From 32ae64892bb8d91dc958301fbca447be6cfb91bc Mon Sep 17 00:00:00 2001 From: Marko Lisica Date: Thu, 6 Aug 2026 16:15:50 +0200 Subject: [PATCH 1/3] [YAML] Patch policies: Notify end users before app updates Related to: - #39178 --- docs/Configuration/yaml-files.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/Configuration/yaml-files.md b/docs/Configuration/yaml-files.md index 532e70fff87..a1c778436e2 100644 --- a/docs/Configuration/yaml-files.md +++ b/docs/Configuration/yaml-files.md @@ -108,6 +108,10 @@ A patch policy's `query` automatically updates. Hosts will fail this policy if t To automatically install the app when this policy fails, you can add an automation by setting `install_software` to `true`. +To notify the end user before the app is updated, set `notify_before_patching` to `true`. Fleet shows a notification listing the apps that will be updated, waits 1 hour, then installs. A reminder is shown 5 minutes before the install, and anything the end user updates themselves in the meantime is skipped. Nothing is installed until the end user has been notified and the hour has elapsed. Also, `continuous_automations_enabled` is automatically set to `true`. + +`notify_before_patching` requires macOS and [Fleet Desktop](https://fleetdm.com/guides/fleet-desktop). Patch policies targeting other platforms install without notifying. + #### Automations ##### Install software @@ -203,6 +207,13 @@ policies: fleet_maintained_app_slug: zoom/darwin continuous_automations_enabled: true install_software: true +- name: 1Password up to date + description: Outdated software might introduce security vulnerabilities or compatibility issues. + resolution: Install the latest version from self-service. + type: patch + fleet_maintained_app_slug: 1password/darwin + install_software: true + notify_before_patching: true ``` `default.yml` (for policies that neither install software nor run scripts), `fleets/fleet-name.yml`, or `fleet/unassigned.yml` From 5e8418248a1a9dd909cf059fcd93d72da4addbcb Mon Sep 17 00:00:00 2001 From: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> Date: Tue, 11 Aug 2026 12:51:19 +0200 Subject: [PATCH 2/3] update --- docs/Configuration/yaml-files.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/Configuration/yaml-files.md b/docs/Configuration/yaml-files.md index a1c778436e2..4a5d60156ca 100644 --- a/docs/Configuration/yaml-files.md +++ b/docs/Configuration/yaml-files.md @@ -106,11 +106,15 @@ You can create a patch policy by setting `type` to `patch` and specifying `fleet A patch policy's `query` automatically updates. Hosts will fail this policy if they’re not running the latest version found in [the app's metadata](https://github.com/fleetdm/fleet/tree/main/ee/maintained-apps/outputs). If `version` is set for `fleet_maintained_apps`, that version is included in the query. -To automatically install the app when this policy fails, you can add an automation by setting `install_software` to `true`. +To automatically patch the app when this policy fails, whether or not the app is open, set `install_software` to `true`. -To notify the end user before the app is updated, set `notify_before_patching` to `true`. Fleet shows a notification listing the apps that will be updated, waits 1 hour, then installs. A reminder is shown 5 minutes before the install, and anything the end user updates themselves in the meantime is skipped. Nothing is installed until the end user has been notified and the hour has elapsed. Also, `continuous_automations_enabled` is automatically set to `true`. +To automatically patch the app when this policy fails and app is not open, set `patch_when_closed` to `true`. -`notify_before_patching` requires macOS and [Fleet Desktop](https://fleetdm.com/guides/fleet-desktop). Patch policies targeting other platforms install without notifying. +To notify the end user before the app is patched, set `notify_before_patching` to `true`. Fleet shows a notification listing the apps that will be updated, waits 1 hour, then installs patch. A reminder is shown 5 minutes before the install. This option is only available on macOS, and requires Fleet Desktop app (available as Fleet-maintained app). + +Fleet adds a read-only pre-install query that skips automatic install while the app is open and retries on the next policy run when `patch_when_closed` or `notify_before_patching` is set to `true`. Also, the `continuous_automations_enabled` is automatically set to `true` when one of these options is enabled.. + +Fleet-managed pre-install query is ignored for self-service, host details page, and setup experience installs. #### Automations From 713dc9680c158e8b00546e48d5bb7fa2c6b6ea3d Mon Sep 17 00:00:00 2001 From: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> Date: Tue, 11 Aug 2026 12:54:47 +0200 Subject: [PATCH 3/3] update --- docs/Configuration/yaml-files.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/Configuration/yaml-files.md b/docs/Configuration/yaml-files.md index 4a5d60156ca..8a4a37b7bdc 100644 --- a/docs/Configuration/yaml-files.md +++ b/docs/Configuration/yaml-files.md @@ -735,7 +735,7 @@ By default, Fleet-maintained apps will be updated to the latest version publishe The fields below are all optional. - `self_service` specifies whether end users can install from **Fleet Desktop > Self-service**. -- `pre_install_query.path` is the SQL query Fleet runs before installing the software. Software will be installed only if the [query returns results](https://fleetdm.com/tables). +- `pre_install_query.path` is the SQL query Fleet runs before installing the software. Software will be installed only if the [query returns results](https://fleetdm.com/tables). If a [patch policy](#patch-policy) has `patch_when_closed` or `notify_before_patching` set to `true`, Fleet manages this query and rejects this field. - `post_install_script.path` is the script that, if supplied, Fleet will run on hosts after the software installs. - `icon.path` is a relative path to the PNG icon that will be displayed in Fleet and on **Fleet Desktop > Self-service** instead of the default icon the icon sourced from Apple. It must be a square PNG with dimensions between 120x120 px and 1024x1024 px. Custom icons will only override the icon for the software title and fleet where they are added. - `⁠version` specifies the app version. Available versions are listed in the Fleet UI under **Actions > Versions**. If omitted, Fleet automatically downloads the latest version found in [Fleet's catalog](https://fleetdm.com/software-catalog). The `version` must be wrapped in quotes (e.g. "147.0.1") so that it is processed as a string.