Repository navigation
Remove Nocturnal as a macOS FMA - #50050
Merged
Merged
Conversation
The nocturnal cask was removed from homebrew-cask on 2026-07-28 (deprecated 2024-07-27, disabled 2025-07-27, because: :unmaintained), so the brew API returns 404 and the maintained-apps ingester panics with "app not found in brew API". Remove the Homebrew input, macOS output data, the entry in apps.json, the frontend icon component and its import/mapping, and the website app icon.
fleet-release
approved these changes
Jul 28, 2026
Contributor
Script Diff Resultsee/maintained-apps/inputs/homebrew/nocturnal.jsonError: File 'ee/maintained-apps/inputs/homebrew/nocturnal.json' does not existee/maintained-apps/outputs/nocturnal/darwin.jsonError: File 'ee/maintained-apps/outputs/nocturnal/darwin.json' does not exist |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (5)
💤 Files with no reviewable changes (5)
WalkthroughNocturnal was removed from the maintained applications output and from the software icon registry. Its application list entry, icon import, and 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR removes the “Nocturnal” Fleet-maintained macOS app (Homebrew-based) to prevent the maintained-apps ingestion workflow from failing now that the Homebrew cask has been removed upstream.
Changes:
- Deleted the Homebrew input definition and macOS output metadata for Nocturnal.
- Removed Nocturnal from the maintained apps registry (
apps.json). - Removed the frontend Nocturnal icon component and its mapping entry.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| frontend/pages/SoftwarePage/components/icons/Nocturnal.tsx | Removes the Nocturnal SVG/icon component. |
| frontend/pages/SoftwarePage/components/icons/index.ts | Drops the Nocturnal import and SOFTWARE_NAME_TO_ICON_MAP entry. |
| ee/maintained-apps/outputs/nocturnal/darwin.json | Deletes Nocturnal macOS output metadata (versions/queries/scripts/sha256). |
| ee/maintained-apps/outputs/apps.json | Removes the Nocturnal entry from the published maintained apps list. |
| ee/maintained-apps/inputs/homebrew/nocturnal.json | Deletes the Homebrew input definition for Nocturnal. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #50050 +/- ##
==========================================
+ Coverage 67.98% 67.99% +0.01%
==========================================
Files 3923 3923
Lines 250102 250118 +16
Branches 13361 13207 -154
==========================================
+ Hits 170026 170071 +45
+ Misses 64774 64746 -28
+ Partials 15302 15301 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
2 tasks done
allenhouchins
added a commit
that referenced
this pull request
Jul 28, 2026
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A Pins the macOS Fleet-maintained app for Yubikey Manager at its current output version, `1.2.5`, by setting `"frozen": true` on the Homebrew input. - `ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json` — added `"frozen": true` The flag is read by the ingester into the manifest ([`homebrew/ingester.go`](https://github.com/fleetdm/fleet/blob/main/ee/maintained-apps/ingesters/homebrew/ingester.go)) and then consumed in two places: - [`cmd/maintained-apps/main.go`](https://github.com/fleetdm/fleet/blob/main/cmd/maintained-apps/main.go) skips overwriting `outputs/yubico-yubikey-manager/darwin.json` when the output file already exists, so the published version, installer URL, SHA256, and patch-policy query stop moving. - [`cmd/maintained-apps/validate/main.go`](https://github.com/fleetdm/fleet/blob/main/cmd/maintained-apps/validate/main.go) skips the app entirely during validation. `frozen` is tagged `json:"-"` on the manifest struct, so it does not appear in the output JSON — that file is intentionally left untouched by this PR. The Windows FMA (`inputs/winget/yubico-yubikey-manager.json`) is deliberately **not** frozen and continues to update. ## Note for reviewers While preparing this change I found that the `yubico-yubikey-manager` cask has been **removed from homebrew-cask**: ``` https://formulae.brew.sh/api/cask/yubico-yubikey-manager.json → 404 ``` The full cask list now contains only `pallotron-yubiswitch`, `yubico-authenticator`, and `yubihsm2-sdk`, and the token is not present in `inputs/homebrew/custom-tap/` either. This matches upstream: Yubico discontinued `yubikey-manager-qt` (the 1.2.5 installer this FMA pins) in favor of Yubico Authenticator. **Freezing does not resolve that 404.** The ingester fetches cask metadata *before* the frozen flag is applied, so the scheduled "Update Fleet-maintained apps" workflow is still expected to fail for this app with: ``` panic: ingesting homebrew app: app not found in brew API ``` Fully resolving that would mean removing the macOS FMA, the way #50050 did for Nocturnal (input, output, `apps.json` entry, frontend icon + mapping, website PNG). This PR is scoped to the freeze only, per the request; the removal can be a follow-up if that is the direction we want. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually — confirmed the edited input still parses as JSON, and traced the `frozen` flag through the ingester into both the output-write skip and the validation skip. No automated tests were added; this is a single data-file flag with no new code paths. --------- Co-authored-by: Kitzy <kitzy@kitzy.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2 tasks done
allenhouchins
added a commit
that referenced
this pull request
Jul 29, 2026
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A — fixes the failing scheduled "Update Fleet-maintained apps" workflow The `yubico-yubikey-manager` cask was removed from homebrew-cask on 2026-07-28 ([Homebrew/homebrew-cask@7ffabaa](Homebrew/homebrew-cask@7ffabaa)) after being disabled on 2025-07-27 `because: :discontinued, replacement_cask: "yubico-authenticator"` — Yubico discontinued `yubikey-manager-qt` (the 1.2.5 installer this FMA pinned) in favor of Yubico Authenticator. The brew API now returns 404 for the token, so the maintained-apps ingester panics: ``` {"level":"INFO","msg":"ingesting homebrew app","name":"Yubikey Manager"} panic: ingesting homebrew app: app not found in brew API ``` Freezing the app in #50054 did not resolve this: `fetchCask` runs before the `frozen` flag is applied, so the ingester still fetches the cask and fails on the 404. This is the follow-up that PR called out. Removes Yubikey Manager as a **macOS** Fleet-maintained app, following the same pattern as #50050 (Nocturnal), #46541 (Messenger), and #47420 (Dell Display Manager): - `ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json` — Homebrew input - `ee/maintained-apps/outputs/yubico-yubikey-manager/darwin.json` — macOS output data - `ee/maintained-apps/outputs/apps.json` — the `yubico-yubikey-manager/darwin` entry - `website/config/routes.js` — the bare `/software-catalog/yubico-yubikey-manager` redirect pointed at `-darwin`, which would now 404; retargeted to `-windows` The **Windows** FMA is unaffected and continues to update, so these are deliberately kept: - `ee/maintained-apps/inputs/winget/yubico-yubikey-manager.json` and its install/uninstall scripts - `ee/maintained-apps/outputs/yubico-yubikey-manager/windows.json` - the `yubico-yubikey-manager/windows` entry in `apps.json` - `frontend/pages/SoftwarePage/components/icons/YubikeyManager.tsx` and its `"yubikey manager"` mapping in `index.ts` - `website/assets/images/app-icon-yubico-yubikey-manager-60x60@2x.png` Also drops "Requires Rosetta 2." from the Windows entry's description in `apps.json`. Rosetta is macOS-only; the sentence was copy-pasted from the macOS entry, and with macOS gone the Windows page is what `/software-catalog/yubico-yubikey-manager` now resolves to. Descriptions in `apps.json` are hand-maintained — `updateAppsListFile` in `cmd/maintained-apps/main.go` only appends entries whose slug it doesn't already find, so it won't overwrite the edit. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually: - `go run ./cmd/maintained-apps -slug yubico-yubikey-manager/darwin` exits 0 with no panic and writes no files (before this change, the same run panicked on the brew 404). - `apps.json` still parses and holds 1377 apps; the only remaining `yubico-yubikey-manager` entry is `/windows`. - Grepped the repo for `yubico-yubikey-manager`: remaining hits are the winget input, its two script paths, the windows `apps.json` entry, and the retargeted website redirect. No automated tests added — this is a data-file removal with no new code paths.
2 tasks done
allenhouchins
added a commit
that referenced
this pull request
Jul 30, 2026
…w-cask) (#50215) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA — fixing a failing scheduled "Update Fleet-maintained apps" run. Removes the **macOS** Dynalist Fleet-maintained app. The Windows (winget) FMA is unaffected and stays. ## Why The `dynalist` cask was deleted from homebrew-cask on 2026-07-30 ([commit `adac21ffc4`](Homebrew/homebrew-cask@adac21ffc401)), completing Homebrew's full deprecation lifecycle: - `deprecate!` 2024-07-29, `because: :unmaintained` - `disable!` 2025-07-29 - cask file removed 2026-07-30 `https://formulae.brew.sh/api/cask/dynalist.json` now returns 404, so the scheduled ingester panics: ``` {"level":"INFO","msg":"ingesting homebrew app","name":"Dynalist"} panic: ingesting homebrew app: app not found in brew API ``` Marking the app `"frozen": true` does **not** fix this — the ingester fetches the cask JSON before the frozen flag is consulted (`cmd/maintained-apps/main.go`), so removal is the only fix for a dead upstream cask. ## What changed Deletions only (39 lines, no additions): - `ee/maintained-apps/inputs/homebrew/dynalist.json` — deleted - `ee/maintained-apps/outputs/dynalist/darwin.json` — deleted - the `dynalist/darwin` entry in `ee/maintained-apps/outputs/apps.json` — removed; `dynalist/windows` remains ## Deliberately kept Because the Windows FMA still needs them: - `ee/maintained-apps/outputs/dynalist/windows.json`, `ee/maintained-apps/inputs/winget/dynalist.json`, and its install/uninstall scripts - `frontend/pages/SoftwarePage/components/icons/Dynalist.tsx` and its `dynalist:` mapping in `icons/index.ts` — the map is keyed by lowercased app name and is shared across platforms - `website/assets/images/app-icon-dynalist-60x60@2x.png` — keyed by slug token, still serving the Windows entry in the app library ## Note for reviewers Hosts that currently have the macOS Dynalist FMA installed will lose the maintained-app entry on the next sync. This matches the behavior of prior FMA removals (Nocturnal #50050, Dell Display Manager #47420, Messenger #46541). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. Not applicable — consistent with prior FMA removal PRs, which do not add a changes file. ## Testing - [x] QA'd all new/changed functionality manually Verified that `ee/maintained-apps/outputs/apps.json` still parses as valid JSON (1381 apps) and that `Dynalist` now resolves to only `dynalist/windows`. Confirmed the 404 against the brew API and read the pre-removal cask at `adac21ffc4~1` to establish the deprecation reason. `git diff` confirms the change is deletions-only.
This was referenced Aug 4, 2026
This was referenced Oct 8, 2026
allenhouchins
added a commit
that referenced
this pull request
Oct 9, 2026
**Related issue:** N/A (found by the catalog installer URL sweep from #55164) Three macOS Fleet-maintained apps point at installers that can no longer be downloaded, so they can't be added to any fleet. In GitOps, a fleet file that lists one of them fails the whole software apply. This is the same class of bug as #54704 (Abstract). Disabled casks still return 200 from the brew API, so the ingester never flagged them. | App | Installer URL | Why it fails | Homebrew | |---|---|---|---| | lo-rain | `https://lo.cafe/lo-rain-files/lo-rain-1.5.2.dmg` | `lo.cafe` fails DNSSEC validation (the `.cafe` registry publishes a DS record but the authoritative servers serve no DNSKEY), so Cloudflare, Google, and Quad9 resolvers return SERVFAIL. Reaching the origin directly, the file returns 404 and the site now only hosts a statement about an ownership dispute. | Disabled 2026-09-21, `:unreachable` ([Homebrew/homebrew-cask@e235f25](Homebrew/homebrew-cask@e235f2554b)) | | NotchNook | `https://lo.cafe/notchnook-files/NotchNook-1.6.2.zip` | Same domain, same failure, file returns 404 at the origin. | Disabled 2026-09-20, `:unreachable` ([Homebrew/homebrew-cask@1c9dd31](Homebrew/homebrew-cask@1c9dd310ca)) | | Huly | `https://dist.huly.io/Huly-macos-0.7.426-arm64.zip` | 403 for every path on `dist.huly.io`, with Fleet's UA and a browser UA. The body is Cloudflare R2's "This bucket cannot be viewed" page, so the bucket is no longer public; it isn't a bot challenge. Huly's own download page reads its update manifest from the same bucket and now shows only the web app. The `hcengineering/platform` GitHub releases have no macOS assets. | Disabled 2026-10-03, `:no_longer_available` ([Homebrew/homebrew-cask@45e945f](Homebrew/homebrew-cask@45e945f90a)) | None of them has a working vendor download to point a custom cask at, so this removes all three, following the same pattern as #50050 (Nocturnal) and #55164 (Abstract): - `ee/maintained-apps/inputs/homebrew/{lo-rain,notchnook,huly}.json`: Homebrew inputs - `ee/maintained-apps/outputs/{lo-rain,notchnook,huly}/darwin.json`: macOS output data - `ee/maintained-apps/outputs/apps.json`: the three entries (diff is deletions only) - `frontend/pages/SoftwarePage/components/icons/png/{LoRain,Notchnook,Huly}.png` and their imports/mappings in `index.ts` - `website/assets/images/app-icon-{lo-rain,notchnook,huly}-60x60@2x.png` None of the three has a Windows FMA, so no shared icons had to stay. Servers drop catalog entries that leave `apps.json` on their next sync (`ClearRemovedFleetMaintainedApps`). The hashes in `tools/software/fma-script-hashes/` are left in place as historical records, matching earlier removals. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually (re-verified DNS, origin responses, and cask `disabled` state on 2026-10-08; `apps.json` still parses with 1422 entries and no `lo-rain`, `notchnook`, or `huly` slugs; `git grep` finds no remaining references outside the historical hash maps; `go test ./server/mdm/maintainedapps/... ./ee/maintained-apps/... ./cmd/maintained-apps/...` passes) ## AI **AI:** Claude Code (claude-opus-5-5) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Catalog Updates** * Huly, lo-rain, and NotchNook have been removed from the macOS software catalog and are no longer listed as available apps. * Their corresponding app entries and install and uninstall options are no longer included in the catalog. * No other catalog entries were changed. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
allenhouchins
added a commit
that referenced
this pull request
Oct 9, 2026
**Related issue:** Resolves #54704 The Abstract installer URL (`https://downloads.goabstract.com/mac/Abstract-98.6.3.zip`) is on a domain that no longer resolves (`goabstract.com` returns NXDOMAIN), so the app can't be added to any fleet. In GitOps, a fleet file that lists it fails the whole software apply. Homebrew disabled the `abstract` cask on 2026-10-03 ([Homebrew/homebrew-cask@8a604d3](Homebrew/homebrew-cask@8a604d3bf0), `disable! because: :no_longer_available`). Disabled casks still return 200 from the brew API, so the ingester never flagged it, and the input was already `frozen`, which only stops the output from being rewritten. This removes Abstract as a Fleet-maintained app, following the same pattern as #50050 (Nocturnal): - `ee/maintained-apps/inputs/homebrew/abstract.json`: Homebrew input - `ee/maintained-apps/outputs/abstract/darwin.json`: macOS output data - `ee/maintained-apps/outputs/apps.json`: Abstract entry - `frontend/pages/SoftwarePage/components/icons/png/Abstract.png` and its import/mapping in `index.ts` - `website/assets/images/app-icon-abstract-60x60@2x.png` Servers drop catalog entries that leave `apps.json` on their next sync (`ClearRemovedFleetMaintainedApps`). The hashes in `tools/software/fma-script-hashes/` are left in place as historical records, matching earlier removals. A sweep of every catalog installer URL found a few more apps that can't be downloaded (`lo-rain`, `notchnook`, `huly`, and some 403/404 URLs). Those are handled in separate PRs. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually (confirmed NXDOMAIN and the disabled cask; `apps.json` still parses with no `abstract/darwin` entry; no remaining references; `go test ./server/mdm/maintainedapps/... ./ee/maintained-apps/... ./cmd/maintained-apps/...` passes) ## AI **AI:** Claude Code (claude-opus-5-5)
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue: N/A — fixes the failing scheduled "Update Fleet-maintained apps" workflow
The
nocturnalcask was removed from homebrew-cask on 2026-07-28 (Homebrew/homebrew-cask@517db75) after being deprecated on 2024-07-27 and disabled on 2025-07-27, bothbecause: :unmaintained(upstream repo's last push was in 2018). The brew API now returns 404 for it, so the maintained-apps ingester panics:This removes Nocturnal as a Fleet-maintained app, following the same pattern as #46541 (Messenger) and #47420 (Dell Display Manager):
ee/maintained-apps/inputs/homebrew/nocturnal.json— Homebrew inputee/maintained-apps/outputs/nocturnal/darwin.json— macOS output dataee/maintained-apps/outputs/apps.json— Nocturnal entryfrontend/pages/SoftwarePage/components/icons/Nocturnal.tsxand its import/mapping inindex.tswebsite/assets/images/app-icon-nocturnal-60x60@2x.pngChecklist for submitter
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.Testing
apps.jsonstill parses, no remainingnocturnalreferences, ESLint passes on the icons index)Summary by CodeRabbit