Changes:
- Added a new landing page: /capex-savings
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a CapEx savings page available at `/capex-savings`.
* Added guidance on device refresh cycles, hardware performance, and
recommended replacement timing.
* Added a savings calculator for device cost, refresh cycle, and fleet
size, with estimated annual savings and assumptions.
* Added responsive layouts, imagery, calls to action, and
mobile-friendly calculator controls.
* Added supporting content on refresh recommendations, Fleet hardware
performance, and device lifecycle planning.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Brave Browser for macOS to version 151.1.93.129.
* Updated IBM Semeru JRE 8 for Windows to version 8.0.502.0.
* Updated NordPass for macOS to version 7.9.3.
* Refreshed installer information, checksums, and version detection for
the updated releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Refreshed Windows packages for 1Password, Claude, Cursor, GitKraken,
Node.js, OBS Studio, VirtualBox, and IBM Semeru JDK/JRE releases.
- Refreshed macOS packages for Arc, Beeper, BrickLink Studio, ChatGPT,
Firefox Nightly, Kiro CLI, Melodics, Azure Storage Explorer, Nextcloud
Talk, Spokenly, and Warp.
- Updated installer metadata, version detection, download sources, and
integrity checks to support the latest releases.
- Updated uninstall handling where required for 1Password and Node.js.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A
# What this does
Removes the **Captin** software icon: the `Captin.tsx` fallback icon
component and its
`SOFTWARE_NAME_TO_ICON_MAP` entry.
Captin is deprecated and is being removed as a Fleet-maintained app. Its
manifest fails
the FMA validator because the download at the pinned URL now installs
2.0.1 while
Homebrew still declares 1.3.1:
```
level=INFO msg="Looking for app: Captin, version: 1.3.1" app=Captin
level=INFO msg="Found app: 'Captin' at /Applications/Captin.app, Version: 2.0.1, Bundled Version: 203"
level=ERROR msg="App version '1.3.1' was not found by osquery" app=Captin
```
Split out of the FMA removal so the frontend change can be reviewed on
its own.
> [!NOTE]
> **Merge order.** The FMA removal (input, output manifest, and
`apps.json` entry) is in a
> separate PR. Merging this one first leaves the Captin FMA without a
fallback icon until
> that PR lands, so it should merge after — or at the same time as — the
FMA removal.
Verified nothing else references `Captin` after the removal. The one
remaining mention in
the repo is a row in `cmd/osquery-perf/software-library/software.sql`,
which is a
load-test software inventory corpus rather than an FMA reference, so it
is left alone.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
No changes file: this is not a user-visible change on its own, and
matches how other FMA
catalog/icon PRs ship (e.g. #50028, #50024).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Removed the obsolete Captin icon from the software listings.
* Prevented the retired icon from appearing in software name mappings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#50097
## Summary
FMA auto-update preserves an admin-customized install script by
comparing the active script against the new manifest's, but FMA scripts
hardcode the versioned installer filename, so a routine version bump
looked like an edit and the old script (old filename) was kept against
the newly downloaded installer, and the install failed. The fix
neutralizes the installer filename in both scripts before comparing
(mirroring the existing uninstall `$PACKAGE_ID` handling), so a
filename-only difference adopts the new script while a genuine edit is
still preserved.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
(`changes/50097-fma-auto-update-keeps-stale-install-script`).
## Testing
- [x] Added/updated automated tests (adopt-on-version-bump regression +
preserve-genuine-edit counterpart).
- [x] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed Fleet-maintained app auto-updates that could keep an outdated
install script after downloading a newer version, causing install
failures.
* Improved install-script change detection by ignoring version-only
installer filename differences.
* Continued to preserve administrator-customized install scripts when
updates change more than just the installer filename.
* **Tests**
* Added and expanded coverage for installer-script normalization and
auto-update install-script selection behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#50070
The "YAML docs" link in the GitOps callout on the custom-package flows
pointed at the unregistered slug `learn-more-about/software-yaml`,
returning a 404. Corrected to the registered
`learn-more-about/yaml-software` (302 →
`docs/configuration/yaml-files#software`). The link lives in the shared
`GitOpsCustomPackageBanner`, so this fixes it in both places it renders:
the **Add software → Custom package** page and the **Add package** modal
on the software title details page. Also updated the two unit tests that
asserted the old slug.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the GitOps custom package “YAML docs” link to direct users to
the new YAML software documentation page.
* **Bug Fixes**
* Corrected YAML documentation links in the custom package banner and
package addition modal.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes:
https://github.com/fleetdm/fleet/actions/runs/30519842615/job/90797961257.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved end-to-end test packaging reliability on macOS by adding a
retry mechanism with delays and failing after repeated unsuccessful
attempts.
* Updated end-to-end test environment hostname setup on Ubuntu to use a
transient hostname derived from the target architecture.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- updated the quote shown on the /contact page
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Content Updates**
* Updated the contact page testimonial with refreshed customer feedback
and revised attribution.
* Updated the testimonial’s company logo, as well as the author
portrait, name, and job title.
* **Style**
* Adjusted the testimonial profile image styling to render as a fully
circular image.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
…orrect URL.
Fixed a broken embedded link in the README. The link was pointing to
[old/broken destination] and now correctly points to the correct
destination.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#50056
## Summary
macOS FMA install scripts never checked the exit code of the install
command (`installer -pkg` / `cp -R`) — the script's last statement is
always `relaunch_application`, which exits 0 — so a failed install
exited 0 and Fleet reported it installed.
**Generated scripts.** The generator now propagates failure: both
`installer -pkg` variants end with `|| exit $?`, and the `cp -R` path
exits non-zero on a failed copy, removes the partial copy (so a failed
fresh install isn't inventoried as the new version), and restores the
app it moved aside. Regenerated `outputs/` for non-frozen generated apps
are produced by the `ingest-maintained-apps` job, so they aren't
committed here.
**Custom scripts.** 9 of the 18 custom input scripts had the same bug
and are fixed with the same pattern: Google Chrome, Zoom, Microsoft
Edge, GitHub Desktop, Webex, Cycling '74 Max, Pd, Grammarly Desktop, and
P4V. The DMG-based ones also now fail before removing/moving the
existing app when the mount or staging copy fails, so a bad download
can't leave a host with nothing. Their `outputs/*/darwin.json` are
updated in the same commit (script content + recomputed 8-char sha256
ref, versions untouched), following the precedent of #49033. Docker
Desktop (`set -euo pipefail`), 1Password/Slack/LogiTune (installer is
the last statement), and the rest already propagated errors.
**Frozen apps.** The ingest job never rewrites frozen outputs, so the 10
frozen apps with generated scripts (adobe-acrobat-pro, comet, evernote,
firealpaca, keeper-password-manager, nvidia-geforce-now, pritunl,
vnc-viewer, wins, worksheet-crafter) had the fix applied directly to
their published `darwin.json` scripts — the exact text the current
generator would emit, with pinned versions/URLs/hashes untouched. The
11th frozen app (logi-options+) uses a custom script that was already
correct and in sync.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
(`changes/50056-fma-install-scripts-ignore-errors`).
- [x] Untrusted data interpolated into shell scripts is validated
against shell metacharacters. (No new untrusted interpolation: the guard
reuses the same curated cask-derived name the adjacent lines already
interpolate.)
## Testing
- [x] Added/updated automated tests (three generator tests: pkg,
pkg-with-choices, cp-R restore — the last now pins the exact emitted
block).
- [x] All 19 updated output manifests validated: embedded scripts pass
`bash -n`, refs match `sha256(script)[:8]`, refs map stays key-sorted
like Go's encoder.
- [x] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* macOS Fleet-maintained app installations now fail fast when
installers, DMG extraction/mounting, or app copy steps error.
* If an upgrade fails, the system removes any partial app and restores
the previously installed version when available.
* Improved robustness during app staging/copying, including safer
handling of paths with spaces or special characters.
* **Tests**
* Added unit coverage to verify installer failure propagation and
rollback behavior.
* **Documentation**
* Clarified that the install-script error handling applies to both
generated and custom scripts, including already-published frozen apps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Proton Drive for Windows to version 3.0.4.
* Refreshed the installer download reference and checksum verification.
* Improved uninstall behavior by adding a pre-uninstall stop for running
Proton Drive processes and introducing a timeout-based “watchdog” to
prevent the uninstaller from hanging.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
**Related issues:** Resolves#50068, Resolves#50106, Resolves#50107,
Resolves#50108, Resolves#50110, Resolves#50114
Follow-on fixes from QA of #41470 (Python script-only packages):
- Software-installer validation errors are action-neutral, so the Add
and Edit flows each show the correct single verb, and the
unsupported-file error names a content/format mismatch instead of
blaming the extension (#50068, #50107).
- `.py` packages accept `setup_experience_platform` (`darwin`/`linux`),
matching `.sh` (#50106).
- A failed-to-run install script (exit code `-1`) now renders a
diagnostic instead of empty output, and orbit surfaces the underlying
execve error (#50108).
- The install-rejection message for `.sh`/`.py` packages says "macOS and
Linux hosts" instead of "linux" (#50110).
- Orbit writes each script's temp file with an extension matching its
shebang (`.py`/`.sh`/`.ps1`), so tracebacks reference the right file
type (#50114).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes.
- [x] Verified compatibility with the latest released version of Fleet
(orbit-only change; the server↔agent `SoftwareInstallDetails` contract
is unchanged).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved installer validation and rejection messaging for
unsupported/invalid package contents (including correcting “add” vs
“edit” wording and avoiding duplicated phrasing).
* Added clearer diagnostics when install scripts fail to start
(including empty output cases).
* Corrected handling of script-only packages so Python scripts use the
proper script type/extension, reducing misleading tracebacks.
* Updated platform availability messaging so `.sh`/`.py` packages
display macOS+Linux support.
* **New Features**
* Python script-only packages can now specify macOS and Linux setup
experience platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#48416
When adding a Fleet-maintained app, a large-installer download that's
canceled or times out now returns a clear message pointing at the likely
proxy/load-balancer timeout, instead of a raw `context canceled`.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved error messages when adding Fleet-maintained apps times out or
is canceled during large installer downloads.
* Added clearer guidance for configuring server, proxy, and load
balancer timeouts.
* Properly handles additional timeout and upstream cancellation
responses, including HTTP 408, 499, and 504.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The host transfer endpoint recorded raw requested host IDs in the
transferred_hosts activity verbatim, letting an authorized user inject
fabricated IDs into the audit trail. Derive the activity's host IDs and
names only from hosts that actually exist, and skip the activity when
none exist.
Reset tokens are base64url (case-sensitive) but the
password_reset_requests.token column used case-insensitive
utf8mb4_unicode_ci, so a case-mutated token copy still matched. Switch
the column to utf8mb4_bin for byte-exact comparison.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Evernote for Windows to version 11.27.5.
* Updated Granola for Windows to version 7.452.1.
* Updated Postman for Windows to version 12.21.7.
* Updated Trezor Suite for macOS to version 26.7.3.
* Refreshed installer links and verification checksums for each release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added availability for the latest releases of numerous maintained
applications across Windows and macOS.
* Updated applications include Chrome, Firefox Nightly, Postman, Signal,
Notion, Podman Desktop, Draw.io, CMake, JDK/JRE, and many others.
* **Bug Fixes**
* Refreshed installer links, version detection, and package verification
data to ensure updates install and validate correctly.
* Updated app-specific installation handling where required for newer
releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA — fixing a failing scheduled "Update
Fleet-maintained apps" run.
Removes the **macOS** Dynalist Fleet-maintained app. The Windows
(winget) FMA is unaffected and stays.
## Why
The `dynalist` cask was deleted from homebrew-cask on 2026-07-30
([commit
`adac21ffc4`](https://github.com/Homebrew/homebrew-cask/commit/adac21ffc401)),
completing Homebrew's full deprecation lifecycle:
- `deprecate!` 2024-07-29, `because: :unmaintained`
- `disable!` 2025-07-29
- cask file removed 2026-07-30
`https://formulae.brew.sh/api/cask/dynalist.json` now returns 404, so
the scheduled ingester panics:
```
{"level":"INFO","msg":"ingesting homebrew app","name":"Dynalist"}
panic: ingesting homebrew app: app not found in brew API
```
Marking the app `"frozen": true` does **not** fix this — the ingester
fetches the cask JSON before the frozen flag is consulted
(`cmd/maintained-apps/main.go`), so removal is the only fix for a dead
upstream cask.
## What changed
Deletions only (39 lines, no additions):
- `ee/maintained-apps/inputs/homebrew/dynalist.json` — deleted
- `ee/maintained-apps/outputs/dynalist/darwin.json` — deleted
- the `dynalist/darwin` entry in `ee/maintained-apps/outputs/apps.json`
— removed; `dynalist/windows` remains
## Deliberately kept
Because the Windows FMA still needs them:
- `ee/maintained-apps/outputs/dynalist/windows.json`,
`ee/maintained-apps/inputs/winget/dynalist.json`, and its
install/uninstall scripts
- `frontend/pages/SoftwarePage/components/icons/Dynalist.tsx` and its
`dynalist:` mapping in `icons/index.ts` — the map is keyed by lowercased
app name and is shared across platforms
- `website/assets/images/app-icon-dynalist-60x60@2x.png` — keyed by slug
token, still serving the Windows entry in the app library
## Note for reviewers
Hosts that currently have the macOS Dynalist FMA installed will lose the
maintained-app entry on the next sync. This matches the behavior of
prior FMA removals (Nocturnal #50050, Dell Display Manager #47420,
Messenger #46541).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
Not applicable — consistent with prior FMA removal PRs, which do not add
a changes file.
## Testing
- [x] QA'd all new/changed functionality manually
Verified that `ee/maintained-apps/outputs/apps.json` still parses as
valid JSON (1381 apps) and that `Dynalist` now resolves to only
`dynalist/windows`. Confirmed the 404 against the brew API and read the
pre-removal cask at `adac21ffc4~1` to establish the deprecation reason.
`git diff` confirms the change is deletions-only.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Standardized websocket error responses when requested campaigns are
unavailable.
* Prevented campaign existence from being inferred through differing
error messages.
* Improved consistency for both nonexistent campaigns and campaigns
inaccessible to the current user.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#44406
Windows programs report a version in their name (e.g. `Granola
7.373.2`), so each version created its own `software_title` and never
linked to the Fleet-maintained app installer's title (`Granola`), hiding
the uninstall action. macOS handles this via `bundle_identifier`;
Windows had no join key.
- Give matching Windows programs the canonical FMA name at ingestion
(name-prefix match), so all versions collapse onto the title the
installer owns. `software.name` is unchanged.
- Merge already-mismatched versioned titles onto the canonical title in
`ReconcileMaintainedAppSoftwareNames` (runs on FMA sync; no migration
needed).
---------
Co-authored-by: Tim Lee <timlee@fleetdm.com>
Co-authored-by: Juan Fernandez <juan@fleetdm.com>
Changes:
- Updated the contact source used for contacts created from workshop
requests
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Workshop requests are now correctly identified as “Website - Workshop
request” in CRM records, improving source tracking and reporting.
* Workshop request contacts are treated as form-based, ensuring the most
recent campaign member status is set to **Registered**.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48217
This does update a couple of places, but I checked and it should only be
for Status indicators.
Figma spec with 4px rather than 8px:
https://www.figma.com/design/gxvU745LfOdkE9AuRg64wi/%F0%9F%A7%A9-Product-design-system?node-id=858-23&t=QwTqGmpK0V3inArL-0
<img width="1119" height="407" alt="image"
src="https://github.com/user-attachments/assets/8cae52d6-dbb9-4b8d-80d6-1a899790ad82"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Reduced the spacing between icons and text for a more compact,
consistent layout across the product.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated AWS CLI for Windows to version 2.36.11.
* Updated Windsurf for macOS to version 3.6.22.
* Updated Gitify for macOS to version 7.2.0.
* Updated GoLand for Windows to the 2026.2 release.
* Updated Linear for macOS to version 1.32.0.
* Updated Rancher Desktop for macOS to version 1.24.0.
* Refreshed installer links and verification data for each release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A
# Checklist for submitter
This PR adds one markdown file under `articles/` (a customer case study)
— no product code, so most of the template below doesn't apply.
## What changed
Adds `articles/hawx.md`, a case study on Hawx Pest Control.
**The story:** Hawx is a technology-first pest control company whose
field technicians can't be dispatched without a provisioned phone.
Hiring ramps up hard every summer, so onboarding and offboarding run
constantly. With Jamf, phones sat on the MDM screen until the technician
logged in, nobody remembered their credentials, and the helpdesk got
flooded from personal phones every season. Identifying which device
belonged to which technician took 5 to 10 minutes per call, 5 to 10
calls a day. Hawx now drives Fleet entirely through the API, paired with
Tines and Okta, so a device lands in the right fleet with the correct
profiles, policies, and apps the moment the technician verifies their
identity. Offboarding wipes or locks based on role. Migration took a
month.
**Source:** the 2026-07-20 customer interview with Loren Farr, IT
Manager at Hawx. Loren confirmed on the call that Fleet may use the
company name and his name and title, and was told nothing publishes
without his approval.
**Format:** drafted against the proposed `fleet-case-study-formatting`
skill in #49917 and the `content-style` skill:
- Three-act narrative (the challenge → why Fleet → the solution → the
results), headings in sentence case.
- Four `attribution-quote` divs spaced through the narrative rather than
clustered.
- A `checklist` div for the headline results.
- Full endmatter including the build-enforced `summaryChallenge` /
`summarySolution` / `summaryKeyResults` (semicolon-separated) plus the
company and hero-quote tags.
- "About Hawx" lives in `companyInfo` / `companyInfoLineTwo` rather than
the body, matching every published case study.
## Why
Hawx is a strong story in a segment Fleet's published case studies don't
yet cover: iOS-only, a small IT team (3 people, ~500 devices), a
seasonal workforce, and an API-only usage pattern where the customer
never touches the Fleet UI. It's also a clean Jamf migration narrative
with a quantified helpdesk result.
## ⚠️ Blockers before this can be published
This is a **draft PR on purpose**. Two items must be resolved first:
1. **The quotes are not verbatim yet.** The interview record is bullet
notes, not a transcript, so the four quotes are faithful reconstructions
of what Loren described, not transcribed speech. The case-study skill's
rule is that quotes are verbatim and never reconstructed. **Loren needs
to approve these as his words before merge.** Reviewers should not treat
them as citable until he has.
2. **Both image assets are missing.** There is no Hawx logo and no Loren
Farr headshot in `website/assets/images/`. `companyLogoFilename` and
`quoteAuthorImageFilename` are deliberately stubbed with `TODO-`
prefixes so the website build fails loudly rather than shipping broken
image references. Real files are needed following the
`{descriptor}-{css-width}x{css-height}@2x.{ext}` convention.
## Open questions for reviewers
- **The "more than 90%" figure was dropped.** An earlier draft said
credentials were forgotten in more than 90% of cases. That number isn't
in the interview notes (the notes say "nobody knew their username or
password"), so it's omitted. If Loren sourced it, it can go back in.
- **The warehoused-device problem is omitted.** The notes describe
devices offline more than 30 days needing a reset, currently a 30-minute
call, listed as a *current* problem. That would fit a "Looking ahead"
section if Fleet is the plan for it, but it doesn't belong in results as
an achieved outcome.
- **Hero quote choice.** `quoteContent` uses the "slam dunk ... control
over the phone itself" quote because it names the differentiator.
Loren's closer, "As long as you're not shy about getting into the code,
this is a fantastic platform," is arguably the more trustworthy line for
Fleet's audience. Easy swap if marketing prefers it.
- **Follow-up, not in this PR:** the pull quote could be added to
`handbook/company/testimonials.yml` for the `/customers` carousel. Left
alone since that file is curated by marketing.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`. — N/A, website content
only, not a product change
## Testing
- [ ] Added/updated automated tests — N/A, markdown content only
- [x] QA'd manually: cross-checked the structure, custom div syntax, and
required meta tags against the published case studies
(`articles/fastly.md`, `articles/primo.md`) and against the validation
logic in `website/scripts/build-static-content.js`; confirmed
`summaryKeyResults` is semicolon-separated; confirmed `articleTitle`
matches the H1 exactly; grepped `website/assets/images/` and confirmed
both referenced image files are absent (hence the `TODO-` stubs).
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
**Related issue:** NA
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
---
Updates the leave-behind deck with revisions from design review:
* Updated headings on slide 2 to address pain sooner
* Moved "The world has evolved rapidly" heading to slide 3
* Incorporated platform icons into illustration graphic
**Related issue:** Related to fleetdm/confidential#16762 (not a full
close — see Notes)
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
## Summary
Redesigns fleetdm.com/support:
- Merges the previous "Ask the community" and "Support" sections into
one unified "How can we help?" section with a single 6-card grid
- Adds a new "Professional support" card linking to the SLA section of
the go-to-market-operations handbook page
- Adds a customer testimonial
- Consolidates responsive breakpoints (single-column switch and card
centering now both happen at 991px)
- Removes target="_blank" from the two cards linking to fleetdm.com
itself (Professional support, Ask us anything).
## Related
- fleetdm/confidential#16762
## Notes
This is a first iteration toward the broader vision in
https://github.com/fleetdm/confidential/issues/16762, discussed in
design review but intentionally deferred.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Redesigned the Support page header into a single “How can we help?”
entry point.
* Added a Professional Support card linking to service-level agreement
details.
* Introduced a customer quote section with author information.
* **Improvements**
* Refreshed support card design (cleaner layout, consistent spacing,
updated typography and link hover behavior).
* **Responsive**
* Improved the support card layout across breakpoints, including
3-column to 2-column to single-column grid behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
Run: https://github.com/fleetdm/fleet/actions/runs/30451947297.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security**
* Added an OpenVEX document for **CVE-2026-56852**.
* Documented that the vulnerability is **not affected** for the
**fleetctl** product under the specified conditions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated Krita for Windows to version 5.3.3.0.
- Updated Loom for macOS and Windows to version 0.365.0.
- Updated Vivaldi for Windows to version 8.1.4087.61.
- Refreshed installer links and verification data to support reliable
installation and version detection.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated managed Zed app installers for macOS and Windows to version
1.13.1.
* Updated download links and integrity checks to match the new release.
* Improved version detection so outdated installations are correctly
identified.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Eric
