Remove unnecessary surrounding double quotes from the `resolution` field
in
it-and-security/lib/all/policies/npm-supply-chain-compromised-packages.yml.
This cleans up the YAML and prevents literal quote characters from
appearing in rendered output; no functional change to the resolution
text.
Delete the explicit 'platform: darwin,linux,windows' line from the
hosts-with-npm-package-inventory label so the dynamic label applies
regardless of OS. The label still uses the same query (SELECT 1 FROM
npm_packages LIMIT 1) and remains dynamic; this change prevents
unintentionally excluding platforms.
Second PR in the staged plan from
[#33370](https://github.com/fleetdm/fleet/issues/33370#issuecomment-4394807680).
Per [@getvictor's
confirmation](https://github.com/fleetdm/fleet/issues/33370#issuecomment-4421816049),
takes the package-level var approach so tests can swap `initFatal`
without terminating the test binary.
The new `TestGetTLSConfigInvalidProfile` covers `getTLSConfig`'s default
case (previously unreachable in tests because it calls `initFatal`)
**Related issue:** Part of #33370.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
## Database migrations
_N/A — no database migrations in this PR._
## New Fleet configuration settings
_N/A — no new configuration settings._
## fleetd/orbit/Fleet Desktop
_N/A — no agent code changes._
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Improved test coverage for TLS configuration error handling.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45343)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Adds a new policy `TanStack supply-chain attack - not affected` to the 💻
Workstations fleet that checks `npm_packages` on macOS, Windows, and
Linux hosts for any of the known-malicious `@tanstack/*` package
versions involved in the recent supply-chain compromise.
The policy returns **1 (passing)** when no compromised package/version
pair exists on the host, and **fails** when at least one match is found
— making it easy to triage affected workstations from the Fleet UI.
## Changes
- New file: `lib/all/policies/tanstack-supply-chain-attack.yml` — the
policy definition.
- Updated: `fleets/workstations.yml` — registers the new policy under
the `policies:` list.
## Notes
- `calendar_events_enabled` is left at the default (off).
- Platform is set to `darwin,windows,linux` because the `npm_packages`
osquery table is cross-platform and developer dependencies can land on
any workstation OS.
- Resolution guidance instructs users to remove/downgrade the affected
packages and rotate any developer credentials that may have been
exposed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Detect compromised npm packages on workstations (cross-platform) with
remediation guidance.
* Enforce per-user npm "min-release-age" on macOS, Linux, and Windows
with automated remediation.
* Add a host label for machines reporting an npm package inventory.
* **Chores**
* Add cross-platform scripts to automate updating per-user npm
configuration.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45264)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Style fixes, including color and spacing.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Refined spacing and typography across the patch-faster landing page
for improved hierarchy and readability.
* Updated hero text (removed trailing period) and increased H1 size;
removed several section dividers for cleaner flow.
* Restyled proof strip into a light, bordered panel with darker neutral
text and adjusted highlight colors.
* Changed feature icon background to a light neutral; adjusted CTA
gradient start and internal spacing.
* Improved responsive paddings and gaps at tablet and desktop
breakpoints.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45338)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Added details on Simplified Platform SSO introduced in macOS 26,
including prerequisites, configuration steps, and user experience.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#30674
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43640
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
I figured out that the RunScriptModal was being re-rendered without any
user events or network calls after the 2s mark.
At first I thought the parent (ScriptModalGroup.tsx) could have been the
culprit since there's a lot going on there (lots of callback functions
passed to multiple modals).
It turns out that RunScriptModal is wrapped in React.memo to avoid
re-rendering but since some of its props changed in the parent
component, this caused it to re-render and close the Actions dropdown
randomly.
To detect which where the problematic props changing, I threw this code
at the top of RunScriptModal.tsx:
```react
const prev = useRef<any>({});
useEffect(() => {
const current = {
currentUser,
hostTeamId,
onClose,
page,
setPage,
hostScriptResponse,
isFetchingHostScripts,
isLoadingHostScripts,
isError,
onClickViewScript,
onClickRunDetails,
onClickRun,
isRunningScript,
isHidden,
};
const changed = Object.entries(current).filter(
([k, v]) => prev.current[k] !== v
);
console.log(
"RunScriptModal re-render. Changed props:",
changed.map(([k]) => k)
);
prev.current = current;
});
```
and the output was:
```
RunScriptModal re-render. Changed props:
(2) ['onClickViewScript', 'onClickRunDetails']
```
So I just wrapped those two in useCallback and that fixed the issue.
https://github.com/user-attachments/assets/f6eae13e-2a60-4fda-9468-2952acdedd58
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
* Fixed the Actions dropdown in the Run script modal on the Host details
page auto-closing after 2-3 seconds.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45349)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Related to, but does not resolve, #45267
Adds a 12h cooldown period such that when npm is resolving dependencies
it will not resolve anything released less than 12 hours ago. This
doesn't apply globally within the fleet project because some portions
use yarn which #45267 will take care of however this does add it to our
CI jobs and the .npmrc files for projects that use npm
I was going to set this as NPM_CONFIG_MIN_RELEASE_AGE in a github EV but
that won't automatically set it on every runner so leaving it in here
for now
As far as QA local builds and CI are both green. Tested
NPM_CONFIG_MIN_RELEASE_AGE=0.5 and min-release-age=0.5(in npmrc) locally
using the npm package feed https://registry.npmjs.org/-/rss to verify
that recently updated packages either chose an older version OR the
update was blocked if I tried to choose a newer one
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enhanced npm supply-chain security by implementing package
installation policies across build workflows and configuration files to
exclude packages released within the last 12 hours.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45268)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#43609 and #43566
Fixed bug were toggling GitOps mode was creating a spurious
update_conditional_access_bypass activity whenever Okta conditional
access was already configured with bypass_disabled=true.
**Related issue:** Resolves#44459
## Summary
Fixed an issue where the recovery lock password for a macOS host could
become unretrievable via the UI and API after the host was transferred
to a team with recovery lock disabled, even though the password was
still stored in the database.
## Root causes
Three bugs combined to produce the symptom:
- **Frontend visibility**: `canShowRecoveryLockPassword` gated the "Show
Recovery Lock password" action on the current team's
`enable_recovery_lock_password` setting and ignored the
`recoveryLockPasswordAvailable`
signal, so the UI option vanished whenever the host's new team had the
feature off.
- **API 404 on view**: `MarkRecoveryLockPasswordViewed` returned a
`notFound` error when its UPDATE matched zero rows. This happened as
soon as the `ClaimHostsForRecoveryLockClear` cron flipped the password
row's
`operation_type` from `install` to `remove` — causing `GET
/hosts/:id/recovery_lock_password` to 404 even though the password had
already been successfully retrieved and decrypted moments earlier in the
same
request.
- **Stale rotation deadline**: `ClaimHostsForRecoveryLockClear` left the
row's `auto_rotate_at` untouched when flipping to `remove`, so
subsequent reads still surfaced the pre-transfer view-deadline and the
UI
rendered a rotation banner promising an auto-rotation that the cron
(filtered on `operation_type='install'`) would never honor.
## Fix
- **Frontend**: updated `canShowRecoveryLockPassword` to also show the
action when a password is available, regardless of the team setting.
- **API**: changed `MarkRecoveryLockPasswordViewed` to return a zero
`time.Time` with no error when no install-state row exists. The service
skips the `AutoRotateAt` assignment in that case and explicitly nulls
any stale value loaded from the DB, so the response's `auto_rotate_at`
is omitted.
- **Data hygiene**: updated `ClaimHostsForRecoveryLockClear` to also set
`auto_rotate_at = NULL` when flipping a row to `remove`, since the
rotation deadline is meaningful only for install-state rows.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45230, Resolves#45213
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
#### For 45213
Did a gitops run to apply external URLs as logos:
<img width="395" height="122" alt="Screenshot 2026-05-12 at 10 52 25 AM"
src="https://github.com/user-attachments/assets/a1fea9ce-7a3d-419b-8c56-68568dcc704e"
/>
Command: `./build/fleetctl gitops -f
/Users/nico/dev/gitops-output-test/default.yml` (**gitops-output-test**
is where I usually have my gitops outputs).
Then I deleted both from the UI:
https://github.com/user-attachments/assets/03899795-7cda-485d-b87e-25f829b928b7
#### For 45230
- Uploaded logos using **org_logo_path_dark_mode** and
**org_logo_path_light_mode** in the first GitOps run.
- In the second GitOps run, set **org_logo_url_dark_mode:
"https://placehold.co/100"** and **org_logo_url_light_mode:
"https://placehold.co/100"**.
https://github.com/user-attachments/assets/4dfd0440-9a17-44e1-aa7d-395afd9c7d7a
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Organization logo deletion is idempotent and no longer errors on
repeated deletes.
* Orphaned hosted logo blobs are cleaned up after config changes;
deletion or activity-emission failures are logged and do not abort
requests.
* Conflicting/contradictory URL updates now produce validation errors.
* **Improvements**
* GitOps/logo sync strips gitops-only path keys and only performs
uploads in non-dry-run flows.
* Logo URL handling simplified: deprecated alias fields are mirrored and
path keys are stripped to avoid unintended deletions.
* **Tests**
* Added lifecycle tests for upload/delete, activity emissions, and
in-memory PNG generation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45236)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
FYI @rfoo2015
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated open job postings: replaced the Channel Account Manager with a
Controller role in Finance; updated hiring manager, on-target earnings,
and revised responsibilities and experience to reflect
controller/accounting requirements.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45289)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Refreshed version metadata and installer information for over 25
third-party applications, including Slack, Discord, Docker Desktop,
Claude, Firefox, Grammarly, Granola, MongoDB Compass, Signal, Telegram,
Teleport, Visual Studio Code, Notion, and others. Updates include new
installer URLs, updated security checksums, and modified version
comparison logic across macOS and Windows platforms.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45334)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
This is an experiment landing page to see if we get any different
results from his post
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added "Patch Faster" landing page with marketing content, responsive
styles, and page-level meta (title/description)
* Interactive demo request form with client-side validation, submission
flow, conversion tracking, and success state
* Integrations/platforms and proof sections plus a CTA and client script
to boot the page UI
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45278)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45290
Just drops the mobile platforms from the platform list in the chart
filters modal.
You can still find mobile devices by searching for now, as filtering
them out is a bigger change requiring either backend work or
on-the-glass filtering + pagination which is bug-prone.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated platform filter options in chart filters. iOS, iPadOS, and
Android are no longer available as filter options; macOS, Windows,
Linux, and ChromeOS remain supported.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45310)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45163
# Details
Limits CVE data collection to only those CVEs which we report on in the
chart. This is a performance optimization necessitated by the large
amount of data that bigger fleets may generate. The plan is to implement
a data compression strategy so that we can go back to collecting full
CVE data soon.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] Ran some collection jobs and verified that only tracked CVEs were
represented in "open" rows.
- [ ] Ran load test w/ new code
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
should improve results!
- [X] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Enhancements**
* CVE vulnerability tracking is now scoped to a curated set of critical
vulnerabilities, improving the relevance of security impact data
displayed across your systems.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45247)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42405
Unreleased bug fix.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Android MDM profile detail messages (e.g., certificate status) are
preserved when adding additional profiles or marking profiles pending,
preventing loss of important status information.
* **Tests**
* Added an integration test verifying ONC/certificate detail is retained
when additional Android MDM profiles are uploaded for the same team.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45299)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Updated the build-static-content script to modify links to embedded
YouTube videos to use youtube-nocookie.com instead
- Removed unused video modals on the homepage and orchestration page
- Updated embedded video links to use youtube-nocookie.com instead of
youtube
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced privacy for embedded YouTube videos site-wide by switching to
a privacy-focused embed domain.
* **Bug Fixes**
* Removed several end-of-page video modals (homepage and observability)
and consolidated homepage content into a preferences-focused modal;
minor content cleanup including a hidden identifier for page handling.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45275)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44046
# Details
Updates GitOps to ensure that team labels are created before any
consumers (e.g. profiles, policies, software) that might use the labels
are applied. It does this by adding a new `afterTeamApply` callback
option to `ApplyGroup` that is called after team config is applied --
this is when team labels are now created, instead of after `ApplyGroup`
runs.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed GitOps deployments failing when a label and a profile that
references it are created in the same run.
* Ensures the correct apply ordering so dry-run/log output shows label
application before profile application.
* **Tests**
* Added a regression test validating label → profile apply ordering to
prevent future regressions.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45194)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Updated test fixtures for Apple VPP configuration in GitOps workflows
to better reflect real-world scenarios.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45305)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44801
Fixed remaining issue setting end user authentication in the UI.
The root cause was that the frontend was always sending
`enable_managed_local_account : false` even when macOS MDM was disabled.
Fix:
<img width="756" height="363" alt="image"
src="https://github.com/user-attachments/assets/5f88797d-c5c3-4c03-9048-c8ee2981c374"
/>
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Automatic syncing of "Lock end user info" when toggling End User
Authentication now only runs when Apple MDM is enabled and configured
(with an exception when EUA is being disabled to preserve behavior).
* Save payloads omit Apple-only fields unless Apple MDM is configured.
* **UI**
* "Lock end user info" checkbox shows an Apple MDM–gated tooltip and is
disabled when Apple MDM is not configured.
* **Tests**
* Added coverage for Apple MDM–gated behaviors and saved-payload
variations.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45212)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42026
- Show "uninstall" button if the status is `installed` (or
`recently_installed`) which just reflects that the install script ran
successfully, not that the software title for the installer is in the
software inventory. For example, even with a no-op install script that
exits successfully the button will be available.
- Make the status clickable by removing the recentlyTakenAction check,
since that only represents the last install script that ran. This should
only really affect the `recently_installed` status (according to claude
at least).
This behaviour is already possible through the API, but it mostly
depends on the specific uninstall scripts if they will pass or fail when
the software doesn't even exist.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Uninstall option now appears for installers even when the host
inventory lacks a matching software entry, ensuring uninstall remains
accessible.
* **Tests**
* Added regression tests verifying the uninstall button is visible and
enabled for relevant installed states, including on personal device
pages.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45273)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45220 (one of many small PRs)
## Testing
- [x] QA'd all new/changed functionality manually. (Ran basic smoke
testing.)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added a consolidated test utilities package to boot full test servers,
seed users, retrieve auth tokens, and provide common mocks for
integration/service tests.
* Updated integration and service tests to use the new helpers for more
consistent, reliable test setup and wiring.
* **Chores**
* Centralized and reorganized test configuration types and options, and
standardized test wiring for clearer, maintainable test setup.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45221)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add Jonathan Porter to the Customer Success team.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Adding documented profiles for PSSO simplified setup. These are
specifically for the macOS 26+ feature, though most of what's in them is
also applicable to lower versions
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Documentation**
* Added example configuration profiles for macOS SSO extension setup
with Entra and Okta platforms.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45157)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Part of #38790. Stacked on top of #44935.
Closes#43968.
The two activate functions are the only `InstallApplication` command
builders, so fetching configuration and substituting `$FLEET_VAR_*`
inside them covers every enqueue path (manual, self-service, policy
auto-install, scheduled auto-update, setup experience, retry, admin
reinstall) by construction. Documents this invariant on each function.
Adds integration tests asserting an iOS install enqueues
`<key>Configuration>` with the host UUID substituted in, and macOS
installs omit the field.
---------
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
Sharon Katz
