This pull request adds support for the Comet browser (an AI-integrated
browser from Perplexity) to the maintained apps catalog for both macOS
and Windows. It introduces metadata, installation, and uninstallation
scripts, as well as versioned definitions for both platforms.
**New application support: Comet browser**
*Metadata and catalog integration:*
- Added `comet.json` metadata files for Homebrew (macOS) and Winget
(Windows) in the `inputs` directory, defining identifiers, installer
types, and categories.
[[1]](diffhunk://#diff-60e2346d602b7538ba08314f7adfdde98ca8e802dd3706c65bb75273fe7bbbd4R1-R8)
[[2]](diffhunk://#diff-ecdccc5ed1a1f1e6f2b66439941fcd74419b2706c1df155cb4bc1940abd6bfa7R1-R13)
- Updated `apps.json` to include Comet for both `darwin` (macOS) and
`windows` platforms with descriptive text.
*macOS support:*
- Added `outputs/comet/darwin.json` with versioned app definition,
install/uninstall queries, download URL, and references to
install/uninstall scripts.
*Windows support:*
- Added `outputs/comet/windows.json` with versioned app definition,
install/uninstall queries, download URL, SHA256, and references to
install/uninstall scripts.
- Added PowerShell scripts for silent installation (`comet_install.ps1`)
and uninstallation (`comet_uninstall.ps1`) of Comet, handling
machine-wide deployment and proper exit codes.
[[1]](diffhunk://#diff-5b9c60857fd2a49958f05124e8744394683297127503578e9b4eaf227470f1f7R1-R31)
[[2]](diffhunk://#diff-3433e05da3c0601490c7d90084264d4a793d0feef4211569b4aff884f85116dbR1-R101)
Add TablePlus Windows packaging: input manifest, PowerShell
install/uninstall scripts, and outputs. The install script runs the Inno
Setup installer silently with /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
/ALLUSERS; the uninstall script locates the Inno Setup uninstaller via
registry and runs it with silent args. apps.json was updated to include
TablePlus and a new outputs/tableplus/windows.json was added with
version 7.1.2, installer URL, sha256, and script references.
## Summary
Adds **WinRAR 7.22.0** as a Fleet-maintained app (Windows / winget
`RARLab.WinRAR`).
## Details
- **Installer type**: `exe` (WinRAR self-extracting installer), machine
scope → custom install/uninstall scripts (the ingester only
auto-generates for machine-scope MSI).
- **Silent install**: `-s1` — from the winget manifest's documented
`InstallerSwitches.Silent`.
- **Silent uninstall**: `uninstall.exe /S` located via the registry
`UninstallString`, parsed with the defensive 3-shape matcher.
- **Identity**: `unique_identifier: "WinRAR"` + `fuzzy_match_name: true`
→ exists query `name LIKE 'WinRAR %' AND publisher = 'win.rar GmbH'`.
Fuzzy match is required because WinRAR's registry DisplayName embeds the
version (`WinRAR 7.22.0 (64-bit)`). Registry Publisher matches the
winget locale Publisher, so no `program_publisher` override.
- **SHA**: matches the manifest's en-x64 installer; version `7.22.0`
reconciles with osquery's DisplayVersion.
- **Icon**: generated component, website PNG, and `index.ts` map entry
(`winrar`).
## Notes / risks
- Installer URL (`https://www.rarlab.com/rar/winrar-x64-722.exe`) is
version-pinned, so the SHA is stable until the FMA auto-update bumps it.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added WinRAR application support, including version 7.22.0 with
automated installation and uninstallation capabilities.
* Added custom WinRAR icon for improved visibility on the software page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add Zen Browser support: new PowerShell install and uninstall scripts
(silent NSIS installer with /S and /PreventRebootRequired; uninstaller
detects registry entries and runs uninstall string). Add winget input
manifest ee/maintained-apps/inputs/winget/zen-browser.json referencing
those scripts. Update outputs: add a apps.json entry for Zen Browser and
create ee/maintained-apps/outputs/zen-browser/windows.json containing
version 1.20b metadata, installer URL, sha256, and script refs.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated installer metadata for 13 apps (new versions, updated download
links and checksums) across Windows and macOS.
* Added a Windows uninstall script for TextExpander and registered it in
the package manifest to improve uninstall behavior and exit-code
handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Introduce a new content-style skill under .claude/skills/content-style
with a SKILL.md and three reference docs (content-types.md,
positioning.md, style-rules.md) to capture Fleet's voice, format rules,
and messaging guidance for authoring and reviewing public-facing
content. Also add .kilo/kilo.jsonc to register the .claude/skills path
so Kilo Code loads the skill automatically.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated project configuration to support automated skill management
infrastructure.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46467?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Introduce Groove OmniDialer to the maintained apps dataset and UI. Adds
a homebrew input (dmg) and an apps.json entry, plus a darwin-specific
output with version 26.603.1017, installer URL, sha256, and embedded
install/uninstall script refs. Also adds a frontend SVG icon component,
registers it in the icons index, and includes the app PNG asset.
Install/uninstall scripts handle quitting/relaunching the app and
cleaning user data.
Add ClickShare to maintained apps and frontend. Creates a Homebrew input
(ee/maintained-apps/inputs/homebrew/clickshare.json), adds an apps.json
entry, and adds an outputs file for darwin with version 4.50.0
(installer URL, sha256, and install/uninstall script refs). Also adds a
React SVG icon component, registers it in the icon map, and includes the
60x60@2x PNG asset for the app. Default category set to Communication.
Register Microsoft 365 Copilot: add a Homebrew input (unique_identifier
com.microsoft.m365copilot), add an apps.json entry, and add
darwin-specific output with version 1.2605.2501 (installer URL, sha256,
install/uninstall script refs). Also add a React SVG icon component,
update the icons index map, and include the app icon image asset.
Introduce Power Monitor (corp.sap.PowerMonitor) for Darwin: add Homebrew
input, register app in ee outputs/apps.json, and add detailed
ee/maintained-apps/outputs/power-monitor/darwin.json with version 1.3.3,
installer URL, sha256 and install/uninstall script refs. Also add
frontend assets — a React SVG icon component, register it in the icon
map, and include a 60x60@2x PNG app icon. This enables listing,
installation, and clean uninstallation of the Power Monitor app.
Introduce support for Cinc Workstation across the app catalog and UI.
Adds a winget input (ee/maintained-apps/inputs/winget/cinc.json), a new
apps catalog entry (ee/maintained-apps/outputs/apps.json), and a
Windows-specific output with versioned metadata
(ee/maintained-apps/outputs/cinc/windows.json) including installer URL,
SHA256, and install/uninstall script refs for version 23.5.1040. Also
adds a React SVG icon component, maps the app name to the icon
(frontend/pages/SoftwarePage/components/icons/*), and includes the 60x60
PNG asset for the app icon.
Rename Windsurf to Devin Desktop across EE manifests and frontend
assets. Bump darwin version to 3.0.28 and update installer URL, SHA256,
and install/uninstall script refs and contents
(ee/maintained-apps/inputs/homebrew/* and ee/maintained-apps/outputs/*).
Update ee/maintained-apps/outputs/apps.json to list Devin Desktop and
remove the old Windsurf entry. Add a new React SVG icon component and
register it in the icons index, and add the corresponding PNG asset
(frontend/pages/SoftwarePage/components/icons/DevinDesktop.tsx,
frontend/pages/SoftwarePage/components/icons/index.ts,
website/assets/images/*).
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Claude Windows to version 1.11187.4
* Updated Ollama Windows to version 0.30.6
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Claude Desktop (macOS) to version 1.11187.4
* Updated Cursor (macOS) to version 3.7.12
* Updated Figma Desktop (macOS) to version 126.4.13
* Updated Fork (Windows) to version 2.20.0
* Updated Ollama (macOS) to version 0.30.6
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected redirect links for Apple Business Manager documentation
resources, ensuring users are directed to the appropriate help content
within the Fleet UI.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for PowerShell as a managed Windows app,
including its metadata, versioning, install/uninstall scripts, and
validation logic in the CI workflow. It also ensures that any
pre-installed PowerShell 7 is removed from the test environment before
validation. The most important changes are:
**PowerShell app definition and metadata:**
* Added a new entry for PowerShell in
`ee/maintained-apps/inputs/winget/powershell.json` and included its
metadata in `ee/maintained-apps/outputs/apps.json`, enabling PowerShell
to be managed as a Windows app.
[[1]](diffhunk://#diff-7e4899a379d327948f55b7e6ba4c9893501713edd16020b128b68343569fcbfbR1-R10)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1985-R1991)
* Created `ee/maintained-apps/outputs/powershell/windows.json`
containing version information, SQL queries for existence and patch
status, installer/uninstaller scripts, and download URL for PowerShell
7.6.2.0.
**CI workflow enhancements for PowerShell:**
* Updated `.github/workflows/test-fma-windows-pr-only.yml` to detect
changes involving PowerShell, set the appropriate output flags, and
conditionally execute PowerShell-specific steps.
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR102)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR116)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR155-R162)
* Added a workflow step to remove any pre-installed PowerShell 7 from
the GitHub Actions runner, ensuring a clean environment for validation.
* Ensured that validation and related steps use Windows PowerShell 5.1
(not pwsh) after uninstalling PowerShell 7, to avoid shell availability
issues.
These changes collectively enable PowerShell to be validated, installed,
and uninstalled as part of the managed apps ecosystem and ensure
reliable, repeatable CI validation.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added PowerShell as a supported application with full Windows
integration, including installation and uninstall management
capabilities.
* Enhanced deployment scripts to support flexible input handling for app
configurations.
* Added PowerShell icon to the frontend UI for visual identification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/46872
Changes:
- Updated the `productCategories` value of the testimonial from Adam
Pippert to show it on the /software-management page.
- Updated the order of testimonials on the homepage,
/software-management, /device-management, and /linux-management
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* In-house iOS app manifest and package downloads now use secure
per-install tokens embedded in the URL path instead of query parameters
* Installation tokens are bound to specific devices and teams, enhancing
security
* Installation tokens automatically expire after 6 hours
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jonathan Katz <yehonatankatz@gmail.com>
**Related issue:** Resolves#35148
## What was added
| CVE | Rule | Reason |
|-----|------|--------|
| **CVE-2017-17522** | `IgnoreAll` | DISPUTED by Python maintainers; not
exploitable (`webbrowser.py` uses `subprocess.Popen` with
`shell=False`). Broad NVD CPE matched modern Python. |
| **CVE-2023-36632** | `IgnoreAll` | NVD-DISPUTED — Python states it's
"neither a vulnerability nor a bug" (intentional `RecursionError` in
`email.utils.parseaddr`). |
| **CVE-2024-3219** | `IgnoreIf target_sw != "windows"` | Only affects
platforms lacking AF_UNIX (Windows). Linux/macOS unaffected, but
NVD/VulnCheck CPE uses `target_sw=*`. |
**Files touched:**
- `cpe_matching_rules.go` — three new rules
- `cpe_matching_rule_test.go` — assertions covering all three (incl.
Windows-vs-macOS/Linux distinction for CVE-2024-3219)
- `changes/35148-python-cve-false-positives` — changelog
**Correctness note:** `target_sw` derives from software *source*
(`apps`/`homebrew_packages` → `macos`, `programs` → `windows`), so the
CVE-2024-3219 rule suppresses on macOS while preserving the genuine
Windows
positive.
## What was skipped, and why
| CVE | Why skipped |
|-----|-------------|
| **CVE-2024-12718** | Conflicting evidence: getvictor confirmed it's a
**true positive** (3.9.22 < fixed 3.9.23), contradicting the customer's
"only 3.12+ affected" reasoning. Needs a product/security ruling, not a
code change. |
| **CVE-2025-1795** | Likely a VulnCheck patch-level miss (customer says
3.10.17 has the backported fix). Needs the actual VulnCheck version
range to fix safely. |
| **CVE-2023-32681** | Affects `python:requests` and is **correctly
matched**; the customer dismissed it on deployment grounds ("corporate
servers only"). Not a detection bug. |
| **CVE-2007-4559** | Real tarfile path-traversal (CVSS 9.8, **not
disputed**); the customer labeled it "Other issue," not a false
positive. Suppressing it would hide a genuine vulnerability. |
**Related issue:** Resolves#42757
## Summary
Resending or renewing the Okta conditional access profile leaves an
orphaned SCEP certificate in the per-user macOS keychain, accumulating
duplicates with every renewal. This PR auto-runs an existing
keychain-cleanup script after a successful `InstallProfile` ack for the
Okta CA profile, so admins no longer have to find and run the script
manually.
## Root cause
Investigation in the issue thread isolated the trigger:
- The Okta CA `.mobileconfig` bundles `com.apple.security.scep` with
`com.apple.security.identitypreference` in a single profile (macOS
rejects the alternative — `Identity payload not found in same profile as
identity preference payload`).
- The Identity Preference payload creates a keychain-resident preference
item that keeps the *old* cert pinned across profile replacement, even
though the rewritten Identity Preference now points to the fresh SCEP
enrollment.
- EAP-TLS Wi-Fi profiles renew cleanly because they reference the cert
via SystemConfiguration (`PayloadCertificateUUID`), not the keychain —
so this isn't a generic SCEP-bundling issue.
The team decision in the issue (`@sharon-fdm`) was to delete the
duplicate certificate rather than restructure the profile. A standalone
cleanup script already shipped at
`docs/solutions/macos/scripts/delete-duplicate-scep-certificates.sh` and
was linked from the Okta CA guide; admins had to find and run it.
## Approach
Hook the existing Apple MDM `InstallProfile` ack path in
`MDMAppleCheckinAndCommandService.CommandAndReportResults`, parallel to
the existing ACME `CertificateList` follow-up. When the ack is for the
Okta CA profile and status is `verifying`, enqueue an internal host
script run that executes the cleanup script targeting the host's
per-user MDM enrollment short name.
Key properties:
- **Single hook, three paths covered.** Admin "Resend" nulls the profile
status and the reconciliation cron re-enqueues an `InstallProfile`; the
SCEP renewal cron also re-issues `InstallProfile`. Both flow through the
same ack handler this hook attaches to.
- **Idempotent.** The cleanup script no-ops when only one matching cert
is present, so triggering on initial installs (not just renewals) is
safe and removes the need to distinguish "is this a renewal".
- **Tightly gated.** Single indexed lookup keyed on `(host_uuid,
command_uuid, profile_identifier, platform='darwin')`. Other
SCEP-bearing profiles do not trigger the script. No work happens for
hosts with no per-user enrollment.
- **Internal-script semantics** (matches lock/unlock/wipe prior art).
Runs even when scripts are globally disabled. Does not appear in the
user-facing host activity feed.
- **Failure-isolated.** Enqueue errors are logged but do not break the
ack path; the renewal itself is what matters.
- **Defense in depth on the shell call.** The macOS short name is
validated against a strict regex (`^[A-Za-z0-9_][A-Za-z0-9_.-]*$`, ≤31
chars) before being interpolated, and POSIX single-quote-escaped on the
way through.
## Files
**New**
- `server/service/conditional_access_cleanup.go` — `//go:embed` of the
cleanup script, the hook helper `maybeRunOktaCACleanupScript`, the
validated shell-wrapper builder, and the POSIX single-quote escape
helper.
- `server/service/conditional_access_cleanup_test.go` — unit coverage
for username validation, shell escaping, the routing decisions of the
hook helper (mock-based), and an embed-sync assertion against the docs
copy.
-
`server/service/embedded_scripts/delete-duplicate-scep-certificates.sh`
— embed source-of-truth copy, byte-for-byte equal to the public
`docs/solutions/macos/scripts/` script.
- `changes/42757-okta-conditional-access-duplicate-scep-cert-cleanup` —
user-visible changes note.
**Datastore**
- `server/datastore/mysql/mdm.go` —
`OktaCACleanupTargetForInstallCommand`: single SQL lookup that returns
`(host_id, user_short_name, ok)` for the new hook. Returns `ok=false`
for non-Okta profiles, non-darwin hosts, or hosts without a user-channel
enrollment.
- `server/datastore/mysql/scripts.go` —
`NewInternalHostScriptExecutionRequest`: thin wrapper that routes
through the existing internal-script codepath (`isInternal=true`) used
by lock/unlock/wipe. Refactored the existing public method to share an
internal helper.
**Interface / mocks**
- `server/fleet/conditional_access_idp.go` — exported
`ConditionalAccessOktaProfileIdentifier`,
`ConditionalAccessOktaCertificateCN`, and the new `OktaCACleanupTarget`
struct, so both the template-render path and the SQL lookup can
reference the same source of truth.
- `server/fleet/datastore.go` — `OktaCACleanupTargetForInstallCommand`
and `NewInternalHostScriptExecutionRequest` added to the `Datastore`
interface.
- `server/mock/datastore_mock.go` — regenerated (additions only).
**Wiring**
- `server/service/apple_mdm.go` — call into
`maybeRunOktaCACleanupScript` from the InstallProfile
`MDMDeliveryVerifying` branch, alongside the existing ACME
`maybeQueueCertificateListForACMEProfile` follow-up. Warns on error
rather than failing the ack.
- `server/service/conditional_access_idp.go` — use the new
`fleet.ConditionalAccessOktaCertificateCN` constant when rendering the
profile template, eliminating the magic string duplication.
**Tests touched**
- `server/datastore/mysql/mdm_test.go` — integration test
`testOktaCACleanupTargetForInstallCommand` covering the happy path,
non-Okta profile, device-only enrollment, and unknown command.
- `server/datastore/mysql/scripts_test.go` —
`testNewInternalHostScriptExecutionRequest` confirming the internal flag
is set correctly and the new entry only appears under the internal-only
listing filter.
- `server/service/apple_mdm_test.go` — added the new mock stub for
`OktaCACleanupTargetForInstallCommandFunc` to
`TestMDMCommandAndReportResultsProfileHandling` so the existing test
continues to pass with the new hook in the codepath.
- `server/service/conditional_access_idp_test.go` — the rendered-profile
assertion now also pins on the shared
`ConditionalAccessOktaProfileIdentifier` and
`ConditionalAccessOktaCertificateCN` constants so the template can't
drift from the SQL lookup.
Fixes#44805
Fixed a bug where the "Add custom variable" modal would clear entered
values when switching focus to another browser tab or application window
due to network refetches.
For the following quick win:
- https://github.com/fleetdm/fleet/issues/45965
<img width="852" height="288" alt="Screenshot 2026-06-05 at 3 30 08 PM"
src="https://github.com/user-attachments/assets/22967048-8752-4194-b5a6-9014f061e413"
/>
"Learn more" takes me to here:
https://fleetdm.com/guides/mdm-migration#end-user-workflow
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added "Learn more" link in the end user migration section that opens
the Fleet MDM migration guide documentation in a new tab.
* Configured redirect route to direct users to the end user workflow
section of the migration guide.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated GitHub Actions dependencies to latest stable versions across
CI/CD workflows for improved reliability, security, and performance.
* Enhanced build provenance attestation configuration for macOS, Linux,
and Windows builds.
* **Security**
* Strengthened workflow validation by removing override exception for
build artifact version mismatch rules, ensuring stricter security
compliance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46790
Example live run off this branch:
https://github.com/fleetdm/fleet/actions/runs/27005120262
Example stale issue with comment:
https://github.com/fleetdm/fleet/issues/18421
- Added `@author` mention when marking issue as stale
- Refactored so that both Fleetie and eng-initiated stale issue bots use
the same core JS code
- Run Fleetie-initiated workflow on a schedule
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Automated stale-issue workflows for engineering-initiated and Fleetie
issues with configurable dry-run, max-operations, manual triggers, and
scheduled runs.
* **Tests**
* Added shared test helpers and expanded, tightened test suites covering
staleness, closing, unstale, and error/boundary behaviors.
* **Refactor**
* Introduced a shared stale-issue engine used by thin,
author/label-based wrappers for consistent behavior and messaging.
* **Chores**
* Updated workflow triggers, permissions, and CI test matrix to include
the new core and wrappers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated internal code review assignments for documentation paths.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45263
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Android devices no longer lose team assignments or certificate
configuration when a host is deleted and the device re-enrolls.
* Re-enrollment restores a device’s previously known team when
available, preserving certificate templates and team-specific settings.
* Team transfers for Android devices now reliably update device records
so certificates and access remain consistent.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add support for Microsoft Visual C++ Redistributable (x64) via winget:
new installer and uninstaller PowerShell scripts that handle the WiX
"burn" bootstrapper, a winget input manifest, an app entry in
outputs/apps.json, and a detailed outputs/vc-redist-x64/windows.json
with version metadata (14.51.36231.0), installer URL, SHA256 and
embedded script refs. The uninstall script targets the bundle
ProductCode (falls back to the Package Cache) and normalizes /uninstall,
/quiet and /norestart handling; the install script runs the bootstrapper
with /quiet /norestart and treats reboot codes (3010, 1641) as success.
- Move "Re-enrolling" to troubleshooting because I think that's the best
spot we have for it. I don't think we want it in the top of the "AB"
section because we link to this section from "Add AB" UI and we want to
steps to add AB to be easy to find:
<img width="795" height="431" alt="Screenshot 2026-06-04 at 5 57 12 PM"
src="https://github.com/user-attachments/assets/8b691577-bc20-4b6d-92a8-7b5655fc4ebf"
/>
- Also did some other language cleanup
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated BBEdit macOS to version 16.0.1
* Updated Figma Windows to version 126.5.6
* Updated WhatsApp macOS to version 26.22.26
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#45178
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually. _Note: Only windows
and Mac OS. Android required by someone with a device._
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved MDM profile applicability on Android, Windows, and Apple to
handle combined include-all, include-any, and exclude-any label rules,
yielding more accurate install/remove decisions.
* **Tests**
* Added cross-platform tests covering combined include/exclude label
scenarios to verify correct profile selection, installation, and removal
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This pull request introduces support for managing Node.js as a
maintained Windows app in the system. It adds Node.js metadata,
versioning, install/uninstall scripts, and a custom SVG icon for the
frontend. The Windows workflow is updated to detect Node.js changes and
ensure any pre-installed Node.js is removed before installing the
managed version.
**Node.js app support:**
* Added `nodejs/windows` to the maintained apps with metadata
(`ee/maintained-apps/inputs/winget/nodejs.json`,
[[1]](diffhunk://#diff-07f6dd0fa793aa5ad8e559c540e6f85df3f3ef15f3c7582462441b85f84fb244R1-R10)
and output definitions
(`ee/maintained-apps/outputs/nodejs/windows.json`,
[[2]](diffhunk://#diff-da3a5f86c5330f52227f66bf34701870ff49b5a00651f89366b092c10c5d717fR1-R22)
including version, installer URL, and install/uninstall scripts.
* Updated `apps.json` to include Node.js as a Windows app with
description and identifiers (`ee/maintained-apps/outputs/apps.json`,
[ee/maintained-apps/outputs/apps.jsonR1698-R1704](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1698-R1704)).
**CI/CD workflow enhancements:**
* Modified `.github/workflows/test-fma-windows-pr-only.yml` to detect
Node.js changes in PRs, output `has_nodejs` flags, and remove
pre-installed Node.js before managed installation
(`.github/workflows/test-fma-windows-pr-only.yml`,
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR101)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR114)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR145-R152)
[[4]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR340-R407).
**Frontend improvements:**
* Added a custom Node.js SVG icon component
(`frontend/pages/SoftwarePage/components/icons/Nodejs.tsx`,
[frontend/pages/SoftwarePage/components/icons/Nodejs.tsxR1-R14](diffhunk://#diff-5c0b7f670e49e55467eb93b875eae2c00f83eee90e5b7b61eafab363df95165eR1-R14)).
* Registered the Node.js icon in the software icon map for display in
the UI (`frontend/pages/SoftwarePage/components/icons/index.ts`,
[[1]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR49)
[[2]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR486).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## New Features
* Added Node.js support for Windows platform with automated detection
and management capabilities
* Node.js is now displayed with a dedicated icon in the application
interface
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46912
<!-- Summary of what was resolved -->
- Webhook/ticket checkbox is now disabled (locked, no explanation) for
**Maintainers** in `PolicyAutomationsFields` — covers the create modal,
edit form, and manage automations modal since all three share the
component. (Any role below maintainer can't edit automations.)
- Automations cell pencil icon and `cursor: pointer` are now hidden for
roles that can't open the automations modal (technician and below).
- Config and team data are now fetched for all authenticated roles so
the webhook automation shows correctly in the table for technicians
(previously gated on `canAddOrDeletePolicies`, which excluded them).
## Testing
- [x] QA'd all new/changed functionality manually
#### Before
With a global/fleet technician user, Automations cell on Policies page
showed "2 automations" when there were actually 3 automations
configured.
Also, the pencil (edit) icon and cursor pointer are shown even though
technicians can't access the Manage automations modal.
https://github.com/user-attachments/assets/276f11f2-4d5c-46ed-80c8-cc5172fab62b
Maintainers can manage automations but they can't configure webhooks or
tickets (product requirement + also forbidden by BE). This silently
failed when checking the "Send webhook" checkbox when creating or
editing.
https://github.com/user-attachments/assets/482e546a-5cd6-4c7d-a74a-362e54b7ee09
#### After
Technicians see all available automations on the Policies page (and this
matches the Details page).
Also, the edit icon is no longer shown, and the Automations cell is no
longer clickable.
https://github.com/user-attachments/assets/21848ad8-42aa-4fe1-87f3-9c0d873c9d10
Locked "Send webhook" / "Create ticket" for Maintainers.
https://github.com/user-attachments/assets/f0c0b058-db02-4174-bb8e-33165014806f
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features / Improvements**
* Users without policy modification permissions can now access and view
the policies page.
* Automations column displays read-only state for users without edit
permissions.
* Non-global admin users can view webhook/ticket automations but see
them as locked and uneditable.
* Enhanced visual feedback distinguishing read-only elements from
interactive ones.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#4890
* Optimized listing labels query by refactoring correlated subquery.
* Optimized aggregate that counts host's labels to executed once, and
skip the join to hosts entirely when the team filter allows all hosts.
Adds a `macos_applications` boolean query parameter to the list host
software endpoint (`GET /api/_version_/fleet/hosts/{id}/software`). When
true, results are restricted to apps installed at the top level of the
macOS /Applications folder, hiding helper apps, system apps,
command-line tools, and user-local apps. The filter applies only to
macOS hosts and is ignored on other platforms.
The filter is applied by pruning the in-memory software maps in
ListHostSoftware down to the title IDs that have a top-level
`/Applications` bundle, so the count and paginated queries stay
consistent and the filter applies uniformly across regular, VPP, and
in-house apps. Top-level is determined from
`host_software_installed_paths` via
`installed_path LIKE '/Applications/%' AND NOT LIKE '/Applications/%/%'
on source 'apps'`.
**Related issue:** Resolves#39017
Introduce MindManager to the maintained apps set: add a Homebrew input
(mindmanager.json), register the app in
ee/maintained-apps/outputs/apps.json, and provide a darwin versions file
for v25.2.105 including installer URL, sha256, and install/uninstall
script refs. Also add a frontend SVG icon component, wire it into the
icon map, and include the 2x PNG asset. These changes enable the app to
be detected, installed/uninstalled, and displayed in the UI.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
for #44846
for #43458
- UPDATE: @noahtalerman: For the following story:
- https://github.com/fleetdm/fleet/issues/44846
---
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added a new Agent column on the Hosts page displaying Orbit version
with tooltips showing Osquery, Orbit, and Fleet Desktop versions for
comprehensive version visibility.
* **Improvements**
* Updated default column visibility on the Hosts page—Issues and Private
IP columns are now hidden by default for a cleaner view.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Scott Gress <scott@fleetdm.com>
- misfeature — rule enabled, waived only for the 6 Windows shell: cmd
workflows (catches any future misuse elsewhere).
- excessive-permissions and artipacked — fixed and fully enforced
(removed from gate).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved CI/CD security by disabling credential persistence across
many workflows.
* Tightened workflow permissions to least-privilege for selected build
and analysis jobs.
* Made runner hardening and credential handling explicit in several
deployment and test workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Allen Houchins
