<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #49149 Adds **Firefox Nightly** and **Firefox Developer Edition** as Fleet-maintained apps for macOS and Windows (4 new FMAs). Mozilla VPN (also requested in #49149) is not included, so this doesn't close the issue. ## What's included | App | macOS | Windows | |-----|-------|---------| | Firefox Nightly | Homebrew cask `firefox@nightly`, bundle ID `org.mozilla.nightly` | MSIX `Mozilla.Firefox.Nightly.MSIX` (no exe package exists in winget) | | Firefox Developer Edition | Homebrew cask `firefox@developer-edition`, bundle ID `org.mozilla.firefoxdeveloperedition` | NSIS exe `Mozilla.Firefox.DeveloperEdition`, machine scope, `/S` | All identity fields were verified against the real installers, not catalog metadata: bundle IDs read from the DMGs' `Info.plist`, MSIX identity ("Firefox Nightly" / publisher "Mozilla Corporation") read from the package's `AppxManifest.xml`, and DevEd's registry identity (`Firefox Developer Edition (x64 en-US)`, publisher `Mozilla`, versionless DisplayName) confirmed in Mozilla's NSIS installer source at the shipped release tags. The MSIX install/uninstall scripts follow the established Slack/Claude pattern (provision machine-wide + register for the logged-on user via scheduled task). ## Pre-release version handling (macOS) Mozilla's pre-release bundles report only the base version in `CFBundleShortVersionString` (`153.0` for cask version `153.0b13`), which would make the generated patch policy flag every up-to-date install as outdated. Instead, the patch policies for these two channels compare **`bundle_version`** (`CFBundleVersion` encodes the build date, e.g. `15326.7.15`), so individual pre-release builds are distinguishable: - **Nightly**: derived directly from the build timestamp embedded in the cask version (`154.0a1,2026-07-17-09-27-13` → `15426.7.17`). No external calls. - **Developer Edition**: build date resolved from Mozilla's [buildhub](https://buildhub.moz.tools) (indexed as product `firefox`, channel `aurora`). On buildhub failure the ingester logs a warning and falls back to a base-version comparison (cycle granularity) rather than failing the run; it self-corrects on the next scheduled ingestion. The macOS validator gets a matching exception accepting `base + "b"` versions for the DevEd bundle ID. Both computed values were verified against the actual DMGs' `Info.plist`. **Known limitation (Windows):** patch detection for Developer Edition on Windows is only accurate to the release cycle (153 vs 154), not between betas (b13 vs b14) — the registry `DisplayVersion` and winget's `PackageVersion` are both the base version (`151.0`) with no beta number, and osquery's `programs` table has nothing finer to compare. Nightly on Windows is day-granular since its MSIX package version encodes the build date. Documented in #49149. ## Other changes - Tightened `firefox_uninstall.ps1` (release channel FMA): its `*Firefox*` match would have uninstalled Developer Edition (or ESR) first depending on registry enumeration order. Now matches `Mozilla Firefox*` and excludes ESR; `firefox/windows` output regenerated. - Channel-specific icons generated from the real app bundles (frontend components + website PNGs), with map keys covering both catalog and inventory names. ## Why Firefox Beta is not included Beta (requested in #49149) was deliberately dropped: - On Windows, the Beta exe registers the same identity as release Firefox (`Mozilla Firefox (x64 en-US)`), making it indistinguishable in inventory. The only distinct package is `Mozilla.Firefox.Beta.MSIX`, which has no `en-US` winget locale manifest (only `en`), which the ingester requires. - On macOS, Beta shares both the bundle ID (`org.mozilla.firefox`) and the install path (`/Applications/Firefox.app`) with release Firefox, so installing it silently replaces a release install. ## Notes for reviewers - Nightly URLs are date-stamped and refresh with the daily FMA ingestion; within-cycle Nightly darwin builds share a `CFBundleVersion` date so same-day rebuilds are indistinguishable. - DevEd's winget package lags Mozilla's releases (winget latest is 151.0 vs current 153.0b13); the FMA tracks winget as usual. - The `CFBundleVersion` format (`<major><yy>.<M>.<D>`, unpadded) is an inferred contract of Mozilla's build system, verified against both shipped DMGs; if it ever changes, patch status fails visibly (reports unpatched), not silently. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added deployment support for Mozilla Firefox Developer Edition and Firefox Nightly on macOS and Windows (including Homebrew/Winget inputs and platform-specific install/uninstall workflows). * Added new catalog entries and dedicated UI icons for both Firefox variants. * **Bug Fixes** * Improved macOS “patched” detection and version matching for Developer Edition and Nightly builds. * Enhanced Homebrew ingestion by resolving build information (with fallback when unavailable). * Refined Windows uninstallation matching to target the correct Firefox release channels and avoid ESR. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fleet frontend
The Fleet frontend is a Single Page Application using React with Typescript and Hooks.
Table of contents
Running the Fleet web app
For details instruction on building and serving the Fleet web application consult the Contributing documentation.
Testing
Visit the overview of Fleet UI testing for more information on our testing strategy, philosophies, and tools.
To run unit or integration tests in ComponentName.tests.tsx, run yarn test -- ComponentName.tests.tsx. To test all Javascript components run yarn test.
QA Wolf manages our E2E test and will maintain the tests as well as raise any issues found from these tests. Engineers should not have to worry about working with E2E testing code or raising issues themselves.
For more information on how our front-end tests work, visit our frontend test directory.
Directory structure
Component directories in the Fleet front-end application encapsulate the entire component, including files for the component and its styles. The typical directory structure for a component is as follows:
└── ComponentName
├── _styles.scss
├── ComponentName.tsx
|-- ComponentName.tests.tsx
├── index.ts
_styles.scss: The component css stylesComponentName.tsx: The React componentComponentName.tests.tsx: The React component unit/integration testsindex.ts: Exports the React component- This file is helpful as it allows other components to import the component
by it's directory name. Without this file the component name would have to
be duplicated during imports (
components/ComponentNamevs.components/ComponentName/ComponentName).
- This file is helpful as it allows other components to import the component
by it's directory name. Without this file the component name would have to
be duplicated during imports (
components
The component directory contains global React components rendered by pages, receiving props from their parent components to render data and handle user interactions.
context
The context directory contains the React Context API pattern for various entities.
Only entities that are needed across the app has a global context. For example,
the logged in user (currentUser) has multiple pages and components
where its information is pulled.
interfaces
Files in the interfaces directory are used to specify the Typescript interface for a reusable Fleet entity. This is designed to DRY up the code and increase re-usability. These interfaces are imported in to component files and implemented when defining the component's props.
Additionally, local interfaces are used for props of local components.
layouts
The Fleet application has only 1 layout, the Core Layout. The Layout is rendered from the router and are used to set up the general app UI (header, sidebar) and render child components. The child components rendered by the layout are typically page components.
pages
Page components are React components typically rendered from the router.
React Router passed props to these pages in case they are needed. Examples include
the router, location, and params objects.
router
The router directory is where the react router lives. The router decides which
component will render at a given URL. Components rendered from the router are
typically located in the pages directory. The router directory also holds a paths
file which holds the application paths as string constants for reference
throughout the app. These paths are typically referenced from the App
Constants object.
services
CRUD functions for all Fleet entities (e.g. report) that link directly to the Fleet API.
styles
The styles directory contains the general app style setup and variables. It includes variables for the app color hex codes, fonts (families, weights and sizes), and padding.
templates
The templates directory contains the HTML file that renders the React application via including the bundle.js
and bundle.css files. The HTML page also includes the HTML element in which the React application is mounted.
test
The test directory includes test helpers, API request mocks, and stubbed data entities for use in test files. See the UI testing documentation for more on test helpers, stubs, and request mocks.
utilities
The utilities directory contains re-usable functions and constants for use throughout the application. The functions include helpers to convert an array of objects to CSV, debounce functions to prevent multiple form submissions, format API errors, etc.
Patterns
The list of patterns used in the Fleet UI codebase can be found in patterns.md.
Storybook
Storybook is a tool to document and visualize components, and we
use it to capture our global components used across Fleet. Storybook is key when developing new
features and testing components before release. It runs a separate server exposed on port 6006.
To run this server, do the following:
- Go to your root fleet project directory
- Run
make deps - Run
yarn storybook
The URL localhost:6006 should automatically show in your browser. If not, visit it manually.
Running Storybook before implementing new UI elements can clarify if new components need to be created or already exist. When creating a component, you can create a new file, component.stories.tsx, within its directory. Then, fill it with the appropriate Storybook code to create a new Storybook entry. You will be able to visualize the component within Storybook to determine if it looks and behaves as expected.