<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48217
This does update a couple of places, but I checked and it should only be
for Status indicators.
Figma spec with 4px rather than 8px:
https://www.figma.com/design/gxvU745LfOdkE9AuRg64wi/%F0%9F%A7%A9-Product-design-system?node-id=858-23&t=QwTqGmpK0V3inArL-0
<img width="1119" height="407" alt="image"
src="https://github.com/user-attachments/assets/8cae52d6-dbb9-4b8d-80d6-1a899790ad82"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Reduced the spacing between icons and text for a more compact,
consistent layout across the product.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated AWS CLI for Windows to version 2.36.11.
* Updated Windsurf for macOS to version 3.6.22.
* Updated Gitify for macOS to version 7.2.0.
* Updated GoLand for Windows to the 2026.2 release.
* Updated Linear for macOS to version 1.32.0.
* Updated Rancher Desktop for macOS to version 1.24.0.
* Refreshed installer links and verification data for each release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A
# Checklist for submitter
This PR adds one markdown file under `articles/` (a customer case study)
— no product code, so most of the template below doesn't apply.
## What changed
Adds `articles/hawx.md`, a case study on Hawx Pest Control.
**The story:** Hawx is a technology-first pest control company whose
field technicians can't be dispatched without a provisioned phone.
Hiring ramps up hard every summer, so onboarding and offboarding run
constantly. With Jamf, phones sat on the MDM screen until the technician
logged in, nobody remembered their credentials, and the helpdesk got
flooded from personal phones every season. Identifying which device
belonged to which technician took 5 to 10 minutes per call, 5 to 10
calls a day. Hawx now drives Fleet entirely through the API, paired with
Tines and Okta, so a device lands in the right fleet with the correct
profiles, policies, and apps the moment the technician verifies their
identity. Offboarding wipes or locks based on role. Migration took a
month.
**Source:** the 2026-07-20 customer interview with Loren Farr, IT
Manager at Hawx. Loren confirmed on the call that Fleet may use the
company name and his name and title, and was told nothing publishes
without his approval.
**Format:** drafted against the proposed `fleet-case-study-formatting`
skill in #49917 and the `content-style` skill:
- Three-act narrative (the challenge → why Fleet → the solution → the
results), headings in sentence case.
- Four `attribution-quote` divs spaced through the narrative rather than
clustered.
- A `checklist` div for the headline results.
- Full endmatter including the build-enforced `summaryChallenge` /
`summarySolution` / `summaryKeyResults` (semicolon-separated) plus the
company and hero-quote tags.
- "About Hawx" lives in `companyInfo` / `companyInfoLineTwo` rather than
the body, matching every published case study.
## Why
Hawx is a strong story in a segment Fleet's published case studies don't
yet cover: iOS-only, a small IT team (3 people, ~500 devices), a
seasonal workforce, and an API-only usage pattern where the customer
never touches the Fleet UI. It's also a clean Jamf migration narrative
with a quantified helpdesk result.
## ⚠️ Blockers before this can be published
This is a **draft PR on purpose**. Two items must be resolved first:
1. **The quotes are not verbatim yet.** The interview record is bullet
notes, not a transcript, so the four quotes are faithful reconstructions
of what Loren described, not transcribed speech. The case-study skill's
rule is that quotes are verbatim and never reconstructed. **Loren needs
to approve these as his words before merge.** Reviewers should not treat
them as citable until he has.
2. **Both image assets are missing.** There is no Hawx logo and no Loren
Farr headshot in `website/assets/images/`. `companyLogoFilename` and
`quoteAuthorImageFilename` are deliberately stubbed with `TODO-`
prefixes so the website build fails loudly rather than shipping broken
image references. Real files are needed following the
`{descriptor}-{css-width}x{css-height}@2x.{ext}` convention.
## Open questions for reviewers
- **The "more than 90%" figure was dropped.** An earlier draft said
credentials were forgotten in more than 90% of cases. That number isn't
in the interview notes (the notes say "nobody knew their username or
password"), so it's omitted. If Loren sourced it, it can go back in.
- **The warehoused-device problem is omitted.** The notes describe
devices offline more than 30 days needing a reset, currently a 30-minute
call, listed as a *current* problem. That would fit a "Looking ahead"
section if Fleet is the plan for it, but it doesn't belong in results as
an achieved outcome.
- **Hero quote choice.** `quoteContent` uses the "slam dunk ... control
over the phone itself" quote because it names the differentiator.
Loren's closer, "As long as you're not shy about getting into the code,
this is a fantastic platform," is arguably the more trustworthy line for
Fleet's audience. Easy swap if marketing prefers it.
- **Follow-up, not in this PR:** the pull quote could be added to
`handbook/company/testimonials.yml` for the `/customers` carousel. Left
alone since that file is curated by marketing.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`. — N/A, website content
only, not a product change
## Testing
- [ ] Added/updated automated tests — N/A, markdown content only
- [x] QA'd manually: cross-checked the structure, custom div syntax, and
required meta tags against the published case studies
(`articles/fastly.md`, `articles/primo.md`) and against the validation
logic in `website/scripts/build-static-content.js`; confirmed
`summaryKeyResults` is semicolon-separated; confirmed `articleTitle`
matches the H1 exactly; grepped `website/assets/images/` and confirmed
both referenced image files are absent (hence the `TODO-` stubs).
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
**Related issue:** NA
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
---
Updates the leave-behind deck with revisions from design review:
* Updated headings on slide 2 to address pain sooner
* Moved "The world has evolved rapidly" heading to slide 3
* Incorporated platform icons into illustration graphic
**Related issue:** Related to fleetdm/confidential#16762 (not a full
close — see Notes)
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
## Summary
Redesigns fleetdm.com/support:
- Merges the previous "Ask the community" and "Support" sections into
one unified "How can we help?" section with a single 6-card grid
- Adds a new "Professional support" card linking to the SLA section of
the go-to-market-operations handbook page
- Adds a customer testimonial
- Consolidates responsive breakpoints (single-column switch and card
centering now both happen at 991px)
- Removes target="_blank" from the two cards linking to fleetdm.com
itself (Professional support, Ask us anything).
## Related
- fleetdm/confidential#16762
## Notes
This is a first iteration toward the broader vision in
https://github.com/fleetdm/confidential/issues/16762, discussed in
design review but intentionally deferred.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Redesigned the Support page header into a single “How can we help?”
entry point.
* Added a Professional Support card linking to service-level agreement
details.
* Introduced a customer quote section with author information.
* **Improvements**
* Refreshed support card design (cleaner layout, consistent spacing,
updated typography and link hover behavior).
* **Responsive**
* Improved the support card layout across breakpoints, including
3-column to 2-column to single-column grid behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
Run: https://github.com/fleetdm/fleet/actions/runs/30451947297.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security**
* Added an OpenVEX document for **CVE-2026-56852**.
* Documented that the vulnerability is **not affected** for the
**fleetctl** product under the specified conditions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated Krita for Windows to version 5.3.3.0.
- Updated Loom for macOS and Windows to version 0.365.0.
- Updated Vivaldi for Windows to version 8.1.4087.61.
- Refreshed installer links and verification data to support reliable
installation and version detection.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated managed Zed app installers for macOS and Windows to version
1.13.1.
* Updated download links and integrity checks to match the new release.
* Improved version detection so outdated installations are correctly
identified.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Changes:
- Updated deliver-talk-to-us-form-submission to return a different
Salesforce user ID if territory information could not be found.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the fallback “Talk to us” form submission contact-routing
behavior when territory information is unavailable or returns an
unexpected value, including changes to the default Calendly meeting link
and related warning messaging.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
https://github.com/fleetdm/confidential/issues/16947
Changes:
- Updated the get-territory-user-id helper to accept `website` and
`numberOfEmployees` inputs
- Updated the deliver-talk-to-us-form-submission action to send website
and number of employees to the get-territory-user-id helper, and updated
the `bookingUrlByUserId` dictionary.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved territory routing for “Talk to us” submissions by using
employee count, city, and website details.
* Updated routing logic to direct submissions to the appropriate
Calendly booking link.
* Preserved existing validation and error handling for incomplete or
unexpected territory lookup results.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds the risk scoring rubric and mitigation/approval requirements to
Fleet's risk management policy in the handbook.
## What changed
Two new sections in `handbook/it/security.md`, between the risk
management policy and the existing risk corrective action timelines:
**Risk scoring rubric** — documents how risks in the risk register are
scored:
- Likelihood scale (1 Very unlikely → 5 Very likely)
- Impact scale (1 Very low impact → 5 Very high impact)
- Risk score = `likelihood × impact`, with level bands Low (1–6), Medium
(7–19), High (20–25)
- The full 5×5 matrix of every likelihood/impact combination
The matrix is built as a native markdown table rather than an embedded
screenshot, and each cell states its risk level in text ("20 (High)")
instead of relying on color alone, so it renders on fleetdm.com, stays
diffable, and is readable without color.
**Risk mitigation and approval** — documents when a risk requires
mitigation and who must approve accepting it instead:
- Low and Medium: mitigation not required (best effort, within the
corrective action timeline), no approval needed to accept
- High: mitigation required via a documented treatment plan, and
accepting it instead requires Head of Security and CIO approval
- Accepting a high risk needs a business justification, compensating
controls, and an expiration date no longer than one year, reviewed on or
before expiry
- Missing the corrective action timeline is treated as an accepted risk
and needs the same approval
- Rescoring a risk down requires the same approval as accepting it at
its original level
## Why
The rubric was previously only documented in our risk register tool, and
the policy didn't say what triggers mitigation or whose approval is
needed to accept a risk. Both are now in the handbook alongside the
corrective action timelines they interact with.
## Notes for reviewers
- The level bands are derived from the existing rubric's color
boundaries: Low tops out at 6, Medium covers 8–16, High starts at 20.
The band ranges are written as 1–6 / 7–19 / 20–25 to cover the gaps that
`likelihood × impact` can't produce.
- Only high risks gate on approval. Medium risks are treated the same as
low ones: mitigate on a best-effort basis within the existing 120-day
corrective action timeline, no approval required to accept. Approval
authorities follow the pattern already used elsewhere in this handbook
page (policy exceptions require Head of Security and CEO approval), with
the CIO as the second approver for high risks.
- The pre-existing "Acceptable Risk Levels" section is left as-is. It
says risks that are either low impact or low probability are generally
acceptable, which the rubric mostly agrees with, with the exception of
very high impact × unlikely (score 10, Medium). Happy to fold that
section into the rubric in a follow-up if reviewers prefer one source of
truth.
# Checklist for submitter
- [x] Handbook-only change. No code, tests, migrations, configuration
settings, or fleetd changes.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated maintained app releases for macOS and Windows, including
Adlock, Another Redis Desktop Manager, BetterTouchTool, BoltAI,
CodexBar, Egnyte, Firefox Developer Edition, Mimestream, Superwhisper,
and TeamViewer.
* Updated installation downloads and version detection for each new
release.
* Refreshed package integrity checks to support the latest installers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Add two new UI routes for Android host vitals tooltips
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #49791
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added convenient links for learning more about device security posture
and software update status.
* These links redirect to the relevant Google Android Management API
reference documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated maintained app releases for Gitify, JetBrains Toolbox,
Microsoft 365 Copilot, Spokenly, Tower, and Vivaldi.
* Refreshed installer links and verification checksums for the latest
versions across macOS and Windows.
* **Bug Fixes**
* Updated Pastebot’s macOS uninstall process to remove the app and
related user files while avoiding removal of additional system paths.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Resolves#50058 where links do not show the expected text in the table
description
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated disk space table documentation to improve cross-referenced
links for Windows logical drives and Linux mounts by adjusting Markdown
formatting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Query responses now include pack details only when the requester has
permission to view them.
* Prevented pack metadata from being disclosed across fleets when query
names overlap.
* Corrected target selection labels and empty-state messaging for
fleet-based targets.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixed spelling on LinkedIn posting.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for the latest versions of AnyBurn, BetterZip, Canva,
Eclipse Temurin, ExifCleaner, Gemini, LibreOffice, NordVPN, Postman,
TablePlus, Tailscale, and other maintained applications across Windows
and macOS.
* **Bug Fixes**
* Improved macOS uninstall cleanup for numerous applications by removing
additional caches, preferences, recent-document entries, containers,
support files, and related data.
* Updated installer downloads and verification checks to match the
latest releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
The gitops-auto-complete uses `replace github.com/fleetdm/fleet/v4 =>
../..` which means it is frequently broken whenever fleet updates shared
libraries.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added automated build and dependency verification for the GitOps
auto-complete tool.
* Updated workflow triggers so changes to the tool are checked
automatically.
* Refreshed supporting service dependencies used by the tool.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49811
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed Fleet-maintained app updates when a rebuilt installer keeps the
same version.
* Rebuilt installers now update their files, hashes, filenames, and
install scripts correctly.
* Prevented installers from being incorrectly skipped when their
contents differ despite matching versions.
* **Tests**
* Added coverage for same-version installer rebuilds and team-specific
caching behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40074 unreleased bug
<img width="539" height="141" alt="image"
src="https://github.com/user-attachments/assets/1ac8e2c2-236d-4567-a200-0eb35cce46e7"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved configuration profile validation for unescaped special
characters in Apple payloads.
* Error messages now consistently indicate when characters like `&` and
`<` must be XML-escaped.
* Updated error examples to show properly escaped guidance.
* Expanded test coverage to verify the standardized XML-escaping error
for additional failing scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [X] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security Improvements**
* Updated device-authenticated policy and host-detail responses to omit
policy author identity fields and any raw SQL/query data.
* Device policy endpoints now return a device-safe policy representation
consistently.
* **Bug Fixes**
* Prevented administrative policy information from appearing in
device-authenticated host details and policy listings.
* **Tests**
* Strengthened integration coverage to verify device-safe responses
(required user-facing fields present; sensitive fields absent).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#50122
<img width="730" height="148" alt="image"
src="https://github.com/user-attachments/assets/e7a803bd-b50d-404f-8af2-9fa32cc34772"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. (Unreleased bug)
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Account provisioning settings now indicate when the feature is
included with Fleet Premium.
- Premium-tier accounts continue to see the full provisioning
configuration and save controls.
- **Bug Fixes**
- Improved license-tier handling so account provisioning displays the
appropriate experience for free and premium plans.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49421
Custom host vitals (`$FLEET_HOST_VITAL_<id>`) already worked in scripts
and Apple/Windows configuration profiles, but Android configuration
profiles and managed app configuration explicitly rejected them at
upload to keep parity with `$FLEET_SECRET_*`. This left admins unable to
inject per-host vitals (e.g. an asset tag) into Android MDM
configuration the same way they can for every other platform.
For more context, prior PRs:
- https://github.com/fleetdm/fleet/pull/49334
- https://github.com/fleetdm/fleet/pull/49586
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
- Created an "Asset tag" host vital.
- Enrolled an Android device.
- Initially the test profile showed as "Failed" because no value was set
for the vital.
- Set a value for the vital, saw that it went from Enforcing to
Verified.
<img width="1446" height="510" alt="Screenshot 2026-07-24 at 8 57 46 AM"
src="https://github.com/user-attachments/assets/c0e2348c-e521-48f3-85cd-6f884689b2cd"
/>
<img width="1520" height="936" alt="Screenshot 2026-07-24 at 8 56 56 AM"
src="https://github.com/user-attachments/assets/169b9545-ec7a-429b-8f45-0e2740f61c77"
/>
<img width="1607" height="1136" alt="Screenshot 2026-07-24 at 8 57
30 AM"
src="https://github.com/user-attachments/assets/a8213745-b224-4a36-a54d-32152a15c377"
/>
Also tested the rejection cases:
- trying to upload a profile with an invalid custom host vital id
(either a non-numeric value, a numeric but non-existent ID, and
referencing a vital as a JSON key instead of a value)
- deleting a vital referenced in a profile
https://github.com/user-attachments/assets/e8b4acde-ddf4-41c0-b00a-5ab4945d0bc2
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Android app configurations and profiles now support custom host vital
placeholders (`$FLEET_HOST_VITAL_<id>`).
* Custom host vital values are expanded per device during Android
delivery.
* Managed Android profiles/configurations are automatically resent when
a referenced vital value changes.
* **Bug Fixes**
* Added validation for malformed, missing, or undefined vital references
during Android app association and profile/config uploads.
* Prevented deletion of vitals referenced by Android profiles.
* Improved error handling and delivery failure details when a device
lacks a required vital value.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48965
## Description
Fleet was escrowing a macOS disk encryption key — and logging an
"escrowed a disk encryption key" activity — for hosts that aren't
enrolled in Fleet's MDM (e.g. still managed by Jamf, or with a leftover
`/var/db/FileVaultPRK.dat`). Because Fleet never installed its FileVault
escrow profile on such a host, the stored key is unusable: the cron
marks it `decryptable = 0` and `GET /hosts/:id/encryption_key` returns
422, so "Show disk encryption key" never appears. The result is a
misleading activity and a dead key row.
Root cause: the macOS key ingestion
(`directIngestDiskEncryptionKeyFileDarwin` and its `file_lines`
fallback) gated only on the disk being encrypted and disk encryption
being enabled for the host's team — it never checked Fleet MDM
enrollment. The Windows/orbit key path (`SetOrUpdateDiskEncryptionKey`)
already performs this check.
- **`server/service/osquery_utils/queries.go`** — added an
`IsHostConnectedToFleetMDM` guard to both macOS ingestion functions,
skipping archival (no key stored, no activity) when the host isn't
connected to Fleet MDM. Mirrors the existing Windows path.
Prevention only — this stops new bad escrows; it does not delete keys
previously escrowed for non-enrolled hosts.
## Testing
- **Unit** (`queries_test.go`): added a "host not connected to Fleet
MDM" case asserting neither ingestion function escrows when the host
isn't Fleet-MDM-connected, and initialized the
`IsHostConnectedToFleetMDM` mock so existing cases still pass.
- **Integration** (`integration_mdm_test.go`):
`TestMDMAppleHostDiskEncryptionWithDisabledEncryptionSetting` was
creating an orbit-only host (no Fleet MDM) and expecting escrow to
succeed — i.e. relied on the bug. Switched it to a Fleet-MDM-enrolled
host (`createHostThenEnrollMDM`), which is now required for escrow.
Passes.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually <!-- covered by
automated integration test; live no-device repro is impractical, flagged
for reviewer -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- FileVault recovery keys are now archived/escrowed only for macOS hosts
that are connected to Fleet MDM.
- Hosts without an active Fleet MDM connection no longer attempt to
archive encryption keys.
- Disk-encryption key archival now cleanly reports MDM connectivity
errors when checks fail.
- **Tests**
- Added/updated coverage to verify both connected and disconnected host
scenarios, including ensuring no archival occurs when MDM is not
connected.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Updates the article to improve the instructions for deploying
CrowdStrike using the .exe.
Moves the exe part to a separate section, and includes the
install/uninstall script.
- Closes#49397
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **Rtools** as a Windows Fleet-maintained app. One of the 11 apps
split out of #48501 that failed the FMA validator; #50016 shipped the 6
that passed.
## Why it was failing
The install script hit the validator's 10-minute `executeScript` cap
exactly:
```
20:41:22 INFO msg="Executing install script..." app=Rtools
20:51:22 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later
20:51:22 WARN msg="failed to remove rtools45-6768-6492.exe: ... Access is denied."
```
The locked installer in the temp dir shows a process was still alive.
`Start-Process -Wait` waits for the process *and all of its
descendants*, which is the same root cause as the other install-timeout
apps in this batch.
Rtools is also the one app in the batch where a **slow unpack** is a
plausible second cause — the installer is ~460 MB and expands a full
toolchain. So rather than assume, the script now waits on the installer
process alone with a 480s cap (under the caller's 10-minute budget) and
logs elapsed time plus Add/Remove Programs registration state on every
poll. If the cap is reached:
- **registered** → the install finished and only a lingering child
remains, so it stops that process and succeeds;
- **not registered** → the unpack genuinely didn't finish, and it fails
with that stated explicitly.
Either way the CI log now says which one happened instead of just timing
out.
## Notes
- **Identity verified against the installer**, not winget metadata. The
setup stub's PE version resource reads `CompanyName: The R Foundation`,
`ProductName: Rtools`. Inno derives `VersionInfoCompany` from
`AppPublisher`, so the ARP publisher is `The R Foundation` — which is
what the exists query uses.
- **Versioned ARP name.** The registry `DisplayName` is `Rtools 4.5
(6768-6492)`, so the input uses `fuzzy_match_name` and the exists query
is `name LIKE 'Rtools %'`.
- Installs to `C:\rtools45`, not Program Files, so the validator's "no
changes detected in `C:\Program Files`" line is an expected warning, not
a failure.
- Ships a new catalog icon and website asset.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30384196159](https://github.com/fleetdm/fleet/actions/runs/30384196159)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries checked against the installer's PE
version resource, `apps.json` is valid JSON with a description filled
in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Rtools as a supported Windows application.
* Added installation and uninstallation support with silent setup and
silent removal.
* Added Rtools version metadata, installer verification, and Developer
tools categorization.
* Added a dedicated Rtools icon for software listings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **Google Earth Pro** as a Windows Fleet-maintained app (a Windows
counterpart to the existing `google-earth-pro/darwin` FMA). One of the
11 apps split out of #48501 that failed the FMA validator; #50016
shipped the 6 that passed.
## Why it was failing
Install and detection were already fine on the SYSTEM-context Windows
runner — osquery found `Google Earth Pro` 7.3.7.1155. **Uninstall** was
the failure:
```
INFO msg="Executing uninstall script for app..." app="Google Earth Pro"
INFO msg="Found app: 'Google Earth Pro' at , Version: 7.3.7.1155"
ERROR msg="App still present after uninstall (expected no match for version '7.3.7.1155' in programs)"
```
The EXE wraps a WiX MSI, so the ARP `UninstallString` is `MsiExec.exe
/X{ProductCode}` — with **no quiet switch**. The old script ran that
string verbatim, which raises a confirmation dialog in session 0 where
nothing can click it, so the uninstall silently no-ops.
The uninstall script now resolves the MSI product code (from the
`UninstallString`, falling back to the registry key name) and runs
`msiexec /x <code> /quiet /norestart` with a bounded 5-minute wait, then
drains child `msiexec` processes. `3010`/`1641` are treated as success.
## Notes
- **Identity verified against the real installer**, not winget metadata.
The installer's embedded MSI Property table reads: `ProductName` =
`Google Earth Pro`, `Manufacturer` = `Google`, `ProductVersion` =
`7.3.7.1155`, `ALLUSERS` = `1`, `ProductCode` =
`{E3B69BB6-FFD8-441C-933E-BB8A3136ED8F}`. No `ARPSYSTEMCOMPONENT`, so it
is not a bootstrapper. That confirms `unique_identifier` = `Google Earth
Pro` and the exists-query publisher `Google` (not "Google LLC").
- Installs to `C:\Program Files (x86)`, so the validator's "no changes
detected in `C:\Program Files`" line is an expected warning, not a
failure.
- Reuses the existing `google earth pro` catalog icon — no new icon
needed.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30383934805](https://github.com/fleetdm/fleet/actions/runs/30383934805)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries checked against the MSI Property table,
`apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Google Earth Pro for Windows to the maintained app catalog.
* Added maintained-apps install and uninstall support for Google Earth
Pro (version 7.3.7.1155).
* Included automated download integrity verification and detection logic
for installed/updated versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **Logitech Unifying Software** as a Windows Fleet-maintained app.
One of the 11 apps split out of #48501 that failed the FMA validator;
#50016 shipped the 6 that passed.
## Why it was failing
Install and detection were already fine on the SYSTEM-context Windows
runner — osquery found `Logitech Unifying Software 2.52` at `C:\Program
Files\Common Files\LogiShrd\Unifying`. **Uninstall** was the failure:
```
20:40:55 INFO msg="Executing uninstall script for app..."
20:40:57 INFO msg="Found app: 'Logitech Unifying Software 2.52' ... Version: 2.52.33"
20:40:57 ERROR msg="App still present after uninstall (expected no match for version '2.52.33' in programs)"
```
Two seconds start to finish — the uninstaller hadn't actually done
anything yet. This is standard NSIS behavior: the uninstaller copies
itself to `%TEMP%` and relaunches, so the process the script starts
exits almost immediately while the real work happens in a detached
child.
The fix passes NSIS's `_?=<dir>` switch, which runs the uninstaller in
place instead of relaunching, making it synchronous. It has to be the
last argument and unquoted, so the script builds a single argument
string rather than an array (PowerShell would quote an element
containing spaces). A bounded poll on the ARP key follows as a backstop,
and the script fails explicitly if the entry is still there.
## Notes
- **Versioned ARP name.** The registry `DisplayName` is `Logitech
Unifying Software 2.52`, so the input uses `fuzzy_match_name` and the
exists query is `name LIKE 'Logitech Unifying Software %'`. The
uninstall script matches the same prefix rather than an exact string.
- Publisher `Logitech` confirmed against the winget locale manifest.
- Installs under `C:\Program Files\Common Files`, so the validator's "no
changes detected in `C:\Program Files`" line is an expected warning, not
a failure.
- Ships a new catalog icon and website asset.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30384010810](https://github.com/fleetdm/fleet/actions/runs/30384010810)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries reviewed for name + publisher
correctness, `apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Logitech Unifying Software to the Windows software catalog,
including the version 2.52.33 download, checksum, and install-detection
metadata.
* Implemented silent installation and a robust, registry-aware uninstall
flow (with process lock handling and timeout behavior).
* Added a dedicated Logitech Unifying Software icon to the software page
UI.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **GNU Privacy Guard** as a Windows Fleet-maintained app. One of the
11 apps split out of #48501 that failed the FMA validator; #50016
shipped the 6 that passed.
## Why it was failing
The install itself worked — the validator logged `New application
detected at: C:\Program Files\GnuPG`. The *script* never returned:
```
20:18:36 INFO msg="Executing install script..." app="GNU Privacy Guard"
20:28:36 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later
20:28:36 INFO msg="New application detected at: C:\Program Files\GnuPG"
```
Ten minutes on the nose is the validator's `executeScript` timeout. The
cause is a PowerShell detail rather than anything wrong with the
installer: **`Start-Process -Wait` waits for the process *and all of its
descendants***. GnuPG's installer starts `gpg-agent`, `dirmngr`,
`keyboxd` and `scdaemon` and leaves them resident, so `-Wait` never
returns. The same run left the installer `.exe` locked in the
validator's temp dir, which is the other tell that a child process was
still alive.
The install script now follows the pattern already established by
[`ollama_install.ps1`](ee/maintained-apps/inputs/winget/scripts/ollama_install.ps1):
start with `-PassThru` (no `-Wait`), wait on the installer process alone
with a 7-minute cap (below the caller's 10-minute script budget), poll
for the Add/Remove Programs entry so a fast-returning installer can't be
mistaken for a finished one, then stop the daemons.
Stopping the daemons also fixes the uninstall, which would otherwise
fail on files those processes hold open. The uninstall script stops them
up front, uses NSIS's `_?=<dir>` switch so the uninstaller runs in place
instead of relaunching itself detached from `%TEMP%`, and polls the ARP
key to confirm removal.
## Notes
- Clean ARP `DisplayName` (`GNU Privacy Guard`), so exact name matching
— no `fuzzy_match_name` needed. Publisher `The GnuPG Project`.
- Ships a new catalog icon and website asset.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30384069714](https://github.com/fleetdm/fleet/actions/runs/30384069714)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries reviewed for name + publisher
correctness, `apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added GNU Privacy Guard as a supported Windows application in the
maintained apps catalog.
* Added install/upgrade detection and uninstall support for Windows.
* Added GNU Privacy Guard to the software catalog (Security category).
* Added a dedicated GNU Privacy Guard icon to the software interface for
proper name-based display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **Azure Data Studio** as a Windows Fleet-maintained app. One of the
11 apps split out of #48501 that failed the FMA validator; #50016
shipped the 6 that passed.
## Why it was failing
The install itself worked — the validator logged `New application
detected at: C:\Program Files\Azure Data Studio`. The *script* never
returned:
```
20:08:19 INFO msg="Executing install script..." app="Azure Data Studio"
20:18:19 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later
20:18:19 INFO msg="New application detected at: C:\Program Files\Azure Data Studio"
```
Ten minutes on the nose is the validator's `executeScript` timeout.
Azure Data Studio is a Visual Studio Code fork and ships the same Inno
Setup script — including the **`runcode` task, which launches the app
when the install finishes**. Because `Start-Process -Wait` waits for the
process *and all of its descendants*, the launched app kept the script
blocked forever.
The fix is the switch VS Code's own FMA already uses:
`/MERGETASKS=!runcode` (see
[`vscode_install.ps1`](ee/maintained-apps/inputs/winget/scripts/vscode_install.ps1)
and
[`vscodium_install.ps1`](ee/maintained-apps/inputs/winget/scripts/vscodium_install.ps1),
both of which pass validation). The script also waits on the installer
process alone rather than its descendants, polls for the Add/Remove
Programs entry, and stops a stray `azuredatastudio` process as a
backstop in case a future build ignores the task suppression.
## Notes
- Machine-scope x64 installer, per the winget manifest — Azure Data
Studio publishes both user and machine scope, and Fleet installs run as
SYSTEM, so machine scope is required.
- Clean ARP `DisplayName` (`Azure Data Studio`), so exact name matching.
Publisher `Microsoft Corporation`.
- Uninstall is unchanged: the Inno uninstaller doesn't leave anything
resident, and `-Wait` waiting on descendants is the desired behavior
there (Inno relaunches itself from `%TEMP%`).
- Ships a new catalog icon and website asset.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30384162280](https://github.com/fleetdm/fleet/actions/runs/30384162280)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries reviewed for name + publisher
correctness, `apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Azure Data Studio to the available Windows software catalog.
* Added support for installing and uninstalling Azure Data Studio
(version 1.52.0) via silent installer and uninstaller flows with
completion detection.
* Added an Azure Data Studio icon to the software interface for better
visual identification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for numerous current macOS and Windows application
releases, including updated installers, download links, and integrity
checks.
* Improved uninstall cleanup for several applications by removing
additional services, launch items, recent-document entries, and
application data.
* **Bug Fixes**
* Corrected version detection thresholds so outdated installations are
accurately identified.
* Updated installer and uninstaller behavior for newer application
builds, including improved relaunch and cleanup handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A — found while removing the macOS Yubikey Manager
FMA (#50109)
Two Windows Fleet-maintained apps describe themselves as macOS software
in `ee/maintained-apps/outputs/apps.json`, because the entries were
copy-pasted from their macOS counterparts. This copy is customer-facing:
it shows in the Fleet UI's software catalog and on
`fleetdm.com/software-catalog/<slug>`.
- `proxyman/windows` — "Proxyman is a high-performance **macOS** app
that enables developers to view HTTP/HTTPS requests and responses." →
drops "macOS". (The `proxyman/darwin` description keeps it; it's
accurate there.)
- `wechat/windows` — name "**WeChat for Mac**" and "**WeChat for Mac**
is a free messaging and calling application." → "WeChat". The winget
input (`inputs/winget/wechat.json`) already declares `"name": "WeChat"`,
so this also makes `apps.json` agree with its own input. The
`wechat/darwin` entry keeps "WeChat for Mac", which is the actual macOS
product name.
Renaming the Windows entry needs a matching icon key.
`getMatchedSoftwareIcon` matches on the lowercased app name and requires
an exact match or a whole-word prefix (`matchLoosePrefixToKey`: `s ===
key || s.startsWith(key + " ")`), so the existing `"wechat for mac"` key
would **not** match a name of "WeChat" and the app would fall back to
the generic package icon. Added a `wechat: Wechat` key alongside it
(both point at the same component; the `"wechat for mac"` key stays for
macOS and for hosts reporting that name in inventory).
No server-side impact: `UpsertMaintainedApp` keys on `slug` and updates
`name` in place, and `ReconcileMaintainedAppSoftwareNames` only renames
`darwin` titles, so the Windows rename doesn't touch existing software
titles. Website icons resolve from the slug (`build-static-content.js`
builds `app-icon-<slug>-60x60@2x.png`), not the name, so
`app-icon-wechat-60x60@2x.png` is unaffected.
Descriptions here mirror upstream cask/winget copy, so these are minimal
factual corrections rather than a voice rewrite.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually:
- `apps.json` still parses; 1378 apps; verified the four
`proxyman`/`wechat` entries read as intended and the `darwin` ones are
untouched.
- Traced the icon lookup by hand: name "wechat" now hits the new
exact-match key; "wechat for mac" still hits the original.
- Swept every non-darwin entry in `apps.json` for macOS-only phrasing
(`Rosetta`, `macOS`, `Mac`, `Apple`) — these two were the only genuine
mismatches. `duo-desktop/windows` (lists macOS, Windows, and Linux) and
`imazing-profile-editor/windows` (edits Apple configuration profiles)
are correct as written.
Note: `node_modules` isn't installed in my working copy, so
ESLint/Prettier weren't run locally — the added line is a one-line map
entry matching the surrounding style. CI will confirm.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A — fixes the failing scheduled "Update
Fleet-maintained apps" workflow
The `yubico-yubikey-manager` cask was removed from homebrew-cask on
2026-07-28
([Homebrew/homebrew-cask@7ffabaa](https://github.com/Homebrew/homebrew-cask/commit/7ffabaad8fcc657dc90343844ad76a50bb60b945))
after being disabled on 2025-07-27 `because: :discontinued,
replacement_cask: "yubico-authenticator"` — Yubico discontinued
`yubikey-manager-qt` (the 1.2.5 installer this FMA pinned) in favor of
Yubico Authenticator. The brew API now returns 404 for the token, so the
maintained-apps ingester panics:
```
{"level":"INFO","msg":"ingesting homebrew app","name":"Yubikey Manager"}
panic: ingesting homebrew app: app not found in brew API
```
Freezing the app in #50054 did not resolve this: `fetchCask` runs before
the `frozen` flag is applied, so the ingester still fetches the cask and
fails on the 404. This is the follow-up that PR called out.
Removes Yubikey Manager as a **macOS** Fleet-maintained app, following
the same pattern as #50050 (Nocturnal), #46541 (Messenger), and #47420
(Dell Display Manager):
- `ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json` —
Homebrew input
- `ee/maintained-apps/outputs/yubico-yubikey-manager/darwin.json` —
macOS output data
- `ee/maintained-apps/outputs/apps.json` — the
`yubico-yubikey-manager/darwin` entry
- `website/config/routes.js` — the bare
`/software-catalog/yubico-yubikey-manager` redirect pointed at
`-darwin`, which would now 404; retargeted to `-windows`
The **Windows** FMA is unaffected and continues to update, so these are
deliberately kept:
- `ee/maintained-apps/inputs/winget/yubico-yubikey-manager.json` and its
install/uninstall scripts
- `ee/maintained-apps/outputs/yubico-yubikey-manager/windows.json`
- the `yubico-yubikey-manager/windows` entry in `apps.json`
- `frontend/pages/SoftwarePage/components/icons/YubikeyManager.tsx` and
its `"yubikey manager"` mapping in `index.ts`
- `website/assets/images/app-icon-yubico-yubikey-manager-60x60@2x.png`
Also drops "Requires Rosetta 2." from the Windows entry's description in
`apps.json`. Rosetta is macOS-only; the sentence was copy-pasted from
the macOS entry, and with macOS gone the Windows page is what
`/software-catalog/yubico-yubikey-manager` now resolves to. Descriptions
in `apps.json` are hand-maintained — `updateAppsListFile` in
`cmd/maintained-apps/main.go` only appends entries whose slug it doesn't
already find, so it won't overwrite the edit.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually:
- `go run ./cmd/maintained-apps -slug yubico-yubikey-manager/darwin`
exits 0 with no panic and writes no files (before this change, the same
run panicked on the brew 404).
- `apps.json` still parses and holds 1377 apps; the only remaining
`yubico-yubikey-manager` entry is `/windows`.
- Grepped the repo for `yubico-yubikey-manager`: remaining hits are the
winget input, its two script paths, the windows `apps.json` entry, and
the retargeted website redirect.
No automated tests added — this is a data-file removal with no new code
paths.
Relates #47832
Both the Host details and My device pages told the reader to log out or
restart when Fleet didn't have a Mac's FileVault key. That's wrong for
ADE-enrolled hosts: they escrow the key automatically, and the only
thing standing between the host and a cleared banner is the next vitals
refetch. It stays correct for manual enrollment, where Escrow Buddy only
generates a new key at next login.
dependabot[bot]
