AddSupportSoftwareCategory` — inserts
the global default (`team_id=0`) and backfills every existing fleet.
Timestamps pinned for deterministic schema dumps; `INSERT IGNORE` guards
the `(team_id, name)` unique key.
- `schema.sql` regenerated via `tools/dbutils`.
- `cmd/maintained-apps/main.go` — added `Support` to the FMA validator
allowlist.
**Frontend**
- `frontend/interfaces/software.ts` — added `"Support"` to the
`SoftwareCategory` union.
- `frontend/pages/hosts/details/cards/Software/SelfService/helpers.ts` —
added `{ label: "🛟 Support", value: "Support" }` to the fallback list.
**Docs**
- `docs/Configuration/yaml-files.md` — documented `Support` as a
supported GitOps category.
## Note on sort order
`ListSoftwareCategories` does `ORDER BY name` under
`utf8mb4_unicode_ci`, which sorts by the word after the (ignorable)
emoji. `🛟 Support` is therefore placed between `🔐 Security` and `🛠️
Utilities`.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Verified against a dockerized MySQL:
- Migration test `TestUp_20260619120000`
- `TestSoftware/SoftwareCategoryCRUD` (order-sensitive assertion)
- `TestSelfServiceCategoriesCRUD` + `TestDeviceSelfServiceCategories`
integration tests
- `cmd/maintained-apps` tests, ee categories test, `go vet`, `make
lint-go-incremental` (0 issues)
- `tools/dbutils` schema regeneration matches
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [x] Verified the setting is documented (GitOps `categories` supported
values in `docs/Configuration/yaml-files.md`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Introduced the "🛟 Support" category as a new self-service software
classification option. Users can now better organize support-related
applications within their software catalog. The category is available
globally across all teams, providing improved organization and discovery
capabilities for support applications alongside utilities and other
existing software categories.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Modified patterns.md to document that we prefer to not spread props into
components. Included some exceptions as well as some specific cases
where we'd never want to spread (e.g. into an `img` tag).
## Testing
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Redesigned in-app notifications with a new toast-based UI style.
* Error messages are now dismissible and expandable to reveal detailed
server response information.
* Success and error notifications now appear consistently across the
application with improved visibility.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#46920.
When a user is assigned to multiple fleets, show a tooltip with those
fleets (similar to the User email column on the Hosts page).
<img width="317" height="201" alt="Screenshot 2026-06-04 at 10 23 32"
src="https://github.com/user-attachments/assets/7a579bc7-30fc-47cf-b3d7-3042b5348698"
/>
When a user has more than one role type, show a tooltip with the
roles/fleets for Various:
<img width="414" height="213" alt="Screenshot 2026-06-04 at 10 23 36"
src="https://github.com/user-attachments/assets/2e1e2cb1-9265-462a-a51e-a9a0b9930b8a"
/>
My account:
<img width="244" height="278" alt="Screenshot 2026-06-11 at 09 13 02"
src="https://github.com/user-attachments/assets/5a7f2621-8809-4c94-a02c-599f8137a562"
/>
<img width="323" height="293" alt="Screenshot 2026-06-11 at 09 13 06"
src="https://github.com/user-attachments/assets/2e3befd2-dc97-49ea-a02d-42a888b140b2"
/>
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary of Updates
* **New Features**
* Added tooltip details for **Settings > Users** and **My account** to
show all fleets and role groupings when a user has multiple assignments.
* **Improvements**
* Updated admin user/invite tables to enrich displayed data for
**Fleets** and **Role**.
* “Role” now supports a special **Various** view with tooltip breakdown
by associated teams.
* **Fleets** cells now show expanded, multi-line tooltips for multi-team
users and improved grey/italic styling for special cases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
This is a follow-up to #47861, the previous PR for #44325.
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Improved GitOps mode tooltip arrow positioning by adapting the default
offset based on whether it’s associated with a single form field row.
* **Style**
* Refined the tooltip wrapper layout so non-form-field content “hugs”
its contents instead of stretching to full form width, improving
alignment and centering.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<img width="1728" height="1045" alt="Screenshot 2026-06-22 at 10 46 46"
src="https://github.com/user-attachments/assets/53f96b70-59ec-422c-8750-324aea21b184"
/>
We now support both iOS and Android for this:
[`docs/Contributing/reference/audit-logs.md#L1747`](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/audit-logs.md?plain=1#L1747).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Simplified the activity filter label text for installed app store apps
by removing unnecessary notation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** For #44746
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [x] Changing the filters in the UI causes the related API params to be
set
- [x] Changing the software filters causes the "filtered" tooltip to
show up and include info about software filters
- [x] Changing the host filters causes the "filtered" tooltip to show up
and include info about host filters
- [x] Changing both host and software filters causes the "filtered"
tooltip to show up and include info about both filters
- [x] CVE search works and utilizes infinite scroll
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added software category filtering options to vulnerability charts.
* Added EPSS range filtering with validation to refine results.
* Added known exploit toggle and CVE exclusion capabilities.
* Improved filter status display with tabbed interface.
* **Tests**
* Added comprehensive test coverage for software filtering and
validation logic.
* **Style**
* Enhanced filter UI styling and interactivity.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Update branding from "Cloudflare WARP" to "Cloudflare One" across
maintained app data. Changed name fields in Homebrew and Winget input
JSON, updated outputs/apps.json entries and descriptions, and updated
the frontend NameToIdentifierMap key to "Cloudflare One" (keeps existing
slug/identifier unchanged).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47731
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated product references from Cloudflare WARP to Cloudflare One
across platform metadata and catalogs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#43310
Read-only policy and report detail pages rendered their displayed fields
(name, description, resolution, platforms, query) from the editing
context (`PolicyContext`/`QueryContext`), which only updates in
react-query's `onSuccess`. On a cached revisit, `isLoading` is `false`
(no spinner) and the freshly-loaded entity is available immediately, but
the context still held the previously-viewed entity's values for a frame
— briefly showing the wrong policy/report.
This change makes both detail pages render directly from the fresh
`useQuery` result (`storedPolicy`/`storedQuery`) and drops their
coupling to the editing context, matching the existing
`HostDetailsPage`/`SoftwareTitleDetailsPage` pattern. `QueryDetailsPage`
(Reports) had the identical latent bug and is fixed here too.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
New regression tests (`PolicyDetailsPage.tests.tsx`,
`QueryDetailsPage.tests.tsx`) seed the context with stale values and
assert the page renders the freshly-loaded entity instead. Verified live
against a running Fleet instance with Playwright: navigating between
cached detail pages no longer flashes the previous entity's content.
[6f7d6d22134dc1fd968f8473c552ee49.webm](https://github.com/user-attachments/assets/c8ef5f3f-278c-4e13-adc1-689b3eff4e59)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Resolved an issue where policy and query details pages could briefly
display previously viewed policy/report information when switching
between items.
* **Tests**
* Added regression coverage to ensure the UI renders freshly loaded
policy/query name, description, and query/report details, and does not
show stale values.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#38670
Adds the backend and frontend for the Policy status page — a historical, per-host view of policy automation outcomes — plus a way to reset a policy's results.
This pull request adds support for three new Windows applications—Chef
Workstation, Cherry Keys, and Colour Contrast Analyser—along with Cribl
Edge, to the maintained apps system. It introduces their metadata,
installation/uninstallation scripts, and icon assets, ensuring these
apps can be managed and displayed within the platform.
**New Windows Application Support:**
* Added metadata input files for:
- `Chef Workstation` (`chef-workstation.json`), including detection
queries and categorization as a Developer tool.
- `Cherry Keys` (`cherry-keys.json`), with fuzzy name matching and
categorized as a Utility.
- `Colour Contrast Analyser` (`colour-contrast-analyser.json`),
specifying publisher and categorized as a Utility.
- `Cribl Edge` (`cribl-edge.json`), with detection queries and
categorized as a Developer tool.
**Application Output and Versioning:**
* Added output JSON files for each new app with:
- Latest version info, detection and patch queries, installer URLs,
SHA256 hashes, install/uninstall script references, and upgrade codes:
- `chef-workstation/windows.json`
- `cherry-keys/windows.json`
- `colour-contrast-analyser/windows.json`
- `cribl-edge/windows.json`
**App Catalog Updates:**
* Updated `apps.json` to include the new Windows apps, each with a
description and unique identifier for catalog display.
[[1]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1411-R1424)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1712-R1718)
[[3]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1803-R1809)
**UI/Icon Assets:**
* Added a new SVG icon component for Chef Workstation in the frontend
(`ChefWorkstation.tsx`).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
Tested with fleet maintained apps and VPP in UI and gitops
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
N/A since this is just editing the existing migration
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- newly added custom category, or default category, was cleared if was
not in the yaml file
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected the “Productivity” category emoji/name and the “Utilities”
category emoji/name across the system for consistent display and
behavior.
* **Tests**
* Updated unit, integration, and handler tests to expect the corrected
category strings and delete-button labels.
* **Chores**
* Refreshed database seed data and migration/test expectations to align
default and per-team category names, preserving IDs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#44325
## Summary
In GitOps mode, disabled settings fields show a "Manage in YAML (GitOps
mode)" tooltip via `GitOpsModeTooltipWrapper`. The wrapper passed the
entire field (label + input + help text) to the shared `TooltipWrapper`,
so react-tooltip anchored to the whole field's bounding box. For
`position="left"`/`"right"` fields this centered the tooltip vertically
across the field, landing the arrow between the input and the help text
instead of at the label.
This change anchors the tooltip to the field's label/control row (via
react-tooltip-5 `anchorSelect` scoped to a unique wrapper id), so the
arrow points at the label regardless of input, help-text, or
tooltip-content length. The change is contained to
`GitOpsModeTooltipWrapper`, leaving `TooltipWrapper` untouched.
Non-field usages (buttons, icon rows) fall back to the previous
whole-element anchoring.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Verified manually with Playwright against a live instance in GitOps
mode: the tooltip arrow points at the checkbox/control row (incl. fields
with help text) and at the label for `isInputField` inputs; button
usages are unchanged.
<img width="1726" height="1041" alt="Screenshot 2026-06-18 at 15 31 08"
src="https://github.com/user-attachments/assets/58229743-58d4-4b26-b69d-c78ca2e6b3b1"
/>
<img width="1721" height="1040" alt="Screenshot 2026-06-18 at 15 30 58"
src="https://github.com/user-attachments/assets/253db973-2a57-4f62-9d6f-2d18f0c2a7ca"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected GitOps mode tooltip positioning for disabled settings
fields. Tooltips now properly target field labels instead of the
combined label/input/help element area, improving visual alignment and
clarity.
* **Tests**
* Enhanced test coverage for GitOps mode tooltip anchoring with tests
for single form fields and grouped field controls to ensure correct
positioning behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A — adds Vivaldi to the Fleet-maintained apps
catalog.
## Summary
Adds **Vivaldi** as a Fleet-maintained app for **macOS** and
**Windows**.
- **macOS (`vivaldi/darwin`)** — Homebrew cask input plus a
`VivaldiDMGInstaller` enricher that redirects Homebrew's unsupported
`tar.xz` download to Vivaldi's direct universal DMG
(`https://downloads.vivaldi.com/stable/Vivaldi.{version}.universal.dmg`),
keeping `installer_format: dmg` so the standard `hdiutil`-based
install/uninstall scripts are generated. `unique_identifier` is the
verified bundle id `com.vivaldi.Vivaldi`.
- **Windows (`vivaldi/windows`)** — winget input (`Vivaldi.Vivaldi`)
with custom install/uninstall scripts. Installs **machine-wide** with
`--vivaldi-silent --do-not-launch-chrome --system-level`. Because Fleet
runs installers as `SYSTEM`, the `--system-level` flag is required —
without it the Chromium-based installer lands in the `SYSTEM` profile
and is invisible to the real user. The exists query matches the registry
`DisplayName` `Vivaldi` and verified `Publisher` `Vivaldi Technologies
AS.`; the uninstall script looks up the entry under HKLM (with an HKCU
fallback) and runs the Chromium uninstaller with `--force-uninstall`.
Outputs were regenerated via the ingester (`go run
cmd/maintained-apps/main.go --slug=...`) at Vivaldi **8.0.4033.46**;
script refs are content-addressed, not hand-edited.
## Changes
- `ee/maintained-apps/inputs/homebrew/vivaldi.json`,
`ingesters/homebrew/external_refs/vivaldi.go` (+ registration in
`main.go`) — macOS input and DMG-URL enricher
- `ee/maintained-apps/inputs/winget/vivaldi.json` +
`scripts/vivaldi_install.ps1` / `vivaldi_uninstall.ps1` — Windows input
and custom machine-wide install/uninstall
- `ee/maintained-apps/outputs/vivaldi/darwin.json`,
`vivaldi/windows.json`, `outputs/apps.json` — generated catalog entries
(with descriptions)
- `frontend/pages/SoftwarePage/components/icons/Vivaldi.tsx` +
`index.ts`, `website/assets/images/app-icon-vivaldi-60x60@2x.png` —
UI/website icon
# Checklist for submitter
- [x] Input data is properly validated; untrusted data interpolated into
shell scripts/commands is validated against shell metacharacters.
(Silent-install flags are documented Vivaldi switches; the uninstall
script parses the registry UninstallString defensively.)
## Testing
- [x] Regenerated both outputs via the ingester; verified
`installer_url`, SHA, and non-empty install/uninstall script refs.
- [x] Verified macOS `unique_identifier` (`com.vivaldi.Vivaldi`) and
Windows identity (DisplayName `Vivaldi`, Publisher `Vivaldi Technologies
AS.`) against the cask/winget manifests.
- [x] `apps.json` validates as JSON; `go build
./cmd/maintained-apps/...` and `GOOS=windows go build
./cmd/maintained-apps/validate/` pass.
- [ ] QA'd all new/changed functionality manually (via the FMA validator
on macOS + Windows hosts).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for Vivaldi browser across macOS (Homebrew) and Windows
(Winget) platforms with version management capabilities.
* Included automated installation and uninstallation scripts for both
operating systems.
* Added Vivaldi icon to the application interface.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Rahul Raghunathan
