Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Windows Granola to version 7.324.2 with the latest installer
package and corresponding security verification checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Add Sonos to maintained apps across platforms. Introduces
SonosVersionTransformer (converts Homebrew "90.0-77070" -> "90.0.77070")
and registers it for the sonos/darwin slug so osquery version_compare
and patch detection work. Add special patched query in the Homebrew
ingester to compare bundle_version for Sonos. Add inputs for Homebrew
and Winget (including a Win32 install PowerShell script and Winget
manifest), outputs for darwin and windows with version metadata,
installer URLs, sha256s, and install/uninstall script refs; include the
actual install/uninstall script refs. Add a React SVG icon and map it in
the icons index, and update the Sonos app image asset and apps.json
entries. Also includes a couple punctuation cleanups in apps.json.
**Related issue:** Resolves#38928
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* After saving report edits, the UI now redirects users back to the
report details page.
* URL context (host_id and fleet_id) is preserved during this
navigation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves ##39323
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated checkbox labels and tooltips across settings to use positive
language (describing enabled outcomes like “Store data” and “Bypass for
non-critical policies”).
* Adjusted checkbox behavior to match the new checked-state semantics
for data retention, feature toggles, and conditional access bypass
(including revised default/tooltip copy).
* **Tests**
* Updated assertions to reflect the new checkbox/help text wording and
checked/unchecked expectations in advanced settings and discard-data
options.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated WhatsApp macOS application version with matching version
verification logic
* Updated Zettlr Windows application version along with installer URL
and verification checksums
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41796
Root cause: run() in orbit/pkg/execuser/execuser_linux.go called
cmd.Start() but never cmd.Wait(). On Linux a child that exits stays a
zombie until the parent reaps it, so every sudo … fleet-desktop
invocation leaked a zombie. When Fleet Desktop fails to start, orbit
respawns it in a loop (desktopRunner.Execute), so the zombies pile up.
Fix: reap the child in a background goroutine after Start(). run() still
returns immediately (orbit monitors the desktop process separately), so
behavior is unchanged otherwise.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
#### Reproduction steps
1. Start TUF server and create .deb package
```sh
SYSTEMS="linux-arm64" \
DEB_FLEET_URL=https://nicolasulmete.xyz \ # personal ngrok tunnel serving Fleet
DEB_TUF_URL=http://nicotuf.ngrok.io \ # personal ngrok tunnel serving TUF
GENERATE_DEB_ARM64=1 \
ENROLL_SECRET=<enroll-secret> \
FLEET_DESKTOP=1 \
TUF_PATH=$FLEET_REPO_DIR/test_tuf \
./tools/tuf/test/main.sh
```
2. Install .deb on a Ubuntu 25.10 ARM64 VM.
3. Push a failing fleet-desktop stub to trigger the respawn loop that
produces zombie processes:
```sh
export TUF_PATH=$FLEET_REPO_DIR/test_tuf
export FLEET_TARGETS_PASSPHRASE=p4ssphr4s3 FLEET_SNAPSHOT_PASSPHRASE=p4ssphr4s3 FLEET_TIMESTAMP_PASSPHRASE=p4ssphr4s3
source ./tools/tuf/test/load_orbit_version_vars.sh
STUB=$(mktemp -d)
mkdir -p "$STUB/fleet-desktop"
printf '#!/bin/sh\n[ "$1" = "--help" ] && exit 0\nexit 1\n' > "$STUB/fleet-desktop/fleet-desktop"
chmod +x "$STUB/fleet-desktop/fleet-desktop"
tar czf "$STUB/desktop.tar.gz" -C "$STUB" fleet-desktop
./build/fleetctl updates add --path "$TUF_PATH" --target "$STUB/desktop.tar.gz" --platform linux-arm64 --name desktop --version "$ORBIT_VERSION" -t "$ORBIT_MAJOR.$ORBIT_MINOR" -t "$ORBIT_MAJOR" -t stable
rm -rf "$STUB"
```
4. Watch zombie processes on the VM:
```sh
watch -n5 'ORB=$(pgrep -x orbit); \
echo "zombie sudo children: $(ps -eo ppid,stat,comm | awk -v o="$ORB" "\$1==o && \$2 ~ /Z/ && \$3==\"sudo\"" | wc -l)"; \
echo "total sudo lines: $(ps aux | grep -c "[s]udo")"'
```
https://github.com/user-attachments/assets/dfa4d766-3c8e-4eb0-9104-7219c421538f
#### Test fix
1. Switch to this branch, rebuild and push the new orbit binary (note
that we still have the stub fleet-desktop that always exits).
```sh
make build
export TUF_PATH=$FLEET_REPO_DIR/test_tuf
bash $FLEET_REPO_DIR/push-orbit-arm64.sh
```
Contents of `push-orbit-arm64.sh` is:
```sh
#!/bin/bash
set -e
source ./tools/tuf/test/load_orbit_version_vars.sh
GOOS=linux GOARCH=arm64 go build \
-o orbit-linux-arm64 \
-ldflags="-s -w -X github.com/fleetdm/fleet/v4/orbit/pkg/build.Version=$ORBIT_VERSION -X github.com/fleetdm/fleet/v4/orbit/pkg/build.Commit=$ORBIT_COMMIT" \
./orbit/cmd/orbit
./tools/tuf/test/push_target.sh linux-arm64 orbit orbit-linux-arm64 "$ORBIT_VERSION"
```
2. Verify on the VM that the update is detected and applied. Also, run
step 4's cmd from the reproduction steps and see the zombies being 0,
even though fleet-desktop is still continuously exiting.
https://github.com/user-attachments/assets/d0f96d85-5e94-4878-b413-67031add3c1e
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue on Linux where repeated Fleet Desktop startup failures
could result in thousands of orphaned processes accumulating in the
background, degrading system performance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for several new Windows applications to
the maintained apps catalog, including their installation and
uninstallation scripts, metadata, and detection queries. It also updates
the main `apps.json` index to include these new apps with descriptions.
Additionally, there are minor improvements to existing app descriptions.
**New Windows app support:**
* Added support for the following apps, including input definitions and
output manifests:
- Alacritty (`alacritty.json`, `alacritty/windows.json`)
[[1]](diffhunk://#diff-3e02eecda6ec1b6c13931cc7ddbab47c090f988f5683bb1ed39218df077160cdR1-R10)
[[2]](diffhunk://#diff-5887b934dfbbba37ac79d83119266442f17fa334190a177684086a32115d34a2R1-R23)
- Amazon Corretto JRE 8 (`amazon-corretto-jre-8.json`,
`amazon-corretto-jre-8/windows.json`)
[[1]](diffhunk://#diff-6cc761a4417395b137592c475901fecdff3f298e8f24406c5bc3792f05c27b75R1-R10)
[[2]](diffhunk://#diff-2a4d72a579b6a7593f430a4b5129a230495bf1b5099ee046a930c221c6ac437fR1-R23)
- Aptakube (`aptakube.json`, `aptakube/windows.json`)
[[1]](diffhunk://#diff-0572d094e23ababfc709823e7c5c40d01c315d32169a0308ce203bcd2e43b1caR1-R11)
[[2]](diffhunk://#diff-8b20bf0e5682306bf73366be85519573a2ac9ef10e826cc182819eb7af916a4aR1-R23)
- Audiveris (`audiveris.json`, `audiveris/windows.json`)
[[1]](diffhunk://#diff-7153868173ff1e2858eb0030faf2538b3757fb369de335046566a43b67e9bb53R1-R10)
[[2]](diffhunk://#diff-fc7ccdcfb1aa3a57d86c588c6451a534e75ed81c93c9f91ffe1d17fcf6ac11e3R1-R22)
- Autopsy (`autopsy.json`, `autopsy/windows.json`)
[[1]](diffhunk://#diff-8f6dbd95a7ad6ced8bdda80c6f91e048954304be7097db43fb26f0420554330dR1-R10)
[[2]](diffhunk://#diff-33a6ed85427063b8a5a590969ef92ddc330dcb3ebb9fb096a6bea41b03b369faR1-R22)
- AWS SAM CLI (`aws-sam-cli.json`, `aws-sam-cli/windows.json`)
- Filebeat (`filebeat.json`, `filebeat/windows.json`)
- Winlogbeat (`winlogbeat.json`, `winlogbeat/windows.json`)
**Catalog and metadata updates:**
* Updated `apps.json` to include the new Windows apps with their
descriptions and unique identifiers.
[[1]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R361-R367)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R459-R465)
[[3]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R641-R647)
[[4]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R732-R745)
[[5]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R767-R773)
[[6]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R2769-R2775)
[[7]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R8124-R8130)
**Minor improvements:**
* Fixed smart quote usage in the descriptions for "Moom" and "Splice" in
`apps.json` for better typographic consistency.
[[1]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2L4790-R4839)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2L6876-R6925)
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Updated 21+ maintained applications across Windows and macOS platforms
to their latest available versions, including Adobe Creative Cloud, AWS
CLI, Codex, CodexBar, Discord, Egnyte, Google Drive, Grammarly, Gyazo,
Insomnia, Loom, Slack, and Spotify.
* Improved uninstaller behavior for select applications to ensure proper
cleanup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
This pull request adds support for several new Windows applications to
the maintained apps list by introducing new JSON manifest files and
corresponding install/uninstall scripts. Each manifest provides
configuration details required for automated installation and
categorization.
**New application manifests added:**
_Productivity applications:_
* Added `nagstamon.json` for Nagstamon, including install/uninstall
scripts and an installation script using Inno Setup silent options.
[[1]](diffhunk://#diff-3c74eeef956d1978f39fb41e4a4c8373a177d3ba899e30cfc7c23de097132689R1-R12)
[[2]](diffhunk://#diff-8befb290da9fe695b0d4c5725a819262c482367c26e5c725e64507abb54638d1R1-R26)
* Added manifests for Notesnook, ocenaudio, OpenRefine, Portfolio
Performance, PreForm, Proton Drive, Readest, Remote Desktop Manager,
Royal TSX, and RetroArch.
[[1]](diffhunk://#diff-8f46fa9ee50b09b7c763c04146a369add5d7edec998ccb1fdcd8b961d6250f2cR1-R13)
[[2]](diffhunk://#diff-3e717b6b7498ecf39f00e628d51b6b6884545e9a781605fba7ec3fdd3e9ece35R1-R12)
[[3]](diffhunk://#diff-ef74fc4e086aabedf80c1ef26493442f24e01dbbbfc169ecde810b6ecfbbc154R1-R12)
[[4]](diffhunk://#diff-0e0d13f35ef324e599a8487825d4844c2f60ad4d1bc68dc2a4f06f8276b85c5dR1-R12)
[[5]](diffhunk://#diff-c395a54083c1e88011dae0ba639b32dcb173ce21b0e21abb8b65ff5335418c38R1-R12)
[[6]](diffhunk://#diff-3a05b3cd4f042b709d41364f93b1d9cea907f0ad8bccf9514cda282a2c2632a3R1-R12)
[[7]](diffhunk://#diff-093dfe2c06862cee70bf9b57dcd535660a41665eba49b095b91b8fa6ffcdf99dR1-R12)
[[8]](diffhunk://#diff-09f2f1905ce5794bf248dcf0d2724b435a2255451adeeac3226197ceea7863f9R1-R10)
[[9]](diffhunk://#diff-00f35514528449c1248f5369bd4143470a48692415b228615c23326f5cbccc87R1-R10)
[[10]](diffhunk://#diff-1ccb271d6fb63b2a250720c43073502dc71c1b1adc6ffd951de002ea426ef785R1-R12)
_Developer tools:_
* Added manifests for NoSQL Workbench, Proxyman, and Reqable, each with
install/uninstall scripts.
[[1]](diffhunk://#diff-13c131b80d23c96d4a163c3842f6b5138b908a478b89edb4a42d5379ed7ba174R1-R12)
[[2]](diffhunk://#diff-e963cb7961788f69a34e407e6ae046cf13dc66af1e2ac0f57a42cdf1b114c568R1-R12)
[[3]](diffhunk://#diff-da81ab2f561640b12b95cae1ceb2ab022f228acdfc94d9005e885261d52224a5R1-R12)
_Browsers:_
* Added manifests for Pale Moon and Safe Exam Browser, including
install/uninstall scripts.
[[1]](diffhunk://#diff-3cee4f5e3d10ec8db232ae70aac509b86ca0eb4d5e4f97f677ecba66a178232eR1-R12)
[[2]](diffhunk://#diff-211c50486f9997fbdd63aa081c265a8e6d27d91f6ed00237d3f3e92f41bfcd98R1-R12)
_Other tools:_
* Added manifest for ProtoPie and Requestly, both with install/uninstall
scripts.
[[1]](diffhunk://#diff-8daee55ad74b517db4b49aaef6e80a329e27702a5e6f81c280685ebe520c6c62R1-R12)
[[2]](diffhunk://#diff-9c8c73d3492b7bf6cd819f2f6ba3a012441f4a8d51ecffd99b101462e074756bR1-R13)
**Script additions:**
* Introduced a PowerShell install script for Nagstamon
(`nagstamon_install.ps1`) that uses silent install flags for unattended
installation.
These changes expand the catalog of supported Windows applications,
enabling automated deployment and management for a wider range of
software.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45984
Fix is applied on the GitOps side since that's what I figured the
customer was using on the [Slack
thread](https://fleetdm.slack.com/archives/C061ZA91Y1J/p1779372669701129).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
#### Before
Reproduced on `main`:
- Set `update_new_hosts: true` beforehand.
- Ran `gitops` with `update_new_hosts` commented out. It was still kept
as `true`.
https://github.com/user-attachments/assets/f6b41f0d-38e6-468f-a605-b3e66b7b2dbc
#### After
Running `gitops` with `update_new_hosts` commented out switched its
value to `false`.
https://github.com/user-attachments/assets/24756063-b3a9-400b-a2cc-208dd816a556
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected GitOps behavior for the macOS “Update new hosts to latest”
setting so it no longer stays enabled after clearing `minimum_version`
and `deadline`; it now defaults to disabled unless both are set.
* **Tests**
* Added GitOps test coverage to verify the defaulting outcomes across
YAML variations for the macOS update settings, including explicit and
empty field combinations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45598
1. Apple disregards query params in the 403 WWW-Authenticate URL, so
setting it as the ?initiator= does not work, had to make a new route on
the frontend to match the same URL but with a dynamic token.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary
* **New Features**
* Added support for a configured default fleet/team for BYO Apple
enrollment.
* Enabled account-driven Apple MDM enrollment using per-enrollment
tokens.
* Added tokenized Apple MDM service discovery and enrollment endpoints.
* **Bug Fixes & Improvements**
* Added automated daily cleanup of expired enrollment challenges.
* Improved BYOD/account-driven enrollment challenge handling, including
default team assignment and Managed Apple ID updates.
* Reduced unnecessary BYOD MDM profile refetches during reenrollment.
* **Tests**
* Expanded coverage for token lookup, enrollment challenges, and updated
BYOD/account-driven flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47573
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated observability and telemetry configuration for improved
deployment monitoring.
* Enhanced infrastructure environment variables including logging,
database connection management, and Fleet service settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Added a new page: /security-and-control
- Added a link to the new page in the "Solutions" header dropdown menu
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## New Features
* Added a new "Security & control" page featuring security solutions
overview, product features including software inventory and autonomous
remediation capabilities, customer testimonials, and call-to-action
sections. The page is accessible via the updated website navigation
menu.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Add a new Smartsvn SVG component
(frontend/pages/SoftwarePage/components/icons/Smartsvn.tsx) and include
the PNG asset (website/assets/images/app-icon-smartsvn-60x60@2x.png).
Update the icons index to import AwsCli and Smartsvn, add mappings for
"aws command line interface", "druva insync", "smartsvn", and "vnc
server", and normalize Azul Zulu keys from "azul zulu 25 jdk/jre" to
"azul zulu jdk/jre".
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated metadata for 25+ maintained applications across Windows and
macOS platforms, including Docker, Discord, Slack, Spotify, and others,
to reflect current available versions.
* Added frozen state configuration for Fire Alpaca and NVIDIA GeForce
NOW Homebrew packages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
**Related issue:** Resolves#41910
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Configurable Android app operation batch size
(FLEET_MDM_ANDROID_BATCH_SIZE, default 1000) to reduce Android
Management API load.
* Android software install and app-availability operations now run in
batched, staggered jobs across workers to improve reliability and avoid
API throttling on large fleets.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Removed, compressed, or resized large images in the website's assets
folder
- compressed whitepaper pdfs
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Adds Mollie case study.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Mollie as a featured customer case study on the customers page,
including company branding, overview information, and a link to the full
case study.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
For #32765
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Fleet software package management (add/update) and download for
software titles.
* Added Apple App Store app management, including listing, adding, and
linking apps to titles.
* Added Fleet-maintained app support for titles.
* Enabled host software uninstalls and retrieval of install/uninstall
results via `install_uuid`.
* Added ability to remove a title’s “available for install” status.
* **Bug Fixes**
* Updated software title icon labeling to indicate download.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Updated the get-territory-user-id helper to not require a country
input, but to throw an error if one is not provided. This is done to
replace the default usageError that is thrown by helpers with an error
that provides more information about the provided inputs
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved input validation error handling for territory lookups to
provide clearer error messages during runtime.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/47387
Changes:
- Added a section to the /software-management page
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added new page section titled "Customize their experience" showcasing
user experience management and customization options. Highlights include
app patching notifications, native notification delivery, calendar
integration support, and seamless compatibility with existing management
tools, emphasizing flexible notification strategies across multiple
communication channels.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/47406
Changes:
- Added a CTA to the article template page.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Call-To-Action sections to certain article pages with a "Read
case studies" link and a "Try it yourself" sign-up button for select
categories.
* **Style**
* Updated CTA styling and layout, including a new CTA container and
button row.
* Improved mobile behavior: buttons stack, center, and become full-width
on small screens.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The FMA unique identifier (software title match) for Cloudflare WARP
changed recently to Cloudflare One Client. This test was using the input
file from `/ee/maintained-apps/inputs/winget/cloudflare-warp.json` so
the change actually affected it.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Updated Cloudflare product identification test expectations to reflect
current software naming and version tracking behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for several new Windows applications to
the maintained apps catalog by introducing new JSON manifest files under
`ee/maintained-apps/inputs/winget/`. Each manifest specifies
installation details, categorization, and, where needed, custom
install/uninstall scripts. The additions cover a mix of productivity,
developer tools, and communication apps.
**New application manifests added:**
_Productivity apps:_
* Added manifests for `ActivityWatch`, `AirParrot`, `Bdash`, `Binance`,
`Biscuit`, `BreakTimer`, `darktable`, `Descript`, `DevToys`, `dupeGuru`,
`Dynalist`, `Electrum`, `GDevelop`, and `Gephi`, each with relevant
install/uninstall scripts and metadata.
[[1]](diffhunk://#diff-55387cfd17c8952a5a5fe56f9072156a285797be5316796f7a1bec6a190170b1R1-R12)
[[2]](diffhunk://#diff-b6391ec86660a9cbcbe90756daea60701eb69b6e0ebbde2b0d8c75dd1a31a126R1-R11)
[[3]](diffhunk://#diff-04b0ac58d3fd3d42504786f39d612dc89bde16512d954bbf1646547d15837c6fR1-R13)
[[4]](diffhunk://#diff-12047bbb053e94f70e18af209bc7b901c37df285ca753549c619cc409b3da361R1-R13)
[[5]](diffhunk://#diff-984aab5373578ee3278d33367fc48b7d67c3ddb59b35d257ef170bb8ee62aaf4R1-R13)
[[6]](diffhunk://#diff-4e06e7c7940663923b6210a19495dd13eeb605d368312718402136666edb2d23R1-R13)
[[7]](diffhunk://#diff-e4ec2c2ab61f6a9de45914b1ca8ee08ce4cde504e4e595341a776a5e69dd5862R1-R12)
[[8]](diffhunk://#diff-b7a6f3074314e4d52a9c5b8d104247ecdbf80e526791d7a02e1819e7a7148441R1-R15)
[[9]](diffhunk://#diff-096ca15b420e419a365d998af529e92e2adfb45a1d28738cfb3009afff48b3daR1-R12)
[[10]](diffhunk://#diff-0db89ec11e8da68b0eb4e894805ae3f71258bf4844aadfd1423fe0b671e58da8R1-R12)
[[11]](diffhunk://#diff-ad484bc36aa30653876aaf4665ad1e5366088a68121163ed94399fecaa17cb7cR1-R14)
[[12]](diffhunk://#diff-1516c2e3c532aecf16b7f81e7cf4488ad1aefca791cf58f5bab1f08c1d3d0becR1-R14)
[[13]](diffhunk://#diff-133f3702736e7cc29113b3faf59cd15fd631b853f21108f19a3428c8a1dac0f7R1-R12)
[[14]](diffhunk://#diff-7b356cca2e47651ce2cdbf7b99ddd89b410185ddddf7546daaefee1d14161d5dR1-R12)
_Developer tools:_
* Added manifests for `Cherry Studio`, `Dataflare`, `DbVisualizer`, and
`Geany`, categorized as developer tools and including install/uninstall
scripts.
[[1]](diffhunk://#diff-8c85cc5f00362d25db8bc87ecd1135e4038b5dbe29408cf6146ff144de02d477R1-R12)
[[2]](diffhunk://#diff-b4a1720d2b1d727613a311c4a2cfd0f1c2e0a6198c0c31605286b9ef20e30896R1-R12)
[[3]](diffhunk://#diff-7a4d41ce430b5a37d4d311c5c3ebaf3bbaef41da062db201fb496f6a2d6abb5fR1-R12)
[[4]](diffhunk://#diff-cb4abb01239b831cc4e82020821d457a018ba1ea109fbc4fe1660bc0b7839af9R1-R12)
_Communication apps:_
* Added manifests for `Fellow` and `Franz`, categorized as communication
tools with user-scope installers and scripts.
[[1]](diffhunk://#diff-284b2bdcf738397525f4e60f50da15c764c6306e8707e4f3196a9a4968a96c56R1-R12)
[[2]](diffhunk://#diff-c60796271608d278c88037acec46900c6da13731b73697b2ef08e4c3ddacd9c8R1-R12)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added support for 30+ new Windows applications including productivity
tools (Bdash, Morgen, Fellow), utilities (dupeGuru, DevToys, Geany),
developer tools (Lapce, KNIME, GDevelop), and others (Binance, Electrum,
GOG Galaxy, Mullvad Browser, ImHex, and more).
* **Improvements**
* Updated description formatting for existing app entries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44617
Screenshot:
<img width="1318" height="528" alt="image"
src="https://github.com/user-attachments/assets/4ec4bd85-8efb-4729-86ad-ea3059439b60"
/>
Note that the uninstall details modal is viewable without any errors on
Fleet Free, so maybe we should address that at some point.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* When accessing software install details without a Fleet Premium
license, the activity modal now displays a Fleet Premium upsell message
with a "Learn more" link instead of a generic error, providing clearer
guidance to upgrade.
* **Tests**
* Added test coverage for the Fleet Premium license requirement scenario
in the install details modal.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Small tool update to support fetching the service discovery URL
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a `-command` flag to enable a new operation mode; when set to
`adue` the CLI performs the account-driven enrollment discovery flow,
otherwise it falls back to the existing account detail behavior.
* **Chores**
* Simplified the server private key flag to `-key`.
* Strengthened input validation to require both `-key` and `-org-name`.
* Enforced mutual exclusivity among operation flags (`-profile-uuid`,
`-serial-number`, `-command`).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
## Summary
- Removes the "*Windows coming soon" text from the
`/software-management` page on fleetdm.com.
## Why
Fleet already supports Windows software and OS management. The "coming
soon" caveat adds unnecessary FUD and confusion — it makes it seem like
Fleet doesn't support Windows, which it absolutely does. Removing this
text provides a clearer and more accurate representation of Fleet's
capabilities.
## Changes
- `website/views/pages/software-management.ejs`: Removed the `<span
purpose="feature-note">*Windows coming soon</span>` element from the
"App store management" feature section.
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1781314316685189?thread_ts=1780459268.285059&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated version metadata and installer information for 26 applications
including Affinity, BoltAI, CodexBar, Cursor, DataFlare, DeepL, Deezer,
Docker Desktop, Dockside, Dropshare, FireAlpaca, HexFiend, Hive, Kitty,
Melodics, Mullvad VPN, NVIDIA GeForce Now, OpenCode, Pd, Postman, Stats,
Syncovery, TablePlus, Typora, WhatsApp, and Zettlr across macOS and
Windows platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46937
Moves fleet desktop standalone app from
https://github.com/allenhouchins/fleet-desktop into the monorepo
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
No changes file. Do we want to create a new changes directory and
changelog for this? Unclear
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
Downloaded build from CI, tested locally and installed via Fleet on a
mac mini. Launched and tested there - all looks good
<img width="1485" height="544" alt="Screenshot 2026-06-09 at 4 27 59 PM"
src="https://github.com/user-attachments/assets/48611808-2265-43b7-a514-afc4f578a9f8"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Launched Fleet Desktop macOS app with web-based self-service UI.
* Added fleet:// URL handling to trigger in-app actions (refetch, update
all).
* Dock badge shows failing policies count in real time.
* Built-in token refresh, retries, and navigation error handling for
reliability.
* MDM configuration support for enterprise deployment.
* Automated macOS packaging with code signing, notarization, and
artifact upload.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46584
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
(Already added in main.)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
`generate-gitops`:
https://github.com/user-attachments/assets/d32e89c3-2ce7-4c57-9492-66deb0a3dfe8
`gitops`:
https://github.com/user-attachments/assets/ac0e3935-bc8d-4541-b3e5-f992109630d9
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added `labels_exclude_all` field support for refining policy label
scopes (available with Fleet Premium license).
* **Bug Fixes**
* Enhanced validation of policy label scope configurations to prevent
invalid field combinations and enforce license requirements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added test coverage to verify team administrator access controls and
boundary enforcement. The test ensures that team admins cannot create
users in other teams, validating this restriction across both standard
and API-only user creation endpoints. The test also confirms that users
can be successfully created within their authorized team scope.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
RachelElysia
