Closes: https://github.com/fleetdm/fleet/issues/45688
Changes:
- Updated the layout and content of the /software-management page to
match the latest wireframes
- Updated the max width of images in the `feature-with-image()` mixin.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Redesigned the Software Management page with a refreshed hero
headline, new CTA row, and replaced the carousel with discrete page
sections.
* Reorganized content into consistent feature-with-image blocks, added
deployment and enrollment/self-service feature items (including platform
notes), and updated hero/closing CTA messaging.
* Rebuilt testimonial and logo areas (desktop and mobile variants),
integrated scrollable testimonials, and improved responsive spacing with
gap-aware image sizing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41683
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactoring**
* Replaced ad-hoc string checks with standardized enrollment-status
constants across platforms.
* Centralized Android wipe validation into a single reusable check.
* **Bug Fixes**
* Updated Apple lock and wipe validations to use standardized
enrollment-status values.
* Fixed pending-device handling during Apple device sync to rely on the
centralized status representation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46567
Note: Hide whitespace for better review
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Server-triggered on-demand Windows MDM check-ins for immediate device
syncs
* Dynamic adjustment of the device polling interval based on server
directives
* Enhanced metrics: tracking and reporting of on-demand MDM
synchronization sessions
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add Winget input manifests for Microsoft .NET Runtime 8 and 10, plus a
shared install script and separate uninstall scripts for each major
version. Update outputs: register both runtimes in
ee/maintained-apps/outputs/apps.json and add per-app windows.json files
containing version metadata, installer URLs, sha256 checksums and script
refs. These changes enable automated install/uninstall and version
detection for .NET Runtime 8 and 10 in the maintained-apps catalog.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated supported application versions across multiple platforms: AWS
CLI, Brave Browser, Claude, Granola, Loom, Microsoft Edge, NordVPN,
Ollama, OrbStack, PhpStorm, RubyMine, Teleport Suite, and WebStorm with
their latest releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Add support for Amazon Corretto JDKs (21, 24, 26) on Windows: new winget
input manifests and outputs with installer URLs, SHA256s,
existence/patch queries, upgrade codes, and install/uninstall script
refs. Update maintained apps index (apps.json) to include the three new
Corretto entries. Add frontend icon components for Corretto 21/24/26 and
update icon exports.
Update visibility and reporting page description
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated navigation copy for "Visibility & reporting" in mobile and
desktop header dropdowns.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request improves how the platform is determined for software
installers, ensuring that the installer's stored platform is used when
available, rather than inferring it from the file extension. This is
especially important for `.zip` installers, which may be used on
multiple platforms. The changes also add a new test to verify this
behavior.
Trying to install a zip-based FMA on Windows:
<img width="1485" height="499" alt="Screenshot 2026-06-04 at 12 39
50 PM"
src="https://github.com/user-attachments/assets/cbeecefd-6376-44d9-8e93-dd93f0c714f9"
/>
**Platform detection improvements:**
* Added the `installerRequiredPlatform` helper function, which returns
the file extension and uses the installer's stored `Platform` field if
set; otherwise, it falls back to inferring the platform from the
extension. This ensures correct handling for installers like `.zip`
files used on both Windows and macOS.
* Updated all relevant service methods
(`installSoftwareTitleUsingInstaller`, `UninstallSoftwareTitle`, and
`SelfServiceInstallSoftwareTitle`) to use `installerRequiredPlatform`
for platform validation instead of inferring from the file extension
alone.
[[1]](diffhunk://#diff-b3883848dac3454f4ed4968a94f9ca335241f9f99bfad92f95a6bfb7157523ebL1592-R1592)
[[2]](diffhunk://#diff-b3883848dac3454f4ed4968a94f9ca335241f9f99bfad92f95a6bfb7157523ebL1702-R1701)
[[3]](diffhunk://#diff-b3883848dac3454f4ed4968a94f9ca335241f9f99bfad92f95a6bfb7157523ebL3226-R3224)
**Testing improvements:**
* Added a new test, `TestInstallZipInstallerUsesStoredPlatform`, to
verify that `.zip` installers use the stored platform (e.g., "windows")
rather than inferring "darwin" from the extension.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Platform enforcement now prefers stored installer platform metadata
(zip treated as ambiguous), preventing incorrect platform selection for
install, uninstall, and self-service install flows.
* **Tests**
* Added tests verifying `.zip` installers use stored platform metadata
for install, uninstall, and self-service install scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Carlo <1778532+cdcme@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Carlo DiCelico <carlo@fleetdm.com>
Closes#45291
**Related issue:** none
## Problem
Apple MacOS devices fail SCEP enrollment with a 400. The proxy sees the
request arrive with `+` signs in the base64 payload:
```
request_uri: /mdm/apple/scep?operation=PKIOperation&message=MIA...MokYg+nl4TGkZi...k0+BJ/...
```
Fleet logs show those `+` signs are interpreted as spaces, and the
decode fails:
```
component=http-mdm-apple-scep method=GET status=400
err="failed to base64 decode message: illegal base64 data at input byte 375:
...MokYg nl4TGkZi...k0 BJ/..."
```
## Root cause
`message()` in `server/mdm/scep/server/transport.go` reads the query
parameter via `r.URL.Query()`, which internally calls
`url.QueryUnescape` and converts every `+` to a space.
The bug is present on `main` as of 2026-04-09.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed SCEP PKIOperation handler so base64 payloads with `+` characters
are decoded correctly (no longer treated as spaces).
* **Tests**
* Added regression tests ensuring GET PKIOperation works with literal
`+` and percent-encoded `+` in the query message.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/43319?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Sharon <sharon@fleetdm.com>
Closes#45843
## Summary
- Table-qualify column names in `vulnerabilitiesAllowedOrderKeys` so
they resolve correctly in both `ORDER BY` and cursor `WHERE` clauses
- `cve` was ambiguous between `vhc.cve` and `cm.cve`
- `hosts_count` and `cve_published` were SELECT aliases not valid in
WHERE scope
- Also fixed `host_count_updated_at` / `hosts_count_updated_at` which
had the same alias issue
## Reproduction
### Bug (before fix)
The `ListVulnerabilities` query joins `vulnerability_host_counts vhc
LEFT JOIN cve_meta cm`. When cursor pagination appends `WHERE <column> >
?`, three order keys fail:
| `order_key` | Old column value | MySQL error |
|-------------|-----------------|-------------|
| `cve` | `cve` | `Error 1052: Column 'cve' in where clause is
ambiguous` (exists on both `vhc` and `cm`) |
| `hosts_count` | `hosts_count` | `Error 1054: Unknown column
'hosts_count' in 'where clause'` (SELECT alias, not a real column) |
| `cve_published` | `cve_published` | `Error 1054: Unknown column
'cve_published' in 'where clause'` (SELECT alias for `cm.published`) |
Reproduced locally by running the raw SQL the old code would generate:
```sql
-- BUG 1: ambiguous
... WHERE vhc.host_count > 0 AND cve > 'CVE-2023-0002' ORDER BY cve ASC;
-- ERROR 1052 (23000): Column 'cve' in where clause is ambiguous
-- BUG 2: alias not valid in WHERE
... WHERE vhc.host_count > 0 AND hosts_count > 10 ORDER BY hosts_count ASC;
-- ERROR 1054 (42S22): Unknown column 'hosts_count' in 'where clause'
-- BUG 3: alias not valid in WHERE
... WHERE vhc.host_count > 0 AND cve_published > '2020-01-01' ORDER BY cve_published ASC;
-- ERROR 1054 (42S22): Unknown column 'cve_published' in 'where clause'
```
### Fix
Changed the allowlist values from bare names/aliases to table-qualified
actual column names:
| `order_key` | Before | After | Why |
|-------------|--------|-------|-----|
| `cve` | `cve` | `vhc.cve` | Ambiguous: both `vhc` and `cm` have a
`cve` column |
| `cve_published` | `cve_published` | `cm.published` | SELECT alias, not
a real column; invalid in WHERE |
| `hosts_count` / `host_count` | `hosts_count` | `vhc.host_count` |
SELECT alias for `vhc.host_count`; invalid in WHERE |
| `hosts_count_updated_at` / `host_count_updated_at` |
`hosts_count_updated_at` | `vhc.updated_at` | SELECT alias for
`vhc.updated_at`; invalid in WHERE |
Table-qualified names work in both `ORDER BY` and `WHERE` clauses.
### Manual verification (after fix)
Started a local Fleet server (`--dev --dev_license`), seeded 6
vulnerability entries, and hit all three previously-broken API calls:
```
GET /api/v1/fleet/vulnerabilities?order_key=cve&order_direction=asc&per_page=3&after=CVE-2023-0002
--> 200 OK, returned CVE-2023-0003, CVE-2023-0004, CVE-2023-0005 (correct ascending order)
GET /api/v1/fleet/vulnerabilities?order_key=hosts_count&order_direction=asc&per_page=3&after=10
--> 200 OK, returned hosts_count=20, 30, 50 (correct ascending order)
GET /api/v1/fleet/vulnerabilities?order_key=cve_published&order_direction=asc&per_page=3&after=2020-01-01
--> 200 OK, returned 3 CVEs with publish dates after 2020-01-01
```
Regression checks (no breakage):
- `order_key=cvss_score` cursor pagination still works
- Page-based pagination (`page=0&per_page=3`) still returns correct
results with `has_next_results: true`
## Test plan
- [x] Added `testListVulnerabilitiesCursorPagination` integration test
covering all three broken order keys (`cve`, `hosts_count`,
`cve_published`)
- [x] Existing tests pass: sort, page-based pagination, team filter,
known exploit filter, count
- [x] Manual verification on local Fleet server (see above)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
* Fixed cursor pagination for the vulnerabilities endpoint when sorting
by CVE, host count, or CVE publication date to prevent SQL errors and
ensure reliable result navigation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45983?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Created new table specific to Windows MDM testing.
- Copied shared tests to Windows MDM table.
- Removed all Windows-specific tests from original MDM table.
- Renamed original MDM table (Apple & cross-platform)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
**Related issue:** Resolves#45149 (adds to)
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Throttle continuous policy automations to avoid repeated install
attempts within the policy update interval.
* **New Features**
* Install records now include an updated timestamp for accurate cooldown
decisions.
* Added tracking of recently verified VPP app installs to avoid
redundant re-installs.
* **Tests**
* New and updated unit and integration tests covering cooldown behavior
and VPP verification lookups.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Update fleet-desktop from 1.3.0 to 1.3.1 across Homebrew cask, API
metadata, and darwin outputs. This includes new version strings, updated
SHA256 checksums, installer URLs and package names, updated
ruby_source_checksum, and refreshed install/uninstall script refs to
reference the v1.3.1 package.
Resolves: #46813
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced the "My device" feature to open device URLs more reliably and
improve popup-blocker compatibility.
* Added clearer error messaging when opening a new device tab fails.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Introduce REAPER to maintained apps: add homebrew input
(com.cockos.reaper, token `reaper`, dmg installer, Productivity
category) and register it in apps.json. Add darwin output metadata
(versions/7.73) including installer URL, sha256, install/uninstall
script refs and embedded scripts for installation/uninstall behavior.
Add frontend icon component and image asset, and wire the Reaper icon
into the SOFTWARE_NAME_TO_ICON_MAP.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Icon Composer as a supported macOS application with
install/uninstall support and a visual icon in the UI.
* **Chores**
* CI workflows updated to detect Icon Composer changes and to validate
it on macOS runners using a clean Xcode state.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43729
# Details
Adds output to GitOps runs indicating which custom/FMA software packages
would be deleted. This involves adding a `deleted_packages` key to the
`/software/batch/:request_uuid` ("Get status of software batch-apply
request") API, which will be documented separately.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] verified that a GitOps dry run produces one "would've deleted"
line per custom package / fma that would be deleted
- [X] verified that a GitOps real run produces one "deleted" line per
custom package / fma that was deleted
- [X] verified that adding software is unaffected
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* GitOps batch software operations now report packages pending deletion:
dry-runs show "would've deleted" warnings and real runs show deletions;
apply flows surface per-package deletion messages.
* Empty payload dry-run now still reports pending deletions when
applicable.
* **Tests**
* Added integration and datastore tests validating deletion-warning
output, pending-deletion detection, and related result handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated OrbStack to version 2.2.0
* Updated RubyMine to version 2026.1.3
* Updated WebStorm to version 2026.1.3
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46816
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed unexpected restarts when starting Orbit with `--debug` or
`ORBIT_DEBUG=1` environment variable while the server was not sending
debug flags.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated IntelliJ IDEA for macOS to version 2026.1.3, including updated
installer artifact and checksum.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45306
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<img width="1470" height="19" alt="image"
src="https://github.com/user-attachments/assets/726b1efe-176f-4460-a140-a1f571990010"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Enhanced GitOps exception enforcement error messages for labels,
secrets, and software to include a direct link to the Fleet settings
page where exceptions can be disabled. Users now receive actionable
guidance when enforcement is triggered, improving troubleshooting
efficiency and reducing time spent resolving configuration issues.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46560
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- updated preview test. This won't run in CI right now b/c we didn't
update fleetctl, but I ran it successfully locally
- [X] QA'd all new/changed functionality manually
- [x] on main, did `fleetctl preview` with the 4.86.0 tag and verified
that charts were disabled
- [x] on this branch, did the same and verified charts were enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Dashboard chart data collection (Hosts online and Vulnerability
exposure) is no longer disabled when starting preview mode.
* **Chores**
* Software inventory config moved to the current features flag so
historical chart data is preserved.
* **Tests**
* Added regression checks to ensure uptime, vulnerabilities, and
host-users historical data remain enabled in preview.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add Winget input manifests for multiple maintained apps (Amazon DCV
client/server, Dell Command Update, Dell Display Manager, Lenovo Dock
Manager, Microsoft Remote Help, Nessus Agent, Plantronics Hub, Power
Automate, PowerToys, and RStudio). Include corresponding
install/uninstall PowerShell helper scripts under
ee/maintained-apps/inputs/winget/scripts and add Windows output metadata
(versions, installer URLs, checksums, installer/uninstaller refs) under
ee/maintained-apps/outputs/*/windows.json. Also update
ee/maintained-apps/outputs/apps.json to reflect the new entries. These
additions enable automated install/uninstall and fleet management for
the new Winget-backed apps.
**Related issue:** Resolves#45179
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Configuration profiles now support selecting both include and exclude
labels when uploading MDM profiles
* Profile labels modal displays include and exclude label sections
separately
* **Bug Fixes**
* Delete label confirmation now clarifies that labels used by
configuration profiles cannot be deleted until the profile is removed
* **Style**
* Added visual check indicators for configured platforms in tabs
* Improved responsive design for profile management and side navigation
layouts
* **Tests**
* Added test coverage for profile labels modal and label deletion
helpers
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46444?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated application version metadata for 14 apps across Windows and
macOS platforms, including AWS CLI, Claude, CleanMyMac, Google Drive,
Notepad++, Ollama, Postman, Signal, Snagit, Zed, and Zen Browser with
latest installer URLs and integrity checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
## Summary
- Re-opens the Solutions Specialist position by uncommenting the entry
in `handbook/company/open-positions.yml`
- Updates the hiring manager from Alex Mitchell to Chaz MacLaughlin
## Changes
- Uncommented the full Solutions Specialist job listing (job title,
department, responsibilities, experience)
- Updated hiring manager fields:
- `hiringManagerName`: Chaz MacLaughlin
- `hiringManagerLinkedInUrl`:
https://www.linkedin.com/in/chazmaclaughlin/
- `hiringManagerGithubUsername`: chazmac6
- Fixed YAML indentation to match the format of other active positions
---
Built for [Isabell
Reedy](https://fleetdm.slack.com/archives/D0AEGJCGJR0/p1780565796045429?thread_ts=1780565771.576509&cid=D0AEGJCGJR0)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Isabell Reedy <113355639+ireedy@users.noreply.github.com>
Closes: https://github.com/fleetdm/fleet/issues/45687
Changes:
- Updated the orchestration page to be at /visibility-and-reporting, and
updated the content and layout to match the latest wireframes
- Added a redirect for /orchestration going to /visibility-and-reporting
- Removed unused images
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Launched redesigned "Visibility & Reporting" marketing page: new hero,
CTAs, feature sections, testimonials (including scrollable tweets), and
parallax background.
* Added site navigation entry for "Visibility & reporting" and redirect
from /orchestration to /visibility-and-reporting.
* **Style**
* New responsive heading styles and a dedicated page stylesheet for
improved layout, spacing, and mobile behavior.
* **Behavior**
* Testimonials payload simplified — personalization-driven headline
variations removed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Extracts the MySQL datastore initialization out of `runServeCmd` and
into a new `cmd/fleet/datastore.go`. Same pattern as the prior
extractions on this issue (#44929, #45343, #45583, #46166, #46421,
#46517). Continues the path toward `serve.go` >60% coverage per the
discussion on #33370.
Three functions come out of the inline block:
- `initDatastore` — builds the shared DB connections, the datastore, and
the carve store (S3-backed when configured, otherwise the datastore
itself).
- `buildMySQLOpts` — assembles the DB options: base logger and config,
plus the optional read replica, dev SQL interceptor, and tracing.
- `evalMigrationStatus` — prints any operator guidance for the migration
status and returns whether `runServeCmd` should exit. The `os.Exit`
stays in `runServeCmd`, so the boot/refuse-to-boot decision becomes
unit-testable without the function terminating the test binary.
Behavior is preserved — `runServeCmd` calls these in the same order with
the same arguments, the migration-exit conditions are unchanged, and the
full `cmd/fleet` suite passes against MySQL + Redis. `initDatastore`
returns early after `initFatal` so it's safe when the caller's
`initFatal` doesn't terminate (the case in tests).
On test scope: `TestEvalMigrationStatus` covers every migration status
code across the dev-mode and allow-missing-migrations combinations —
that's the real decision logic. I deliberately didn't add unit tests for
`initDatastore`/`buildMySQLOpts`: their only failure paths are paranoid
`initFatal` wrapping around constructors that don't dial at construction
time, and the option builder returns opaque option closures. Those
success paths are already exercised by booting the server, so a full
datastore mock wasn't worth it for coverage's sake.
Remaining slice per the broader plan: Redis init.
**Related issue:** Refs #33370
# Checklist for submitter
- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Reorganized database startup initialization and migration status
evaluation for improved maintainability.
* **Tests**
* Added comprehensive test coverage for database migration status
handling across various scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
@allenhouchins Documenting our VDP
## Summary
- Adds a pointer to Fleet's public Bugbop Vulnerability Disclosure
Program from `SECURITY.md` and `handbook/it/security.md`.
- Documents the program's in-scope, out-of-scope, and
typically-not-eligible categories so researchers can self-triage before
submitting.
- Keeps `security@fleetdm.com` as the channel for coordinated,
non-public disclosure.
Motivation: two recent informal disclosures (missing CAA, missing
MTA-STS) revealed that our published policy made no mention of the VDP
or its scope, which left the boundary ambiguous when declining
out-of-scope submissions.
## Test plan
- [ ] Verify rendered `SECURITY.md` on the repo's Security tab links to
the Bugbop program.
- [ ] Verify the handbook page renders the new VDP paragraph in the
"Disclosure" section without breaking surrounding structure.
- [ ] Confirm no internal/private program details are referenced.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
**Related issue:** Resolves#45022
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Prevented intermittent Android profile failures during host/team
transfers by ensuring pending Android certificates are created for
transferred devices before dependent profiles are applied. Profiles now
apply reliably, including when devices are moved off a team.
* **Tests**
* Added and updated tests to cover Android certificate provisioning
during host transfers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated security hardening tools across multiple GitHub Actions
workflows to the latest available version for enhanced CI/CD
infrastructure protection and resilience.
* Enabled additional security validation rules in workflow configuration
to strengthen infrastructure oversight and improve vulnerability
detection capabilities across build and deployment pipelines.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46567 and Resolves#46737
Solution for the agressive polling:
- no WNS (although we could add it later as another avenue for
notifications)
- fleetd advertises a sync capability, persisted as
`mdm_windows_enrollments.fleetd_sync_capable`
- The management session relaxes the DMClient poll
(`poll_schedule_relaxed`)
- When an MDM command is queued, `has_pending_commands` flips, the next
orbit check-in returns `WindowsMDMSyncRequest`, and fleetd runs
`deviceenroller` to deliver it immediately
- older fleetd versions keep the 1-minute poll
Docs: https://github.com/fleetdm/fleet/pull/46780
Changes to osquery_perf and any additional changes after loadtesting
will be done in a separate PR.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* On-demand Windows MDM sync: servers can request immediate delivery of
queued MDM commands to Windows clients; Orbit triggers client-side sync
on Windows.
* **Enhancements**
* Orbit throttles per-device on-demand sync to avoid excessive runs.
* Server reconciles and persists device poll schedule (fast vs relaxed)
and exposes consolidated host MDM state (awaiting-configuration +
has-pending-commands).
* **Tests**
* Added tests covering host config state, pending-command flows,
poll-schedule toggling, and on-demand sync behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
