Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 21 Packages Projects Releases Wiki Activity
26,648 Commits 2 Branches 0 Tags
d2fe9be461df9f1f19559d5b2cf52d841cc2b678
Commit Graph
26648 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
fleet-releaseandallenhouchins d2fe9be461 Update Fleet-maintained apps (#50584) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Updates**
  * Updated Graphviz for Windows to version 15.1.1.
  * Updated PDFsam Basic for Windows to version 6.0.5.0.
  * Updated Visual Studio Code for macOS to version 1.132.0.
  * Updated Wavebox for macOS ARM to version 151.2.148.2.
  * Updated WhatsApp for macOS to version 26.31.19.
  * Refreshed installer details and version checks where applicable.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-08-05 10:23:17 -05:00
fleet-releaseandallenhouchins 72c224bd78 Update Fleet-maintained apps (#50574) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Updates**
* Refreshed supported macOS and Windows application packages to their
latest releases, including Asana, Chrome, Dropbox, Microsoft 365,
Postman, Thunderbird, Todoist, and many others.
* Updated version detection so devices recognize the new releases and
receive applicable upgrades.
  * Refreshed installer downloads and verification data where required.
* Updated installation instructions for selected applications, including
Duo Desktop, Microsoft Office, Nextcloud, Nudge, Santa, and Tailscale.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-08-05 09:14:46 -05:00
Magnus Jensen 1abeb175f3 AULD: Enrollment insert and backfill osquery query (#50131) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #47714 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. (Will be part of another PR)

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Collect and persist macOS software update device identifiers for hosts
during both manual and OTA enrollment flows.
* Added an osquery detail/query to derive the identifier from hardware
properties and upsert it into datastore.
* **Bug Fixes**
* Host deletion now also removes related Apple macOS OS update records.
* **Improved Device Recognition**
* Enhanced Mac model identifier parsing and refined Apple Silicon
detection with expanded test coverage.
* **Reliability**
* Enrollment profile delivery remains unaffected if saving the
identifier fails (errors are logged).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-05 15:37:05 +02:00
Andrew MellorandMagnus Jensen 192ac4eb51 48093 auld api gitops latest os version (#50213) 
**Related issue:** Resolves #48093

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually


## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`

- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added “latest” version enforcement for macOS, iOS, and iPadOS updates
using required `deadline_days`.
* Updates dynamically target each device’s available OS version and
deadline.
  * Configuration and GitOps outputs now include `deadline_days`.

* **Bug Fixes**
* Improved validation when switching update modes or omitting deadline
settings.
* GitOps updates now clear previously stored deadline values when
omitted.
  * Changes to `deadline_days` are detected and applied consistently.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
 2026-08-05 12:37:11 +01:00
Rajendra Kadam 5e95589554 Support custom activations and management declarations for DDM profiles (#50280) 
**Related issue:** Resolves #49970

Adds custom activations to the single-profile paths for declaration
(DDM) profiles — create, edit, delete and read — and unblocks management
declarations. Part of #48222.

Batch/GitOps is #49972; serving the custom activation to devices is
#49971.

### Custom activations

- `POST /configuration_profiles` and `PATCH
/configuration_profiles/{uuid}` accept an optional `activation` file
part, rejected for any profile type other than an Apple declaration.
- Validation requires an activation `Type` (any
`com.apple.activation.*`, so future Apple types need no Fleet change),
an `Identifier`, and exactly one `StandardConfigurations` entry naming
the configuration it ships with. `Predicate` and every other key are
stored and served verbatim for the device to evaluate.
- Premium-only, unconditionally. `parseAndValidateAppleDeclaration`
requires premium only when a fleet or labels are involved, so an
unassigned unlabeled DDM profile is free today; the activation carries
its own gate.
- The activation's Fleet variables are validated against
`fleetVarsSupportedInDDMDeclarations` — already exactly the set
specified for activations — and associated via
`mdm_configuration_profile_variables.apple_ddm_activation_uuid`.
- Returned base64-encoded on both the list and single-profile endpoints,
per the API reference draft (#49768), and omitted entirely when absent.

What an edit does to a stored activation:

| Request | Result |
| --- | --- |
| activation supplied | replaces the stored one |
| new profile content, no activation | stored one is cleared — this is
how it's removed |
| labels-only edit | stored one is carried forward |

The third row matters: the datastore clears the activation of any
declaration written without one, so a labels-only edit rebuilding the
declaration from the existing row would otherwise silently wipe it.
`GetMDMAppleDeclaration` loads the activation so it can be carried
forward, and there's a test asserting it.

### Management declarations

`com.apple.management.*` uploads are unblocked via a prefix check, so
future management declarations work without a product change. Types to
block go in the existing `ForbiddenDeclTypes` deny list, which is
already evaluated ahead of the prefix. An activation supplied alongside
a management declaration is rejected — those are never activated.

Routing them to the manifest's Management section is #49971's work.

### Notes for review

**Where the non-declaration guard lives differs by path, deliberately.**
Create resolves the profile type in the endpoint from the uploaded file;
edit resolves it in the service from the UUID prefix. The check sits
wherever the type becomes known. Both use the same message so the
mistake reads identically.

**Endpoint-level errors must be returned from behind an authz check.**
The create-path guard originally returned the error straight from the
endpoint, which skips authorization and surfaces to the client as a bare
`forbidden` rather than the validation message. It now goes through
`NewMDMActivationUnsupportedProfile`, alongside the existing
`NewMDMUnsupportedConfigProfile` and `NewMDMInvalidJSONConfigProfile`,
which exist for the same reason. This was caught by the integration
tests, not the unit tests — service-level tests bypass the authz
middleware.

**Activation rows are keyed on `declaration_uuid`, not inserted fresh.**
An edit reuses the row, so the Fleet variable associations hanging off
it survive. The UUID is read back after the upsert rather than reusing
the generated one, since `ON DUPLICATE KEY UPDATE` keeps the existing
row.

**Secrets are expanded for validation but stored unexpanded**, so
validation runs against the document the device receives without
persisting secret values.

`MDMAppleCustomActivation` is the storage type; `MDMAppleDDMActivation`
was already taken by Apple's wire format.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

No changes file: the feature isn't reachable by users until the DDM sync
work in #49971 lands.

## Testing

- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually

**Unit** (`server/fleet`): `GetRawActivationValues` and
`ValidateUserProvided` — valid activation, unknown type under the
activation prefix, missing `Type`, a configuration type supplied as an
activation, missing `Identifier`, zero/multiple/mismatched
`StandardConfigurations`, all problems reported at once, plus
`IsManagementDeclaration`.

**Service** (`server/service`): activation accepted, mismatched
configuration rejected, malformed JSON rejected, rejected on a
management declaration, supported Fleet variables recorded, unsupported
rejected, premium required even where the declaration is free. On edit:
activation-only edit keeps content, labels-only edit preserves the
activation, new content without an activation clears it, and exactly one
`edited_declaration_profile` activity fires.

**Datastore** (`server/datastore/mysql`): write, read-back through list
and single get, edit reusing the row, Fleet variable association, and
removal cascading to the variable rows.

**Integration** (`integration_mdm_ddm_test.go`): multipart upload with
an activation, read back and asserted base64-decoded against the raw
response body; the key omitted entirely for a declaration without one;
two management declarations uploaded and coexisting; activation on a
`.mobileconfig` rejected on both create and edit; activation-only
`PATCH` replacing the activation while leaving the declaration
untouched.

The multipart test helper now supports more than one file part — nothing
could build that request before, which is why the decode path was
previously untested. Single-file callers are unchanged.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added optional custom activations for Apple DDM configuration
declarations.
- Activations support secrets, Fleet variables, and custom host vitals.
- Activation data appears when viewing or downloading applicable
profiles.
- Activation files can be added, updated, preserved during label-only
edits, or removed during content replacement.
- Management declarations can coexist with supported configuration
declarations.

- **Validation**
- Added checks for declaration matching, supported profile types, file
limits, and Premium licensing.
- Clear errors are provided when activations are used with management
declarations or non-DDM profiles.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-05 15:29:52 +05:30
fleet-releaseallenhouchinsAllen Houchins
 		33b4efe9c1 Update install script and Fleet-maintained apps (#50499) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Chores

* Updated numerous maintained application definitions with newer
releases, download links, version checks, and checksums across Windows
and macOS.
* Improved Windows installation reliability by recognizing successful
installations that require a restart.
* Corrected installer log-path handling for paths containing spaces.
* Refreshed metadata for applications including Firefox, Docker Desktop,
Discord, Tailscale, and many others.
* Adjusted Google Credential Provider validation settings to support its
installer distribution.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
 2026-08-04 22:16:49 -05:00
Eric 85692f8238 Website: set historical event source (#50546) 
Changes:
- Updated the website's createHistoricalEvent helper to accept an
eventSource input that is used to set the historical event source on
created records.
- Updated places where we create historical events to set a historical
event source
- Updated the accepted contact sources values in the receive-from-clay
webhook
- Updated the deliver-gitops-workshop-request action to log a warning
when a campaign member record cannot be created

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Improvements**
- Improved activity tracking for newsletter subscriptions, signups,
contact forms, workshop requests, webinars, gated content, and page
views.
- Added clearer source details to records for more accurate attribution.
- Expanded support for website, webinar, event, LinkedIn, prospecting,
and GitHub activity sources.
- **Bug Fixes**
- Workshop requests now continue successfully if campaign updates
encounter an error.
- Corrected warning messages and preserved relevant submission details
for troubleshooting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-04 18:26:14 -05:00
Victor Lyuboslavsky a4af4d896c Add default fleet for new Windows MDM enrollments (#41787) (#49922) 
Demo: https://www.youtube.com/watch?v=cWxZlu9WuwA
Guide updates: https://github.com/fleetdm/fleet/pull/49603/changes

IT admins can configure the fleet that hosts enrolling through
user-driven Windows MDM enrollment (Windows Autopilot, Entra join) are
automatically assigned to, via the Windows MDM settings page, the
mdm.windows_enrollment.default_fleet config setting, or GitOps.

- New windows_enrollment_config row stores the default team; the config
API surfaces it by fleet name and hydrates reads from the row so team
renames and deletions never serve a stale name. Deleting the fleet
clears the setting.
- New edited_windows_enrollment_default_fleet activity, emitted only
when the value changes.
- The OMA-DM session persists the device-reported SMBIOS serial on
still-unlinked enrollments, and orbit enrollment reverse-links by that
serial and assigns the default fleet before orbit's one-shot
setup-experience init, so the default fleet's software, scripts, and
profiles apply during the Autopilot ESP. The DevDetail and osquery link
paths keep the same assignment as fallbacks, and the EUA-token link path
now shares the same post-link bookkeeping.
- Hosts are only assigned when new to Fleet in this enrollment cycle:
existing hosts, including ones parked in Unassigned, keep their fleet on
re-enrollment, matching macOS ABM behavior.
- GitOps defers applying the setting until teams declared in the same
run are created, and fleetctl generate-gitops exports it.
- Windows MDM settings page redesign per Figma: programmatic enrollment
toggle, User driven enrollment section with the Entra-gated Default
fleet dropdown, and a Migration section.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41787 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for assigning a default Fleet Premium fleet to new
Windows MDM enrollments, including Autopilot and Entra join.
* Default-fleet settings can be configured, cleared, and managed through
Windows MDM settings and GitOps.
* Assigned fleet software, scripts, and profiles can apply during
out-of-box setup.
  * Added activity-feed visibility for default-fleet changes.
  * Improved Windows enrollment matching using hardware serial numbers.

* **Documentation**
  * Documented default-fleet assignment for Windows enrollment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-04 16:30:02 -05:00
Victor Lyuboslavsky bd601fff84 Fixed nilaway issues (#50405) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #50404 

- Refactored `ListHostSoftware` and `ModifyAppConfig` functions beeing
too big for nilaway
- Added a hard check to make sure all our funcitons/packages are being
analyzed by nilaway

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements**
* Improved software inventory filtering for self-service and macOS
applications, producing more accurate results.
* Improved application configuration updates so saved settings and
related system changes are processed more reliably.
* **Quality**
* Added automated checks to identify overly complex functions and help
maintain code quality.
* Updated static analysis tooling and expanded validation coverage with
new tests.
* **Documentation**
* Added a changelog entry describing the latest reliability and
maintainability improvements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-04 15:41:18 -05:00
LeAnn c49d3d8191 Hide Self-service preview tabs in Edit appearance for Android apps (#50533) 
<img width="890" height="562" alt="Screenshot 2026-08-04 at 12 57 28 PM"
src="https://github.com/user-attachments/assets/cb3a0817-13a8-483e-a5ad-d6c430c81f32"
/>

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44791

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## Summary

Android apps are always self-service and installed from the Play Store
in the end user's work profile — there's no Fleet self-service web view
for them. The "Edit appearance" modal's Preview section still showed a
"Fleet" / "Self-service" tab pair with a browser-style self-service
preview for Android titles, which doesn't reflect what end users
actually see (#44791).

This PR removes the tab nav for Android software titles in
`EditIconModal` — the Preview section now renders just the Fleet card,
with no tabs and no Self-service preview.

## Test plan

- [x] `yarn test` for `EditIconModal.tests.tsx` (added a test asserting
no tabs/Self-service text render for an `android_apps` source, existing
test confirms tabs still render for non-Android)
- [x] Manually verified in a local dev instance: seeded an Android
software title, opened Actions > Edit appearance, confirmed Preview
renders the Fleet card directly with no tabs

(Recreated from #50530, which accidentally included unrelated commits
from a stale branch base.)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Removed the misleading Android Self-service preview from the Edit
appearance modal.
* Android app previews now show only the Fleet preview and Version view.
* Other software continues to display both Fleet and Self-service
preview options.
* **Tests**
* Added coverage to verify the correct preview tabs and version display
for Android apps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-04 13:25:33 -07:00
Steven PalmesanoandRachelElysia 0c1e75ae8a Normalize tags (#48982) 
---------

Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com>
 2026-08-04 12:23:34 -07:00
Lucas Manuel Rodriguez 967d5e69b5 Add lucasmrod to orchestration understanding host vitals (#50492) 
Adding myself to help review the changes to the Understanding Host
Vitals documentation (sometimes blocking PRs from being merged).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated review ownership for the host vitals documentation to include
an additional required reviewer.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-04 16:10:27 -03:00
Sharon Katz a5199593fb Update community contributions process for AI-driven workflow (#50258) 2026-08-04 13:07:39 -05:00
George Karrandtest 1a1e76b012 adding watch for npm publish to release script (#50093) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added an option to resume release publishing after changelog
generation fails.
* Added registry verification to confirm package availability before
continuing publication.

* **Workflow Improvements**
* Release publishing now provides manual instructions for package login
and publishing.
* Supports checking package availability under the selected release tag.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: test <test@test.com>
 2026-08-04 13:05:25 -05:00
dependabot[bot] 49c0e80b77 Bump fast-uri from 3.1.4 to 3.1.5 in /tools/fleet-slackbot (#50505) 2026-08-04 13:04:16 -05:00
dependabot[bot] f9b9fefed1 Bump fast-uri from 3.1.4 to 3.1.5 (#50501) 2026-08-04 13:03:58 -05:00
dependabot[bot] 4e7cebf5ac Bump hono from 4.12.32 to 4.13.0 in /tools/fleet-slackbot (#50500) 2026-08-04 13:03:30 -05:00
Gray WilliamsandRachael Shaw be48a82d16 Update fleet-server-configuration.md adding allow_private_network (#50422) 
Adds the `server_allow_private_network_integrations` flag information

For #49727

---------

Co-authored-by: Rachael Shaw <r@rachael.wtf>
 2026-08-04 11:54:18 -05:00
Lucas Manuel Rodriguez e35e30751c Remove stale Prometheus example config link from reference architectures doc (#50302) 
Removes the link to the example Prometheus config
(`tools/app/prometheus.yml`) from the reference architectures doc, since
that file is being removed in #50053.

Split out of #50053 so the docs change can be reviewed separately.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Documentation-only change; no changes file, tests, or QA needed.
 2026-08-04 11:49:46 -05:00
Dante Catalfamo f17c8cbd8d Bound Google Workspace directory sync pagination (#50092) 
**Related issue:** Resolves #49365
 2026-08-04 11:36:02 -04:00
NicoandCopilot Autofix powered by AI f12954b2af Link custom host vitals from the host name template description (#50491) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #49489

The host name template card's description only linked to built-in and
custom variables, even though `$FLEET_HOST_VITAL_<id>` references are
also supported there as of #49489. This was missed when that story
shipped, leaving admins without a pointer to the custom host vitals tab
from the one place they'd set up a template.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

Already included in main as part of the feature branch merge.

<img width="767" height="117" alt="Screenshot 2026-08-04 at 11 22 07 AM"
src="https://github.com/user-attachments/assets/6358ed90-88e1-4f97-8f26-ab56d00bde0b"
/>


## Testing

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Updated OS Settings documentation with separate links for built-in and
custom host vitals variables to improve accessibility and user
reference.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-08-04 12:12:31 -03:00
dependabot[bot] 09d2431055 Bump ip-address from 10.2.0 to 10.4.0 in /tools/fleet-slackbot (#50480) 2026-08-04 09:56:38 -05:00
Luke Heath 7cd67856aa Fix medium-severity code scanning alerts (#50346) 2026-08-04 09:56:00 -05:00
Allen Houchins 4d6dbf8639 Fix Gpg4win FMA ingest panic after winget relabeled 5.1.0 as x64 (#50494) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** NA — caught from a failing `Update Fleet-maintained
apps` ingest run.

# What this does

Changes `installer_arch` from `x86` to `x64` for the Gpg4win Windows
FMA, and regenerates its output (5.0.2 → 5.1.0).

## Why the ingest was failing

```
{"level":"INFO","msg":"ingesting winget app","name":"Gpg4win"}
panic: ingesting winget app: failed to find installer for app
```

This is **not** a removed winget package — Gpg4win is still published as
`GnuPG.Gpg4win`. The manifest was fetched and parsed fine; the failure
is the `selectedInstaller == nil` check in
`ee/maintained-apps/ingesters/winget/ingester.go`, which means no
installer entry matched all four selector fields from our input.

Upstream flipped the architecture label between versions:

| | 5.0.2 (last ingested) | 5.1.0 (new) |
|---|---|---|
| `Architecture` | **x86** | **x64** |
| Manifest generator | `wingetcreate 1.10.3.0` | `YamlCreate.ps1
Dumplings Mod` |

Our input pinned `x86` to match 5.0.2, so nothing matched once 5.1.0
landed in `winget-pkgs` (2026-08-03 18:11 UTC,
microsoft/winget-pkgs#409397). The ingester only walks to an older
version directory on a genuine 404 of the installer manifest — never
because the newest version's installer failed to match — so it panics
instead of falling back.

## The new x64 label is the correct one

Verified against the real installer rather than trusting either
manifest:

- The NSIS stub's PE header is i386, which is very likely what
`wingetcreate` guessed `x86` from. Installer stubs are almost always
32-bit, so stub arch says nothing about the payload.
- The payload ships 64-bit binaries in `bin/` (PE machine `0x8664`)
alongside a 32-bit `bin_32/` compatibility set.

So 5.0.2's `x86` was the inaccurate manifest and the bot corrected it.
Regenerated `sha256` also matches a fresh download of
`gpg4win-5.1.0.exe` bit-for-bit (`9682f282…20a2e`).

## Blast radius

Worth flagging: this one field blocked **the entire FMA ingest**, not
just Gpg4win. `failed to find installer for app` isn't matched by
`isTransientGitHubError`, so it returns up to `panic(err)` in
`cmd/maintained-apps/main.go`, which aborts the process before
`processOutput` writes *any* app's manifest. Because the `ingesters` map
is iterated in random order, this could take out the homebrew side too.
Any future upstream flip of `installer_arch` / `installer_scope` /
`installer_type` / `installer_locale` on any single app will do the same
thing — worth a follow-up to make non-transient per-app ingest errors
skip-and-report instead of fatal.

## Why no changes file

The net user-visible effect is a routine FMA version bump (Gpg4win
5.1.0), which the scheduled ingest PR delivers without changelog
entries. Happy to add one if you'd rather it be called out.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] QA'd all new/changed functionality manually

Verification performed:

- `go run ./cmd/maintained-apps -slug gpg4win/windows` completes with no
panic (previously fatal).
- Diff is scoped to the two expected files; `outputs/apps.json` is
untouched, since name/description didn't change.
- Regenerated `sha256` matches a fresh download of the upstream
installer.
- Install/uninstall scripts need no changes — both already enumerate the
native *and* `Wow6432Node` registry views across `HKLM`/`HKCU`, so
detection survives the 32→64-bit flip.
- `installer_arch` is only a manifest selector plus CI runner routing in
`.github/scripts/partition-fma-apps.sh`, where x64/x86/neutral all land
on the same x64 runner. No routing change, and the field is never
written into `outputs/`, so no user-visible arch claim changes.

Still needs the FMA validator's install/uninstall run on a Windows
runner to confirm 5.1.0 installs and is detected — that's what the draft
is for.
 2026-08-04 09:50:53 -05:00
Juan Fernandez 60ad78f897 Add Omarchy as a supported Linux platform 
Resolves #50069

Omarchy 4 ships its own /etc/os-release with ID=omarchy, where earlier
versions inherited ID=arch from Arch Linux. Since HostLinuxOSs and
HOST_LINUX_PLATFORMS gate nearly every Linux check, these hosts had
empty vitals and software inventory, were missed by linux-scoped
policies and labels, had no disk encryption or key escrow, and lost Run
script in the UI (the API was unaffected).

Add "omarchy" to HostLinuxOSs, HostNeitherDebNorRpmPackageOSs (pacman-
based), IsLUKSSupported, HOST_LINUX_PLATFORMS,
DISK_ENCRYPTION_SUPPORTED_LINUX_PLATFORMS, and the Vitals
disk-encryption tooltip. Regenerate understanding-host-vitals.md.

Aggregate Omarchy onto the "Arch Linux" / "rolling" OS inventory row,
where these hosts sat before quattro. Unlike CachyOS, Omarchy reports a
real release number rather than BUILD_ID=rolling, so the version is
pinned after parsing instead of rewriting the ingested build value.

Also add a fleetd test container, built on archlinux since Omarchy
publishes no image.
 2026-08-04 10:32:44 -04:00
Juan Fernandez d92b7284d0 Trigger software_checksum_migration on startup 
Relates #36365

Makes the software_checksum_migration cron to run
automatically on server startup.
 2026-08-04 09:35:36 -04:00
melpike 8a11bd58db [Route] Update routes.js (#50472) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48894 

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added a redirect from `/learn-more-about/removal-behavior` to the
relevant section of the custom OS settings guide.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-04 07:11:56 -06:00
Marko Lisica 678d8b77ff Add notify command to Fleet Desktop for patch notification toasts (#50211) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** #49325

# Checklist for submitter

- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes

macOS-only by construction — this is the native macOS app, which has no
other platform build.

No changes file: this app ships on its own release channel
(fleet-desktop-macos-v* → download.fleetdm.com), not the Fleet server
changelog, matching every previous PR to apps/fleet-desktop-macos/.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added macOS notification support through the `notify` command.
* Notifications appear as bottom-right toast messages with loading,
dismissal, timeout, and error handling.
* Added URL validation, clear usage guidance, and meaningful
command-line exit statuses.
  * Notification commands can run without opening the main app.

* **Bug Fixes**
* Improved single-instance handling for background notification
processes.
  * Improved detection of Fleet-rendered error pages.

* **Tests**
* Added developer tools for notification smoke testing and local
invocation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-04 14:54:10 +02:00
Allen Houchins b668734d5c Remove Fig FMA (cask removed from Homebrew upstream) (#50483) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** NA

Removes the **Fig** Fleet-maintained app. Its Homebrew cask no longer
exists.

Homebrew deleted the `fig` cask in
[`a36fac3b75`](https://github.com/Homebrew/homebrew-cask/commit/a36fac3b75f633a9c787c4c73fc46606939947a3)
on **2026-08-04**, the end of a long deprecation:

| Date | Upstream change |
|---|---|
| 2024-08-03 | `fig: deprecate` |
| 2025-08-02 | `fig: disable` |
| 2026-08-04 | `fig: remove cask` |

`https://formulae.brew.sh/api/cask/fig.json` now returns **404**, so the
nightly ingester panics and no maintained apps are generated at all:

```
{"time":"2026-08-04T02:38:58.15272663Z","level":"INFO","msg":"ingesting homebrew app","name":"fig"}
panic: ingesting homebrew app: app not found in brew API
```

Note that `"frozen": true` does **not** fix this — that flag only gates
the output write, and the ingester still fetches the cask first and
panics on the 404. Removing the input is the fix.

There is no successor cask to migrate to. Fig was acquired by AWS and
folded into Amazon Q Developer CLI, which is not distributed via
Homebrew (`amazon-q`, `amazon-q-developer-cli`, `q-cli`, and
`codewhisperer` all 404), and `fig.io` itself now returns 503.

### Changes

- Deleted `ee/maintained-apps/inputs/homebrew/fig.json`
- Deleted `ee/maintained-apps/outputs/fig/darwin.json`
- Removed the `fig/darwin` entry from
`ee/maintained-apps/outputs/apps.json`
- Deleted the `Fig` icon component and its `index.ts` import/map entry
- Deleted `website/assets/images/app-icon-fig-60x60@2x.png`

The output file is deleted rather than orphaned so the PR validator's
changed-app detector doesn't keep validating a removed app.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] QA'd all new/changed functionality manually

Verified `apps.json` still parses and the `fig/darwin` slug is gone
(1390 apps remain, `figma` untouched), `tsc --noEmit` is clean after
removing the `Fig` icon import, and no references to `fig`,
`com.mschrage.fig`, `fig/darwin`, or `repo.fig.io` remain anywhere in
the repo.

> [!NOTE]
> Existing hosts with Fig installed will no longer see it as a
Fleet-maintained app. The app is end-of-life upstream, so there is no
version for Fleet to track or patch to.
 2026-08-04 07:19:45 -05:00
Lucas Manuel Rodriguez f053a9fd49 Allow enabling/disabling software inventory per-fleet via the API (#50481) 
Resolves #45735.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Team settings can now enable or disable Software Inventory through API
updates.
* Partial updates preserve existing settings when the Software Inventory
option is omitted.
* Software Inventory configuration can be re-enabled after being
disabled.

* **Bug Fixes**
* Invalid or null Software Inventory values are handled correctly
without affecting global or Unassigned settings.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-04 08:48:32 -03:00
Juan Fernandez e529d97897 Fix duplicate software inventory entries from v4.76.0 checksum change 
Resolves #36365

The v4.76.0 checksum change (#34097) reordered the fields hashed into
`Software.ComputeRawChecksum` for non-`apps` sources, so software rows
created before the upgrade no longer matched re-ingested rows and got
duplicated (same name/version/source, split host counts).

- Make `ComputeRawChecksum` the sole source of truth and delete the
drifted parallel SQL checksum formula that caused the mismatch.
- Add `ReconcileSoftwareChecksums`, a one-shot migration that merges
existing duplicates onto the canonical row (batched host_software
repointing) and logs each merge. Runs once after startup; re-run with
`fleetctl trigger --name software_checksum_migration`
 2026-08-04 07:12:16 -04:00
Magnus Jensen 6ce0f70ebc Not Now edge case fixes for Apple profiles (#50044) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #47411 (Speculative, but we will keep
investigating if we get new reports)

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Bug Fixes**
- Fixed Apple MDM profile handling for devices that respond with “Not
Now” by ensuring the response is issued only on first delivery and
doesn’t trigger repeated retries.
- Improved reconciliation so superseded InstallProfile commands are
properly canceled and cleanup is correct for user-scoped and pending
installs.
- When host verification fails after an acknowledged install, devices
now receive the appropriate RemoveProfile operation.
- **Tests**
- Added regression integration coverage for “Not Now” cancellation,
scope changes, profile edits, undelivered installs, and failed
verification cleanup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-04 09:40:20 +02:00
Allen HouchinsandEric 19af21dd1a Upgrade query-generator SQL step to Claude Sonnet 5 (#49187) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** N/A

## What this does

The `/query-generator` page's osquery-SQL-generation step
([get-llm-generated-sql.js](website/api/controllers/query-generator/get-llm-generated-sql.js))
was on `claude-sonnet-4-6`, which is now one generation behind. This PR:

- Bumps that call to `claude-sonnet-5`. The schema-filtration step stays
on `claude-haiku-4-5`, which is already the latest Haiku release, so no
change needed there.
- Adds `effort` support to the shared [`ai.prompt`
helper](website/api/helpers/ai/prompt.js), forwarded as
`output_config.effort` on Anthropic requests, and sets it to `"low"` for
the SQL-generation call. Effort controls how much the model deliberates
(and how many tokens/how much latency that costs). `"low"` was chosen
because the Haiku pre-filtering step already narrows the osquery schema
down to relevant tables, so the Sonnet step isn't starting from scratch
and doesn't need to spend much effort re-deriving that context.
- Bumps `max_tokens` in the Anthropic branch of the helper from 4096 to
8192. Claude Sonnet 5 turns on adaptive thinking by default when the
`thinking` param is omitted (which this helper does), and `max_tokens`
is a hard cap on *total* output including thinking tokens — at 4096
there was a real risk of thinking tokens eating into the budget and
truncating the JSON response the SQL step needs to return.
- **Fixes a pre-existing bug found while making the above changes:** the
`sqlReport` call passed the system prompt as a bare object-shorthand key
named `systemPromptForQueryGeneration`, but the `ai.prompt` helper's
declared input is `systemPrompt`. Sails silently drops unrecognized keys
passed to `.with(...)`, so the "Return ONLY a raw JSON object..." system
prompt was never actually reaching the model for this call. This has
been broken since the query generator was switched to Anthropic
(`f7c20c4731`); the sibling `filteredTables` call above it was
unaffected since it passes `systemPrompt` positionally. Now fixed to
`systemPrompt: systemPromptForQueryGeneration`.

## Why

Claude Sonnet 5 follows structured/constrained instructions (don't alias
tables, use `LIKE` with wildcards, only reference documented columns,
etc.) more literally than 4.6, which should make the generated SQL more
reliable. It's priced the same or cheaper than 4.6 during the current
introductory period.

## Trade-offs called out for review

- Thinking being on by default adds some latency versus the old
(thinking-off) behavior on 4.6. This call is not currently streamed
(`sails.helpers.http.post`, single blocking call over a socket), so any
added thinking time is invisible wait time for the user rather than a
visible "thinking" indicator. `effort: "low"` should keep this modest,
but worth confirming with a manual QA pass on a few representative
questions before merging.
- Only the SQL-generation call was migrated. The schema-filtration call
also runs on an Anthropic model, but Haiku 4.5 doesn't support
`output_config.effort` (added `effort` is a no-op if passed to it), so
it was left as-is.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements**
  * Improved AI-generated SQL responses with an updated language model.
  * Added adaptive effort controls for supported AI requests.
* Increased response capacity to support more detailed generated
results.
* Improved handling of AI responses to provide more reliable results
when content includes different response formats.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Eric <eashaw@sailsjs.com>
 2026-08-03 21:39:40 -05:00
Allen Houchins 033cb8843c Fix image captions breaking onto multiple lines when they contain links (#50441) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** NA

Image captions on articles broke onto multiple lines whenever the
caption contained an inline link. Reported on [Linux crossed 10% in
North America, and your inventory might have missed
it](https://fleetdm.com/articles/linux-crossed-10-percent-and-your-inventory-missed-it),
where the source line under the Cloudflare Radar chart rendered as:

```
Source:
Cloudflare Radar
, captured August 3, 2026.
```

## Cause

Image captions (`img + em`) were styled as a column flex container:

```less
display: flex;
align-items: center;
flex-direction: column;
```

Every child of a flex container becomes its own flex item on its own
line — including bare text nodes, which get wrapped in anonymous flex
items. That caption has three children (`"Source: "`, the `<a>`, and `",
captured August 3, 2026."`), so it stacked into three rows.

Every other image caption in `articles/` is a single plain-text run,
which is why this hasn't surfaced before. This is the first caption on
the site with an inline link.

## Fix

```less
img + em { // Image captions
  position: relative;
  top: -12px;
  display: block;
  text-align: center;
  margin-bottom: 16px;
}
```

`display: block` + `text-align: center` preserves the existing centered
appearance for plain-text captions (visually identical) while letting
inline content flow normally.

## Notes for the reviewer

- **Six files, one rule.** The identical caption rule was copy-pasted
into `basic-article.less`, `basic-webinar.less`,
`basic-whitepaper.less`, `case-study.less`, `legal/privacy.less`, and
`legal/terms.less`. Only `basic-article.less` is needed to fix the
reported page; the other five carry the same defect, so all six are
updated rather than leaving the trap for the next caption with a link.
- **No markdown change.** The article source (`*Source: [Cloudflare
Radar](...), captured August 3, 2026.*`) was already correct. This is
purely a stylesheet fix.
- **Mobile overrides untouched.** The second `img + em` block in each
file (inside a media query) only adjusts `top` and `margin-bottom`, so
it needed no change.
- **Existing captions are unaffected.** All current captions are single
text runs; block + centered text renders them the same as column flex +
`align-items: center` did.

# Checklist for submitter

- [x] QA'd all new/changed functionality manually

Verified on the live article by injecting the new rule into the rendered
page: the caption went from 72px tall (three stacked lines) to 24px (one
centered line), rendering as `Source: Cloudflare Radar, captured August
3, 2026.`

I was not able to run `npm run lint` locally — `website/node_modules` is
not installed in my working copy. The change follows `.lesshintrc` (one
space after `:`, no `!important`), but CI's lint run is the authority
here.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Style**
  * Improved image caption layout across articles and legal content.
* Captions now display consistently as centered block text for better
readability.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-03 21:37:45 -05:00
Allen Houchins b2b2081ad4 Remove Gadwin PrintScreen, PrintScreen Pro, and ScreenRecorder FMAs (expired TLS cert on download host) (#50470) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** NA

Removes the three Gadwin Fleet-maintained apps: **Gadwin PrintScreen**,
**Gadwin PrintScreen Pro**, and **Gadwin ScreenRecorder**.

All three download their installers from `www.gadwin.com`, whose Let's
Encrypt certificate **expired 2026-08-02** and has not been renewed:

```
subject=CN=gadwin.com
issuer=C=US, O=Let's Encrypt, CN=R13
notBefore=May  4 13:06:54 2026 GMT
notAfter=Aug  2 13:06:53 2026 GMT
```

Every FMA validation run now fails these three apps:

```
level=ERROR msg="Error downloading maintained app: downloading installer:
performing request for URL https://www.gadwin.com/download/PrintScreen650_Win64.msi:
tls: failed to verify certificate: x509: certificate has expired or is not yet valid"
app="Gadwin PrintScreen"
```

This is not just CI: Fleet fetches the installer from that same URL when
a user installs the app, so all three are currently uninstallable for
customers.

> [!NOTE]
> The certificate expired only one day before this PR was opened. If
Gadwin renews it, these apps become viable again and the alternative fix
is `"frozen": true` in each winget input (which skips validation) rather
than removal. Removing was chosen because a lapsed auto-renewing
certificate means no one is maintaining the download host, and a broken
installer URL is worse for users than an absent app. Happy to switch to
a freeze if reviewers prefer to wait it out.

### What's removed

Per app, all locations that applied:

| Location | PrintScreen | PrintScreen Pro | ScreenRecorder |
|---|---|---|---|
| `ee/maintained-apps/inputs/winget/<slug>.json` | ✅ | ✅ | ✅ |
| `ee/maintained-apps/outputs/<slug>/windows.json` | ✅ | ✅ | ✅ |
| `ee/maintained-apps/outputs/apps.json` entry | ✅ | ✅ | ✅ |
| `frontend/.../icons/<Name>.tsx` | ✅ | ✅ | — (none existed) |
| import + mapping in `icons/index.ts` | ✅ | ✅ | — |
| `website/assets/images/app-icon-<slug>-60x60@2x.png` | ✅ | ✅ | — (none
existed) |

All three are Windows-only (no Homebrew input or `darwin.json`), so no
macOS counterpart is affected and no shared icons needed to be retained.
`apps.json` goes from 1393 to 1390 apps. The diff is deletion-only.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] QA'd all new/changed functionality manually

Verification performed:

- `apps.json` parses as valid JSON; no `gadwin` slugs remain.
- Repo-wide grep for `gadwin` returns no dangling references. (The one
remaining hit, `cmd/osquery-perf/software-library/software.sql`, is a
simulated host-inventory fixture, not an FMA definition — intentionally
left in place.)
- `npx tsc --noEmit` reports no errors related to the removed icon
components or the icon index.
- `npx prettier --check` passes on `icons/index.ts` and `apps.json`.
- `go build ./cmd/maintained-apps/... ./ee/maintained-apps/...` and `go
test ./ee/maintained-apps/...` pass.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Removed Gadwin PrintScreen, Gadwin PrintScreen Pro, and Gadwin
ScreenRecorder from the maintained Windows application catalog.
* Removed their associated software listings, installation details, and
product icons from the application interface.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-03 21:37:09 -05:00
Allen Houchins 2431d580b0 Add QEMU as a Windows Fleet-maintained app (#50471) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #50126

Adds **QEMU** (`SoftwareFreedomConservancy.QEMU`) as a Windows
Fleet-maintained app, requested by a customer in #50126. Windows-only:
on macOS, Homebrew ships QEMU as a formula (CLI tools, no `.app`
bundle), so it isn't a viable macOS FMA.

## App identity (verified against the real installer)

- Downloaded `qemu-w64-setup-20260501.exe` from `qemu.weilnetz.de`;
SHA256 matches the winget manifest.
- QEMU's NSIS definition
([`qemu.nsi`](https://gitlab.com/qemu-project/qemu/-/blob/master/qemu.nsi))
writes the uninstall key `HKLM\...\Uninstall\QEMU` (64-bit view via
`SetRegView 64`) with `DisplayName "QEMU"` and `DisplayVersion` set to
the meson project version — which equals the winget `PackageVersion`, so
the patch policy reconciles cleanly.
- **No `Publisher` value is written to the registry**, so the default
generated exists query (`... AND publisher = 'QEMU Community'`) would
never match. The input overrides it with `exists_query: SELECT 1 FROM
programs WHERE name = 'QEMU';` — exact name match, so entries like "QEMU
guest agent" (virtio-win) are left alone.

## Install/uninstall scripts

- NSIS installer, machine scope, x64. Install: standard silent `/S`
(same pattern as AnyBurn).
- Uninstall: registry lookup by exact DisplayName across both registry
views, defensive UninstallString parsing, `/S _?=<installdir>` so the
uninstaller runs in place (instead of relaunching from `%TEMP%` and
returning immediately), verification that the ARP entry is actually
gone, then sweep of the leftover uninstaller/install dir,
`HKLM\SOFTWARE\QEMU`, and shortcuts.

## Version caveat

winget's newest version dir for this package is **11.0.50 — a QEMU
development snapshot** (QEMU uses `x.y.50` for post-release dev builds;
only x64, no arm64), added upstream alongside the 11.0.0 stable release.
The ingester picks the highest version, so this FMA currently ships the
snapshot build; it will move to the next stable (e.g. 11.0.1/11.1.0) as
soon as winget has it. The installer URL is date-pinned
(`.../2026/qemu-w64-setup-20260501.exe`), so there's no hash-drift risk.
If we'd rather not offer dev snapshots, that needs an ingester-level
version filter — flagging for maintainer input rather than building it
into this PR.

## Icon

Official 128×128 QEMU icon from the upstream source tree
(`ui/icons/qemu_128x128.png`), generated via
`tools/software/icons/generate-icons.sh`.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [x] Verified installer SHA256, registry identity
(DisplayName/DisplayVersion/no Publisher), and silent switches against
the real installer and upstream `qemu.nsi`/`meson.build`
- [ ] `test-fma-windows-pr-only` validates QEMU install/uninstall in
this PR's CI


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added QEMU to the Windows software catalog.
* Added support for silent QEMU installation and reliable
uninstallation.
  * Added QEMU version detection and upgrade validation.
  * Added a QEMU icon to the software interface.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-03 21:36:12 -05:00
Eric f736356f0e Website: update contact form button (#50477) 
Changes:
- updated the submit button on the "Talk to us" form ("Talk to an
engineer" » "Pick a time")
- Updated the GitHub webhook to add ~ga4-annotation labels to pull
requests that change the contact page

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Updated the contact form button label to “Pick a time” for clearer
scheduling intent.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-03 17:52:25 -05:00
Luke Heath 77e090f71b Fix broken JSON examples, response docs, and parameter tables in REST API reference (#50457) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->

## Summary

While working on a parser for the REST API docs, I found a number of
broken spots in the reference. This PR fixes them. They all affect human
readers too (invalid JSON in examples, missing response documentation,
broken tables).

- Fixed invalid JSON in 28 response examples (trailing commas, missing
braces, stray tokens, `...` placeholders inside JSON).
- Added missing `Default response` documentation to 6 endpoints. Status
codes and body shapes were verified against the Go handlers rather than
inferred.
- Added missing `Status:` lines to 4 response blocks. One is a
correction: `Rotate host's Recovery Lock password` was documented as
returning `204`, but the server returns `200` (its response struct has
no `Status()` override).
- Fixed 3 malformed parameter tables (wrong column counts, one missing
`In` value).
- Restored the standard request line in `Get script result`.
- Corrected the dual-key token examples (`abm_tokens`/`ab_tokens`,
`teams`/`fleets`): the nested team objects use `team_id` in legacy
containers and `fleet_id` in renamed containers on the wire, not bare
`id`.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Manual QA for all new/changed functionality

### Test plan

- Every JSON example touched by this PR was mechanically validated
(valid JSON after stripping `//` comment annotations).
- Added response blocks and status codes were checked against the Go
handlers (response structs and `Status()` methods).
- The full document was run through the parser to confirm every endpoint
section now reads cleanly.
 2026-08-03 17:00:22 -05:00
RachelElysia e7a9456044 Fleet UI: Align toast icon with first line of message (#50449) 2026-08-03 14:52:30 -07:00
Eric 74c2b79f05 Website: add support for new usage statistics (#50466) 
Changes:
- Updated the website to support two new usage statistics sent by Fleet
servers: `numHostsFleetMDMEnrolledWindows` and
`numHostsFleetMDMEnrolledMacOS`

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Usage analytics now track Fleet MDM-enrolled host counts separately
for macOS and Windows.
* Historical usage records include these platform-specific enrollment
totals.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-03 15:15:02 -05:00
Allen HouchinsandClaude bbbe93d1b7 Bump Zoom Rooms FMA (custom-tap) to 7.1.5.13403 (#50442) 
**Related issue:** NA — routine custom-tap cask maintenance

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [x] `go test ./ee/maintained-apps/...` passes
- [ ] QA'd all new/changed functionality manually (installer metadata,
URL, and checksum verified as below; not yet deployed through a Fleet
server)

No `changes/` file, consistent with prior custom-tap cask-bump PRs
(#49563, #48028, #45912).

## Version bump details

| | Old | New |
|---|---|---|
| Version | 7.1.0.13088 | 7.1.5.13403 |

- **Upstream source:** `https://zoom.us/client/latest/ZoomRooms.pkg`
redirects to `https://cdn.zoom.us/prod/7.1.5.13403/ZoomRooms.pkg` (Zoom
does not expose a parseable Zoom Rooms version feed, per the cask's
`livecheck` block, so this is the standard manual-bump discovery
method).
- **New download URL:**
`https://cdn.zoom.us/prod/7.1.5.13403/ZoomRooms.pkg`
- **sha256:**
`3b303bc150a3a5d639f09439abf84f2117784a2124ba660f7c73917ba5ef9ab6`
- Downloaded installer verified: 587 MB, `xar archive` (matches expected
`.pkg` format).

**Reviewer note:** `api/zoom-rooms.json` was updated mechanically
because `regenerate.sh` requires macOS. Before merging, run
`ee/maintained-apps/inputs/homebrew/custom-tap/regenerate.sh` locally
and confirm `git diff` is clean for `api/zoom-rooms.json`.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01U8YEGYFy9Uc88wvyg96ySE)_

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Updates**
  * Updated Zoom Rooms for macOS to version 7.1.5.13403.
  * Refreshed download links and package verification checksums.
  * Installation and uninstallation behavior remains unchanged.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Claude <noreply@anthropic.com>
 2026-08-03 14:29:33 -05:00
Jordan Montgomery 3ea4304126 Fix validation on account provisioning page to require secret (#50443) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #50248

Clears the secret field with a clear error, forcing the user to re-enter
it, on a URL change, and displays the actual server error strings rather
than a generic error(though the server errors are currently largely
unreachable via frontend since validation has been tightened up).

# Checklist for submitter

If some of the following don't apply, delete the relevant line.
Unreleased bug so no changes file
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [x] Confirmed that the fix is not expected to adversely impact load
test results


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added HTTPS validation for account provisioning token URLs.
* Server-side validation errors now appear on the relevant form fields.
  * Update failures display helpful server-provided error messages.

* **Bug Fixes**
* Changing a token URL now clears masked secrets and requires the secret
to be entered again.
  * Prevented form submission when required secret re-entry is missing.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-03 14:47:47 -04:00
RachelElysia 756295aabf Fleet UI: Button icon padding correction (#50195) 2026-08-03 11:10:52 -07:00
RachelElysia 75db0f1adf Fleet UI: Fix New user form dropdown layout shift (#50444) 2026-08-03 11:09:36 -07:00
dependabot[bot] 237a6d3040 Bump postcss from 8.5.18 to 8.5.23 (#50452) 2026-08-03 12:49:32 -05:00
Allen Houchins 183aa052d2 Defuse Docker Desktop's install-on-quit updater in macOS FMA install script (#50451) 
**Related issue:** Customer reports of failed Docker Desktop updates
from self-service on macOS.

## Details

The reported error is Docker Desktop's own updater speaking, not
Fleet's:

```
failed to back up /Applications/Docker.app before update: renaming (moving) file from /Applications/Docker.app to /Applications/Docker.app.back: rename /Applications/Docker.app /Applications/Docker.app.back: file exists
```

Hosts showing "update available" in self-service are exactly the hosts
where Docker Desktop has already downloaded and staged its **own**
self-update at `~/Library/Application
Support/com.docker.install/in_progress/Docker.app`. When the FMA install
script gracefully quits Docker Desktop, that quit triggers Docker's
install-on-quit updater, which renames `Docker.app` → `Docker.app.back`
and moves the staged copy into place — racing the script's own
`mv`/`rm`/`cp` of `/Applications/Docker.app`. The script previously
cleaned up after this race (leftover `.back` bundle and staged copy);
this PR prevents it instead:

- Remove the entire `com.docker.install` staging directory (staged
bundle + updater state) **before** quitting the app, so the quit can't
trigger Docker's updater. Same whole-directory removal the uninstall's
`post_uninstall_scripts` already does.
- Wait out (bounded, 30s) any updater already in flight before touching
`/Applications/Docker.app`.
- Output regenerated via `go run ./cmd/maintained-apps -slug
docker-desktop/darwin`; version pinned at 4.85.0, installer URL/sha
unchanged, only the install script ref changed.

Hosts already wedged with a stale `Docker.app.back` self-heal: the
script still removes `.back` before copying the new bundle.

## Local validation (macOS arm64, Docker Desktop 4.84.0 running)

- shellcheck and `bash -n` clean; embedded output script matches input
byte-for-byte with correct sha256[:8] ref
- Downloaded the pinned 4.85.0 DMG; sha256 matches the manifest
- Seeded affected-host state (non-empty `/Applications/Docker.app.back`,
staged `com.docker.install/in_progress/Docker.app`) and ran the shipped
script: staging dir removed before quit, running Docker Desktop (VM +
active build) quit gracefully, wait loop did not hang
- Wait loop unit-tested against a live process matching
`com\.docker\.install`: waits until it exits, 30s cap

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [x] QA'd all new/changed functionality manually
 2026-08-03 12:47:29 -05:00
dependabot[bot] 23a1d4746e Bump brace-expansion from 1.1.16 to 1.1.18 (#50379) 2026-08-03 12:46:41 -05:00
Allen Houchins 89acb97395 Add NVDA as a Windows Fleet-maintained app (#50450) 
**Related issue:** Resolves #50125

Adds NVDA as a Windows Fleet-maintained app, from winget `NVAccess.NVDA`
(2026.1.1, NSIS/nullsoft, x86 launcher).

## Identity — read out of the shipped installer, not the manifest

I downloaded the 60 MB installer, extracted the NSIS payload, and read
the identity fields from `_buildVersion.pyc` and the PE headers. The
winget manifest is misleading in two ways:

| Field | winget says | Actually is | Source |
|---|---|---|---|
| Architecture | `x86` | **x64** app behind a 32-bit NSIS launcher stub
| `nvda_noUIAccess.exe` / `nvda_slave.exe` PE headers |
| Registry DisplayName | PackageName `NVDA` | **`NVDA 2026.1.1`** |
`source/installer.py` `getUninstallerRegInfo()`: `DisplayName=f"{name}
{version}"` |
| Publisher | `NV Access` | `NV Access` (matches) | `_buildVersion.pyc`:
`publisher = "NV Access"` |

Two consequences:

- Because NVDA itself is a **64-bit** process, it registers under the
native registry view, **not** `Wow6432Node` (the launcher's 32-bit-ness
is irrelevant). Both scripts check both views anyway, for legacy 32-bit
copies.
- DisplayName carries the version, so this needs `fuzzy_match_name:
true` → `name LIKE 'NVDA %'`. Publisher matches the locale manifest, so
no `program_publisher` override.

`installer_arch` stays `x86` because that's what the manifest declares
and the ingester matches on it.

## Version reconciles without a validator exception

DisplayVersion is the 4-part `2026.1.1.55980` (`version_detailed`)
against winget's `2026.1.1`:

- **Validator:** passes via the existing
`strings.HasPrefix(result.Version, appVersion+".")` branch in
`cmd/maintained-apps/validate/windows.go`. No new skip added —
deliberately, since existence-only skips make patch policies always
report "patched".
- **Patch policy:** `version_compare('2026.1.1.55980', '2026.1.1')` is
`> 0`, so an installed copy reads as newer, not outdated. No perpetual
false "update available".

## The install script can't trust the exit code

`source/gui/installerGui.py` `doInstall()` pops `winUser.MessageBox` /
`gui.messageBox` on **every** install failure path with **no `if silent`
guard**, and then falls through and exits **0**. Under SYSTEM in session
0 that means:

1. a failure **hangs forever** — nobody can click Retry/Cancel; and
2. if it were dismissed, a failed install would report **success**.

So `nvda_install.ps1` uses a watchdog plus an Add/Remove Programs
registration poll as the real success signal — the same shape as the
existing `azure_data_studio_install.ps1`. Timeouts are 420 + 120 + 30 =
570s, under the caller's 10-minute cap.

On timeout it kills only the launcher's `%TEMP%` children
(`nvda_noUIAccess` / `nvda_uiAccess`), **deliberately not `nvda.exe`** —
an installed NVDA runs as `nvda.exe`, and force-killing it would cut off
a signed-in user's screen reader with no warning.

## Uninstall

Vendor-documented `/S` (NVDA user guide, "Uninstalling NVDA"), plus
`_?=` last so the NSIS uninstaller runs in place instead of relaunching
from `%TEMP%` and returning immediately. NVDA writes **no**
`QuietUninstallString`, and its `UninstallString` is an **unquoted path
containing spaces** (`C:\Program Files\NVDA\uninstall.exe`), so the
parser handles that form. The directory comes from NVDA's `InstallDir`
value (not `InstallLocation`). Absence of the ARP entry is the success
signal, since NVDA removes it via `nvda_slave.exe unregisterInstall`.

## Reviewer notes

- **`installer_scope` is `""`, not `"machine"`.** NVDA genuinely
installs machine-wide (`%ProgramFiles%\NVDA` + HKLM), but the winget
manifest declares no `Scope`, so the ingester derives `""` and
`"machine"` panics with "failed to find installer". The one-line
ingester fix for this is designed in #48248 but isn't in `main`; I chose
not to change shared installer-selection code for a single-app addition.
Happy to land that fix here instead if preferred.
- **Upgrade caveat:** if NVDA is running for a signed-in user,
`--install-silent` refuses to overwrite its own running files by design
(`installer.py` `install()`). The script fails with an actionable
message rather than force-killing the screen reader.
- Installer URL is version-pinned
(`download.nvaccess.org/releases/2026.1.1/...`), not a "latest"
redirect. SHA verified against my own download of the file.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [ ] QA'd all new/changed functionality manually

`go test ./ee/maintained-apps/...` passes; prettier and `tsc --noEmit`
are clean. I have no Windows host or `pwsh`, so **the install/uninstall
scripts are unexercised** until FMA validation CI runs them on a Windows
runner. No changes file — consistent with other FMA additions (#50415,
#50348, #50352).
 2026-08-03 12:40:44 -05:00
Sharon Katz 301e0e009b Improve Windows profile LocURI content validation (#49715) 
**Related issue:** Resolves fleetdm/confidential#16881

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved Windows MDM validation for `LocURI`, ensuring full values are
considered before checks.
  * Rejects empty or whitespace-only `LocURI` entries.
* Strengthens `LocURI` validation for Fleet-reserved, SCEP-specific, and
BitLocker-related formats after complete assembly.

* **Tests**
* Added new test cases for malformed BitLocker `LocURI` values split
across CDATA and XML comment boundaries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-03 13:39:38 -04:00
Noah Talerman da36a26f23 Update what's new from WWDC 2026 w/ Fleet support + Apple IT summit (#49440) 
- So customers, and Fleet's Customer Success team know where Fleet's at
with supporting new features in macOS and iOS/iPadOS 27
 2026-08-03 10:39:01 -07:00