Luke Heath
@@ -1 +0,0 @@
|
||||
- Fixed team write endpoints (modify team, modify team agent options, and create team) so that they no longer return plaintext enroll secrets to users who cannot read them (such as GitOps), and applied the same secret masking to the list teams response.
|
||||
@@ -1 +0,0 @@
|
||||
- Added audit activities when secret variables are created or updated through the `PUT /api/latest/fleet/spec/secret_variables` endpoint.
|
||||
@@ -1 +1 @@
|
||||
- Rejected empty and whitespace-only enroll secrets when creating or updating teams, blocked host enrollment with such secrets across all enrollment paths (osquery, Orbit, Apple MDM, Android), and removed any pre-existing empty enroll secrets.
|
||||
- Blocked host enrollment with empty or whitespace-only enroll secrets across all enrollment paths (osquery, Orbit, Apple MDM, Android), and removed any pre-existing empty enroll secrets.
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
- Added support for personal (BYOD) Apple MDM enrollment, tracking per-host enrollment permissions so that personal devices cannot be remotely wiped or locked, and preserving those permissions across SCEP/ACME certificate renewal.
|
||||
@@ -1 +0,0 @@
|
||||
- Enabled "Turn off MDM" button for offline macOS hosts. The unenroll command is now queued and delivered when the device comes back online, consistent with iOS/iPadOS behavior.
|
||||
@@ -1 +0,0 @@
|
||||
- Added native Splunk HEC log destination for osquery status, result, and audit logs.
|
||||
@@ -1 +0,0 @@
|
||||
- Added the ability to upload multiple custom packages (up to 10) for the same software title on a team, so IT admins can deploy different versions or architectures (for example, Arm vs. Intel builds or staged rollouts) to label-scoped hosts instead of splitting them across teams. When a host matches more than one package, the first-added package is installed.
|
||||
@@ -1,2 +0,0 @@
|
||||
- Added the certificates list to the host details page for Windows hosts, showing each certificate's scope (System or
|
||||
User). This requires osquery 5.23.1 or higher on the host.
|
||||
@@ -1,2 +0,0 @@
|
||||
CachyOS is an Arch-based Linux distribution that is not currently fully supported by Fleet with missing vital information.
|
||||
This adds support for it as a known Linux platform
|
||||
@@ -1 +0,0 @@
|
||||
- Removed the elevated white background container from the loading spinner for a flatter, more consistent look.
|
||||
@@ -1,2 +0,0 @@
|
||||
- Added vulnerability (CVE) reporting for Android OS versions on the Software > OS page, where Android previously showed as "Not supported."
|
||||
- Folded the Android security patch level into the host's OS version so Android versions read as "Android 16 (2026-05-01)", giving vulnerability-relevant granularity per patch level.
|
||||
@@ -1 +0,0 @@
|
||||
Updated link styles in the UI
|
||||
@@ -1,2 +0,0 @@
|
||||
- Improved the user menu to show individual settings sections for admins.
|
||||
- Fixed sorting of fleets for fleet-level users.
|
||||
@@ -1 +0,0 @@
|
||||
- Clarified the delayed host vitals refetch banner to reflect that a refetch was sent and the UI will update when the host responds.
|
||||
@@ -1 +0,0 @@
|
||||
- Updated the message shown when refetching a host's vitals takes longer than expected to reflect uncertainty rather than failure, on the host details page, the My device page, and the dashboard's "Welcome to Fleet" card.
|
||||
@@ -1,6 +0,0 @@
|
||||
* Added the ability to enforce a host naming template on macOS, iOS, and iPadOS hosts under Controls > OS settings > Host names, for a fleet or for "No team" (Fleet Premium).
|
||||
* Added `POST /api/v1/fleet/host_name_template` to set or clear the naming template (`fleet_id` omitted or `0` targets "No team"); an empty template clears it without renaming any host.
|
||||
* Added a `name_template` key under `controls` in GitOps for fleets and "No team", and included it in `fleetctl generate-gitops` output.
|
||||
* Added a "Host name" row with enforcement status (Enforcing, Verifying, Verified, Failed) to the host details OS settings modal, including a resend action via `POST /api/v1/fleet/hosts/{id}/name_template/resend`.
|
||||
* Added host name enforcement statuses to the Controls OS settings aggregate cards and the `os_settings` host filter.
|
||||
* Added the `edited_host_name_template` activity.
|
||||
@@ -1 +0,0 @@
|
||||
- Added enrollment profile URL to the macOS tab in the "Add hosts" modal, with enrollment type selection (company-owned or personal/BYOD) for MDM users.
|
||||
@@ -1 +0,0 @@
|
||||
- Added the ability to handle DDM assets, and unblocked more declaration types.
|
||||
@@ -1,2 +0,0 @@
|
||||
- Added a "View certificate" modal to Controls > OS settings > Certificates so admins can inspect and copy an existing certificate's details.
|
||||
- Added a "no custom SCEP CA configured" empty state to the certificates card.
|
||||
@@ -1 +0,0 @@
|
||||
- Made form validation consistent across more forms (#40410 follow-up): validation errors now appear when leaving a field (on blur) and no longer appear before any input. This covers the policy automations "Other workflows" Destination URL, the add/edit user Email field, and the host status webhook Destination URL (both global settings and fleet settings).
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed the vulnerability automations webhook "Destination URL" field to validate on blur (when the user clicks out of the field), consistent with other URL fields in Fleet, instead of only showing an error on save.
|
||||
@@ -1,3 +0,0 @@
|
||||
* Added automatic renewal for SCEP and ACME certificates issued by external certificate authorities (Okta Conditional Access, Okta Verify, Hydrant ACME). Add `$FLEET_VAR_CERTIFICATE_RENEWAL_ID` to the certificate's Subject OU to enable.
|
||||
* Renamed `$FLEET_VAR_SCEP_RENEWAL_ID` to `$FLEET_VAR_CERTIFICATE_RENEWAL_ID`. The legacy name still works.
|
||||
* Enabled automatic renewal by default in Fleet's generated Conditional Access profile. Existing customers can opt in by redeploying the User scope profile.
|
||||
@@ -1 +0,0 @@
|
||||
- Removed the unused `/api/mdm/microsoft/auth` Windows MDM STS endpoint. Fleet always advertises the OnPremise auth policy, so no device ever contacted this endpoint. It now returns a 404. Windows MDM enrollment (Autopilot, Settings app, and fleetd-initiated) is unaffected.
|
||||
@@ -1 +0,0 @@
|
||||
- Added support for Python (`.py`) script-only software packages, which can be uploaded as custom packages (the file contents become the install script) and installed on macOS and Linux hosts, via the UI, REST API, and GitOps.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed Citrix Workspace LTSR detection on Windows to include cumulative updates (e.g. 2203 LTSR CU4), so their vulnerabilities report the correct LTSR `resolved_in_version` (e.g. `2402` for CVE-2024-6286) instead of the Current Release version.
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed the SSO sign-on button text overflowing by using a fixed "Sign in with SSO" label and showing the configured IdP name in a tooltip.
|
||||
@@ -1 +0,0 @@
|
||||
* Surface hardware-bound ACME certificates on macOS host vitals by retrieving them via the MDM `CertificateList` command when an ACME-bearing configuration profile is installed or re-installed.
|
||||
@@ -1 +0,0 @@
|
||||
- Surface a more detailed error message in GitOps if user doesn't have server_private_key configured.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed vulnerability detection for Python packages on Ubuntu/Debian devices by stripping the "python3-" name prefix during CPE matching.
|
||||
@@ -1 +0,0 @@
|
||||
- Updated Windows MDM end user experience radio button labels from Automatic/Manual to Fleet agent-driven/End user-driven to reduce confusion with MDM status terminology.
|
||||
@@ -1 +0,0 @@
|
||||
- Added `FLEET_MDM_ENABLE_CUSTOM_DISK_ENCRYPTION` (`mdm.enable_custom_disk_encryption`) as a cross-platform alias for `FLEET_MDM_ENABLE_CUSTOM_FILEVAULT`. When set, it allows both custom Apple MDM profiles for FileVault and custom Windows configuration profiles for BitLocker.
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed macOS software titles being displayed with an embedded login-helper's name (e.g. "AmphetamineLoginHelper") instead of the parent app's name when the helper bundle shares a bundle identifier with the main app. Embedded `.app` bundles nested under `Contents/` are now excluded at ingestion, and existing mis-named titles are renamed by a one-shot migration that recomputes the name from the title's sibling software rows.
|
||||
@@ -1 +0,0 @@
|
||||
* Updated the 500 and 403 error pages to match the design system and reuse the app navigation so the 500 page no longer shows broken image elements.
|
||||
@@ -1 +0,0 @@
|
||||
- Added support for escrowing disk encryption recovery keys from Linux hosts that use TPM-backed full-disk encryption (e.g. Ubuntu 26). On these hosts, orbit escrows a dedicated Fleet-owned snapd recovery key silently, without prompting the end user for a passphrase.
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed the Policies page automations filter disappearing from the UI when switching to the "Unassigned" fleet and selecting a different automation type.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed missing `resolved_in_version` for CVE-2025-63389 on Ollama (resolved in v0.12.4), which was absent because the NVD record only provides a `versionEndIncluding` constraint.
|
||||
@@ -1 +0,0 @@
|
||||
- Added custom host vitals: admins can define custom host fields, set their values per host manually or via the API, and reference them as `$FLEET_HOST_VITAL_<id>` variables in scripts and configuration profiles.
|
||||
@@ -1 +0,0 @@
|
||||
* Added support for provisioning macOS users during setup and keeping passwords in sync with any OAUTH ROPG supporting IdP via the Fleet Desktop app on macOS 26+ hosts
|
||||
@@ -1 +0,0 @@
|
||||
- Windows configuration profiles that use a Fleet-proxied SCEP certificate (custom SCEP proxy, NDES, or Smallstep) now report "Verified" only after Fleet observes the issued certificate on the host, instead of reporting "Verified" as soon as the host acknowledged the profile. They report "Failed" when the SCEP proxy request returns an upstream error, or when the certificate is still missing from the host an hour after delivery (once Fleet can confirm the certificate's store was readable).
|
||||
@@ -1 +0,0 @@
|
||||
- Improved the performance of Windows MDM profile installation across large numbers of hosts by reducing database lock contention when recording command results.
|
||||
@@ -1 +0,0 @@
|
||||
* Added a long-lived immutable `Cache-Control` header to content-hashed static assets under `/assets/` so browsers and CDNs can cache them across loads instead of refetching the JS/CSS bundle from origin every time.
|
||||
@@ -1 +0,0 @@
|
||||
- Added Zorin OS as a recognized Linux platform. Hosts running Zorin OS now enroll with `platform=zorin`, appear in the Linux disk-encryption summary, support `.deb` software installs, can be targeted by label platform filters, and have CVEs matched against the underlying Ubuntu LTS OVAL feed (Zorin 16 → Ubuntu 20.04, 17 → 22.04, 18 → 24.04). Unknown future Zorin versions fall through to an unsupported platform string so vulnerability scanning is skipped rather than served stale data from an aging LTS feed.
|
||||
@@ -1 +0,0 @@
|
||||
- Added installed version and available version columns to the self-service software table on the My device page.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed a bug where the Add software > App Store picker failed with an error for maintainer and technician roles because listing VPP tokens required admin access.
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed newly created or updated reports not appearing in the host details "Live report" modal or the reports list until a hard refresh.
|
||||
@@ -1 +0,0 @@
|
||||
- Added a check for duplicate patch policies when applying GitOps.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed a bug where the DEP syncer could silently drop device enrollment events when interrupted mid-run (e.g. context cancelled). The sync cursor now only advances after device records are successfully written, ensuring affected devices are replayed on the next sync rather than lost.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed an issue where ACME urls would throw a 500 error on malformed URLs.
|
||||
@@ -1 +0,0 @@
|
||||
- Updated the invalid NDES admin credentials SCEP error message to point to the correct UI location (Settings > Integrations > Certificate enrollment).
|
||||
@@ -1 +0,0 @@
|
||||
- Improved the Windows MDM enrollment server log for unsupported username and password (OnPremise) enrollment: a device that is not joined to Microsoft Entra ID now receives a clear server log message to join Microsoft Entra ID or enroll with fleetd.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed label membership being incorrectly cleared when a label's query errors out on a host (e.g. the extension socket is unavailable) instead of returning zero rows; existing membership is now left unchanged when a label query fails.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed vulnerability detection for Citrix Workspace on Windows by normalizing the software version (e.g. `25.7.1.6` to `2507.1.6`) for Citrix Workspace entries whose name does not include the `YYMM` release, so the generated CPE matches NVD.
|
||||
@@ -1 +0,0 @@
|
||||
* Added UI for configuring Apple account provisioning (FPSSO) in the integrations settings.
|
||||
@@ -1 +0,0 @@
|
||||
* Updated relative "time ago" timestamps to show days instead of months when the timestamp is less than 90 days ago.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed recurring Redis `MOVED` errors and silently-dropped report result-count increments on Redis Cluster deployments by grouping `query_results_count` keys by hash slot before pipelining.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed a server panic ("assignment to entry in nil map") when a host checked in for its osquery config while its agent options had a null `config`.
|
||||
@@ -1 +0,0 @@
|
||||
- Updated the Render deployment blueprint to use MySQL 8.0.44 (previously 8.0.24), fixing an "Error 1235 ... nesting of unions at the right-hand side" error on Render deployments.
|
||||
@@ -1 +0,0 @@
|
||||
- Removed the blue active-state background flash when clicking a row in a single-select data table (e.g., **My device > Policies**).
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed error in re-enrollment to Fleet with EUA on Linux with a different e-mail than the one used in the first enrollment.
|
||||
@@ -1 +0,0 @@
|
||||
- Removed the default platform filter on the "hosts online" chart, so iOS, iPadOS, and Android hosts are now included by default alongside desktop platforms.
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed an issue where fleetd could intermittently fail to install during Windows MDM enrollment, which could cause the Windows Autopilot Enrollment Status Page to hang.
|
||||
@@ -1 +0,0 @@
|
||||
- Enabled Microsoft Entra conditional access for self-hosted Fleet Premium instances (previously available only on Fleet Cloud). The `microsoft_compliance_partner.proxy_api_key` server configuration has been removed; the feature is now gated on the Fleet Premium license tier.
|
||||
@@ -1 +0,0 @@
|
||||
* Reduced MySQL reader load when listing hosts with `device_mapping=true` and a search query by evaluating device mapping as a per-row correlated subquery instead of a fully-materialized derived-table join, and by skipping it entirely in the host count query.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed a bug where some symbols changed height based on nearby characters in input fields.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed an issue where premium MDM calls was being made on a Fleet Free license.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed a bug where adding Windows software via GitOps could create a duplicate software title when a host had already reported the same program.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed observers not seeing the "Show managed account" action on a macOS host's details page, even though the API already allows them to view the managed local account password.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed an incorrect error message where an `msix` file was parsed as an `ipa` file.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed an issue where tooltips for full name did not always show.
|
||||
@@ -1 +0,0 @@
|
||||
* Updated the 404 page with a new illustration and copy consistent with the rest of the app.
|
||||
@@ -1 +0,0 @@
|
||||
- Renamed "Create" buttons and links to "Add" across the Fleet UI for consistency.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed an issue with the tooltip size of "Require BitLocker PIN" was bigger than normal.
|
||||
@@ -1 +0,0 @@
|
||||
- Updated missed ABM references to AB.
|
||||
@@ -1 +0,0 @@
|
||||
* Added support for editing existing configuration profiles (Apple `.mobileconfig`, Apple DDM declarations, Windows, and Android) in place via `PATCH /api/v1/fleet/configuration_profiles/:profile_uuid`.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed a timeout when editing existing Windows configuration profiles for a large team via `POST /api/latest/fleet/mdm/profiles/batch` (GitOps). Now the request stays fast regardless of host count.
|
||||
@@ -1 +0,0 @@
|
||||
- Added public IP address to host search, so that searching by IP now matches both the primary (private) IP and the public IP.
|
||||
@@ -1 +0,0 @@
|
||||
- Removed the `fleetdm/bomutils` Docker dependency for generating macOS `.pkg` fleetd installers; the Bill of Materials and xar archive are now written by pure-Go code, so `fleetctl package --type pkg` no longer requires Docker, `mkbom`, or `xar`.
|
||||
@@ -1 +0,0 @@
|
||||
- Hid the Self-service "Install all" button on the unfiltered "All" category so end users can't queue an install of the entire catalog in one click. The button still appears when a specific category is selected.
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed a bug where Apple MDM devices re-enrolling manually with a pending SCEP renewal would not be treated as a new renewal and might skip apps, profiles, etc
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed cron jobs getting stuck in "expired" when a run is interrupted mid-flight (e.g. during server shutdown); the run now records a terminal "canceled" status, preserving any job errors, instead of being left "pending" until reaped to "expired".
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed missing hover state on buttons and dropdowns inside cards in dark mode.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed the policies and users tables intermittently reloading and clearing the current selection or resetting to the first page when the browser window regained focus.
|
||||
@@ -1 +0,0 @@
|
||||
* Added support for targeting declarations to the user channel on macOS
|
||||
@@ -1 +0,0 @@
|
||||
- Hide self-service categories that have no available software from the category filter on the **My device** page, so users only see categories they can actually install from.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed server-side paginated tables (e.g. policies) landing on an empty state after deleting the last row on a page. The table now navigates back to a page with data instead.
|
||||
@@ -1 +0,0 @@
|
||||
- Added anonymous usage statistics reporting the number of macOS and Windows hosts enrolled in Fleet's MDM.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed a bug where a custom Windows configuration profile/command could bypass Fleet's checks by using a scope-less LocURI.
|
||||
@@ -1 +0,0 @@
|
||||
* Added better indexing for the Get Next Apple MDM command query
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed long certificate names overflowing the delete certificate modal in Controls > OS settings > Certificates.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed the Add certificate modal (Controls > OS settings > Certificates) to only list custom SCEP CAs in the "Certificate authority (CA)" dropdown, matching the modal's help text.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed an issue where the truncated vulnerabilities list in the Update details modal did not show a tooltip listing the remaining CVEs.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed Windows Autopilot enrollments intermittently hanging on the Enrollment Status Page at "Account setup".
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed an issue where devices given a mandatory update during ADE enrollment might display a failure or fail to display the update
|
||||
@@ -1,2 +0,0 @@
|
||||
- Fixed the "Missing hosts" summary card not showing on the Fleet Free dashboard when a platform other than "All" was selected.
|
||||
- Added an "Operating systems" card to the dashboard when Linux or Android is selected.
|
||||
@@ -1,4 +0,0 @@
|
||||
- Fixed a bug where fresh Windows 11 25H2 (and other recent builds) failed MDM enrollment with error
|
||||
80180006 because the device's discovery `RequestVersion` (e.g. "9.0") was rejected by an exact-match
|
||||
allow-list. Fleet now accepts any MS-MDE2 discovery `RequestVersion` at or above the minimum supported
|
||||
version ("4.0").
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed a bug where pinning a Fleet-maintained app to a different version didn't update the patch policy for it.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed a bug where a failed software install was reported as successfully installed when the install script exited with an error but a post-install script exited successfully.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed a bug where a Fleet-maintained app install could run a stale, previously-cached version after the app was auto-updated; installs (including automatic retries) now target the version Fleet currently displays.
|
||||
@@ -1 +0,0 @@
|
||||
- Removed the validation, added in Fleet 4.89.0, that rejected custom SCEP proxy certificate authority challenges containing characters outside the ASN.1 PrintableString set (for example, an underscore). Apple devices can enroll certificates using such challenges, so they are accepted again. A fix for Windows certificate enrollment failing with these challenges will ship separately.
|
||||
@@ -1 +0,0 @@
|
||||
* Optimized memory usage of CVE chart cron job.
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user