<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#39962
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- N/A
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added “Patch when closed” deployment policies to update software only
when the application is not running.
* Added deployment controls for force install, patching, and manual,
forced, or closed-app patch options.
* Fleet-maintained apps now automatically detect whether the application
is open.
* GitOps configurations support patch-when-closed settings with
validation.
* **UI Improvements**
* Added clear activity and installation messages when updates are
skipped because an app is open.
* Replaced the Patch action with a unified Deploy workflow.
* **Bug Fixes**
* Prevented skipped updates from being incorrectly retried as failed
installations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#47717
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters. _Front end only_
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Apple OS update targeting options for no enforcement, a custom
minimum version, or the latest available version.
* Added configurable whole-day deadlines for macOS, iOS, and iPadOS
updates.
* Added platform-specific target controls, validation, and automatic
new-host updates for latest-version targeting.
* Displayed minimum versions, pending status, and update deadlines in
host details and activity feeds.
* Clarified Windows deadlines as days after release.
* **Style**
* Improved layout and spacing for Apple and Windows update forms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40493
Changes already reviewed in the PRs merged to this feature branch.
Only additive change was
https://github.com/fleetdm/fleet/pull/50595/commits/c0934e1fee46a734f9499a4c782563d4fcc345c4
to address CodeRabbit's comments.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
https://github.com/user-attachments/assets/ea7f5157-a67a-4d83-842d-62197bd1546d
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added host activity automations with configurable webhook
destinations.
* Manage automations from the Hosts page with validation, permissions,
and enable/disable controls.
* Added GitOps support for team and unassigned-host webhook settings.
* Activity webhooks now include fleet-scoped host IDs where applicable.
* Added profile UUIDs to MDM profile resend activity details.
* **Bug Fixes**
* Improved Windows MDM enrollment activity details by including the
linked host ID when available.
* Preserved existing webhook settings when omitted during updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#39281
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
https://github.com/user-attachments/assets/8ef7c66d-f8a6-46d5-ba17-66c1df8171b6https://github.com/user-attachments/assets/6f67b49b-daf1-4acd-ad0f-55a7d1225a44
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added 29 iOS/iPadOS device vitals to host details and API responses.
* Added a “View all” modal for browsing complete device vitals,
including subscriptions and accessibility details.
* Added support for cellular technology, organization information,
attestation data, and device settings.
* **Privacy**
* Personal/BYOD enrollments exclude expanded device-vitals fields.
* Sensitive vitals are removed from device URL-authenticated responses.
* **Bug Fixes**
* Stale vitals are cleared when enrollment ownership changes or hosts
are deleted.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Resolves#45414
- Added Adobe plugins to software inventory: Fleet now detects Adobe Creative Cloud plugins (CEP and UXP extensions) on macOS and Windows hosts and lists them on the Software page and host details with the software type "Plugin (Adobe)", including version and host count.
- Adobe plugins are excluded from vulnerability scanning, so no vulnerabilities are reported for them. No vulnerability data source maps an Adobe CEP or UXP extension to a CVE; Adobe files CVEs against the host application (Photoshop, Acrobat, and so on), which Fleet already scans.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48722
Demo: https://www.youtube.com/watch?v=zm5WmJY-o4Y
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Windows support for creating and managing local administrator
accounts.
* Added a Windows-specific option in user setup when Windows MDM is
configured.
* Added managed-account actions and status visibility for Windows hosts.
* Added guidance noting that this feature requires `fleetd` 1.60.0 or
later.
* **Improvements**
* Updated local account descriptions, help text, and authentication
guidance.
* Improved managed-account status and password-rotation messaging.
* Added clearer feedback when account creation or password escrow is
pending.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42735
- Exposes max_software_package_size in the `GET /api/v1/fleet/config`
endpoint
- Add frontend logic to use it to deny files that are too big before
they get uploaded
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- Tested on Chrome, Safari, and Firefox on macOS
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a configurable maximum software package size to application
settings.
* Software uploads exceeding the limit are rejected with a clear,
size-specific error message.
* Packages at or below the configured limit are accepted.
* Added user-friendly file-size formatting across common units.
* Upload validation accounts for the complete request size, including
scripts and settings.
* **Tests**
* Added coverage for upload validation, boundary conditions, size
formatting, and configuration responses.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Demo: https://www.youtube.com/watch?v=cWxZlu9WuwA
Guide updates: https://github.com/fleetdm/fleet/pull/49603/changes
IT admins can configure the fleet that hosts enrolling through
user-driven Windows MDM enrollment (Windows Autopilot, Entra join) are
automatically assigned to, via the Windows MDM settings page, the
mdm.windows_enrollment.default_fleet config setting, or GitOps.
- New windows_enrollment_config row stores the default team; the config
API surfaces it by fleet name and hydrates reads from the row so team
renames and deletions never serve a stale name. Deleting the fleet
clears the setting.
- New edited_windows_enrollment_default_fleet activity, emitted only
when the value changes.
- The OMA-DM session persists the device-reported SMBIOS serial on
still-unlinked enrollments, and orbit enrollment reverse-links by that
serial and assigns the default fleet before orbit's one-shot
setup-experience init, so the default fleet's software, scripts, and
profiles apply during the Autopilot ESP. The DevDetail and osquery link
paths keep the same assignment as fallbacks, and the EUA-token link path
now shares the same post-link bookkeeping.
- Hosts are only assigned when new to Fleet in this enrollment cycle:
existing hosts, including ones parked in Unassigned, keep their fleet on
re-enrollment, matching macOS ABM behavior.
- GitOps defers applying the setting until teams declared in the same
run are created, and fleetctl generate-gitops exports it.
- Windows MDM settings page redesign per Figma: programmatic enrollment
toggle, User driven enrollment section with the Entra-gated Default
fleet dropdown, and a Migration section.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41787
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for assigning a default Fleet Premium fleet to new
Windows MDM enrollments, including Autopilot and Entra join.
* Default-fleet settings can be configured, cleared, and managed through
Windows MDM settings and GitOps.
* Assigned fleet software, scripts, and profiles can apply during
out-of-box setup.
* Added activity-feed visibility for default-fleet changes.
* Improved Windows enrollment matching using hardware serial numbers.
* **Documentation**
* Documented default-fleet assignment for Windows enrollment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#49419
Adds the UI for patching Fleet-maintained apps when the app is closed.
The patch toggle becomes a Deploy control with Force install and Patch
checkboxes. Checking Patch reveals a radio group: Patch when app is
closed, Force patch, or End user initiated. The control appears in the
Add software flow, a new Deploy modal, and the edit-policy page. The
change also adds skipped-install copy in the activity feed and install
details, a Self-service toggle for Fleet-maintained apps, and GitOps and
Premium gating.
The PR also includes backend changes that expose the patch policy's
continuous-automation state and a Fleet-maintained app's install query
in the API. The UI reads both to show the correct Deploy options, so
they ship in one PR.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Eng QA walkthrough [part
1](https://drive.google.com/file/d/1Un-Z4QoTk2eXslQ_b8t95cE11QYq1SUt/view?usp=drive_link),
[part
2](https://drive.google.com/file/d/12_1Eh_RHOJ7RTjXBxFgas0VhKWvhLS0r/view?usp=drive_link)
Resolves#50069
Omarchy 4 ships its own /etc/os-release with ID=omarchy, where earlier
versions inherited ID=arch from Arch Linux. Since HostLinuxOSs and
HOST_LINUX_PLATFORMS gate nearly every Linux check, these hosts had
empty vitals and software inventory, were missed by linux-scoped
policies and labels, had no disk encryption or key escrow, and lost Run
script in the UI (the API was unaffected).
Add "omarchy" to HostLinuxOSs, HostNeitherDebNorRpmPackageOSs (pacman-
based), IsLUKSSupported, HOST_LINUX_PLATFORMS,
DISK_ENCRYPTION_SUPPORTED_LINUX_PLATFORMS, and the Vitals
disk-encryption tooltip. Regenerate understanding-host-vitals.md.
Aggregate Omarchy onto the "Arch Linux" / "rolling" OS inventory row,
where these hosts sat before quattro. Unlike CachyOS, Omarchy reports a
real release number rather than BUILD_ID=rolling, so the version is
pinned after parsing instead of rewriting the ingested build value.
Also add a fleetd test container, built on archlinux since Omarchy
publishes no image.
Resolves#44088.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Linux as a label platform option.
* Linux labels now apply across supported distributions, including
Ubuntu, Debian, RHEL, CentOS, and generic Linux hosts.
* Updated platform names for improved clarity and consistency.
* **Bug Fixes**
* Improved platform matching so Linux labels apply consistently to
compatible hosts.
* Removed the obsolete Zorin platform option.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#47701
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually: Not able to test
token_rejected, terms and conditions or apple server error.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an Apple Business Manager invalid-token warning banner that
lists the affected organization names.
* Introduced dedicated invalid-token state support so the banner can
appear with the correct priority.
* **Bug Fixes**
* Ensured invalid-token state is cleared when no tokens are returned and
consistently set on token fetch success/error.
* Improved Apple/DEP status messaging and made profile-assignment
rendering more resilient for non-DEP and partial-error responses.
* **Style**
* Adjusted banner spacing and added styling for DEP error presentation.
* **Tests**
* Added/expanded tests for invalid-token messaging, ABM expiry updates,
and MDM status/error scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49777
## Description
Adds `host_id` and `host_serial` to the Apple `mdm_enrolled` activity so
IT admins can build automations on top of it, and surfaces the activity
on the individual host's activity timeline.
- **`server/fleet/activities.go`** — added `HostID` to
`ActivityTypeMDMEnrolled` and a `HostIDs()` method (mirrors the existing
`ActivityTypeMDMUnenrolled` pattern), so the activity is linked to the
host and appears on its timeline.
- **`server/mdm/lifecycle/lifecycle.go`** — populate `host_id` for
macOS/iOS/iPadOS enrollments. Account-driven user (BYOD) enrollments
have no hardware serial, so they report the enrollment ID as
`host_serial` too, keeping `host_serial` populated for automations
regardless of enrollment type.
- **Frontend** — new `MdmEnrolledActivityItem` component, registered in
the host past-activity component map (and the `IHostPastActivityType`
union), renders the now-host-linked `mdm_enrolled` activity on the host
details **Activity** card. There's no Figma, so the copy mirrors the
sibling `mdm_unenrolled` item (e.g. "Mobile device management (MDM) was
turned on for this host").
`host_id` uses `omitempty`, so Windows (`microsoft_mdm.go`) enrollments
keep their existing activity payload unchanged — Windows is
intentionally out of scope, handled in #47874, which also owns the
audit-log documentation update for the shared field.
> **For reviewer:** the ADUE `host_serial = enrollment_id` behavior
comes from the issue's test plan. It means `host_serial` and
`enrollment_id` carry the same value for BYOD. Flagging in case Product
would rather leave `host_serial` empty for ADUE and have automations
read `enrollment_id`.
## Testing
- **Automated:** `TestMDMEnrolledActivityHostIDAndSerial`
(`server/mdm/lifecycle`) covers device enrollment (`host_serial` =
hardware serial) and ADUE (`host_serial` = enrollment ID), both
asserting `host_id`/`HostIDs()`. Also verified `server/datastore/mysql`
`TestMDMEnrollment`, `server/activity/internal/mysql`
`TestListActivities`, and `server/service` `TestMDMTokenUpdate*` pass.
- **Live (simulated) manual macOS enrollment** via `osquery-perf`: the
`mdm_enrolled` activity recorded `host_id` + `host_serial`, and an
`activity_host_past` row linked it to the host (confirmed it shows on
the host timeline).
- **Frontend:** `MdmEnrolledActivityItem.tests.tsx` covers the rendered
copy for macOS/iOS/Android and the actor/no-actor variants; also
visually confirmed the activity renders on a host's Activity card in the
running app. `yarn jest`, `eslint`, and `tsc` pass.
- Updated the MDM integration tests (`integration_mdm_test.go`,
`integration_mdm_dep_test.go`, `integration_vpp_install_test.go`) whose
activity-detail and host-feed assertions changed now that `mdm_enrolled`
carries `host_id` and appears on the host timeline (feed assertions now
filter by activity type).
- **Pending on-device QA (next week):** DEP/ADE macOS and account-driven
user enrollment (iOS/iPadOS) on real hardware, per the issue's test
plan.
- Regression: Windows `mdm_enrolled` payload is unchanged (`host_id` is
omitted when zero); both platforms' `mdm_unenrolled` are unaffected.
# Screenshot for the frontend change
<img width="706" height="382" alt="Screenshot 2026-07-28 at 11 16 57 AM"
src="https://github.com/user-attachments/assets/8f57d129-f819-4399-8754-18b397a49db8"
/>
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually <!-- manual macOS
verified via simulator; DEP + real-device ADUE pending next week -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added support for rendering “MDM enrolled” in the host activity feed
with platform- and actor-aware messaging.
* **Bug Fixes**
* Updated Apple “MDM enrolled” activity details to include the correct
host identifier and serial/enrollment identifiers.
* Ensured host-scoped activity behavior applies only when the host is
known (host id present).
* **Tests**
* Expanded regression and integration coverage for “MDM enrolled”
activity details and feed contents, including VPP-related assertion
stability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
**Related issue:** Resolves
https://github.com/fleetdm/fleet/issues/46818 and
https://github.com/fleetdm/fleet/issues/48524.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Host lists and Host details now show human‑readable Apple hardware
marketing names (macOS, iOS, iPadOS) where available (e.g., "MacBook Pro
(16‑inch, 2021)"), replacing raw model identifiers.
* Hardware model displays fall back to the original model identifier for
non‑Apple or unmapped devices.
* **Bug Fixes / CSV**
* Exported host CSVs now align with the UI by using the marketing name
for Apple devices when available.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Make failed logins for MFA-enabled accounts return a consistent response
and timing regardless of the cause, in line with authentication best
practices. Guidance for CLI users whose client can't complete email
verification is now surfaced by fleetctl on any login failure.
Added a `user_mfa_requested` activity, recorded when valid credentials
are submitted for an MFA-enabled account and a verification email is
sent.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49368
Video:
https://github.com/user-attachments/assets/d73a2146-be13-4bfd-802a-f02eb5681b69
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. **Part of backend PR**
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added “Release from Apple Business” to eligible host actions,
including a confirmation modal with success and error handling.
* Added Apple Business release entries to the activity feed.
* **Bug Fixes**
* Improved user-facing Apple Business error and “Learn more” messaging,
including clearer output when Apple Business device status isn’t
accessible.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48343
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
No changes file as this is covered by the base feature branch
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added the ability to edit existing configuration profiles, including
profile contents and targeting labels.
* Added file validation for supported profile formats and clearer
edit-specific error messages.
* Added activity feed entries and filtering for edited configuration
profiles.
* Updated profile actions with an edit option and improved team-specific
label handling.
* **Bug Fixes**
* Improved label data refreshing when switching between teams.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: andymFleet <andrewmellor@fleetdm.com>
Resolves#47699.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Microsoft Entra Conditional Access is now supported for self-hosted
Fleet Premium instances.
* Conditional Access is available only on the Fleet Premium license
tier.
* **Changes**
* Removed the Microsoft Compliance Partner API key configuration and
updated the proxy behavior accordingly.
* Removed the managed-cloud indicator from license/config responses and
adjusted related UI rendering and gating.
* **Tests / Maintenance**
* Updated fixtures and automated tests to reflect the new licensing
gates and API/proxy behavior (including updated failure codes).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#41470
Adds support for uploading Python (`.py`) script-only software packages
— accepted as script-only (the file contents become the install script;
advanced options and automatic install follow `.sh`/`.ps1`), assigned
the new `py_packages` source, and installable on macOS and Linux hosts
across the UI, REST API, and GitOps.
Feature branch combining the backend (#48942) and frontend (#48946)
sub-PRs.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for Python (`.py`) script-only software packages across
UI uploads, API/self-service installs, and GitOps parsing.
* Python installers now derive metadata correctly and render the proper
Python icon, with install eligibility for macOS & Linux.
* **Bug Fixes**
* Improved installer-script validation and “supported file types” error
messages to include `.py` (and consistent handling of related script
fields/options).
* **Tests**
* Expanded unit, integration, and GitOps tests to cover Python package
parsing, metadata derivation, platform/host eligibility, and UI
rendering.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#35075
- Added vulnerability (CVE) reporting for Android OS versions.
- Folded the Android security patch level into the host's OS version.
---------
Co-authored-by: Konstantin Sykulev <konst@sykulev.com>
**Related issue:** Resolves#37972
This also fixes the sort order of fleets for flee-level users.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the user menu to show the correct settings sections based on
account type and access level, with clearer separation between sections.
* **Bug Fixes**
* Fixed fleet sorting for fleet-level users.
* Corrected top navigation behavior so the menu only shows
role/tier-appropriate items.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44954
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Custom Host Vitals management (create/edit/delete, search) with
copyable variable tokens and per-host values.
* Show Custom Host Vitals on host details, including role-based editing.
* Enabled Custom Host Vitals in host-vitals labels and the activity
feed.
* Extended GitOps to manage global Custom Host Vitals declaratively
(including dry-run behavior).
* Split Controls → Variables into Global Variables and Custom Host
Vitals, including routing updates.
* **Bug Fixes**
* Improved validation and expansion of Custom Host Vital references
across scripts, profiles, installers, and deployments, with clearer
failures when values are missing or invalid.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#38806
Add an IT-admin naming convention for macOS/iOS/iPadOS hosts. An admin
sets a name template (e.g. "iPad $FLEET_VAR_HOST_HARDWARE_SERIAL") under
Controls > OS settings > Host names for a fleet or for "No team"; Fleet
resolves it per host, delivers it via an Apple `Settings`/`DeviceName`
MDM command, renames its own record on ACK, then verifies the name via
osquery (macOS) or a DeviceInformation refetch (iOS/iPadOS). Clearing
the template stops enforcement without renaming any host. Fleet Premium
only, mirroring disk encryption.
**Related issue:** Resolves#46959
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Apple account provisioning configuration UI in integrations
settings with token URL, client ID, and client secret fields.
* Added activity tracking for Apple account provisioning changes.
* **Documentation**
* Renamed integration settings labels for clarity: "Ticketing",
"Calendar events", "Certificate enrollment", "User mapping",
"Authentication (SSO)", and "Host status alerts".
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48571
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
No changes file as this is a subtask
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a Premium-only **Assets** tab to Configuration Profiles, with
JSON asset list, upload, download, copy, and delete (delete limited for
technician views).
* Added a Premium-only **Assets** entry to the command palette
configuration controls.
* Introduced a new **file-json** graphic type and enhanced user-scoped
profile indicators (with iOS/iPad-specific behavior).
* **Bug Fixes**
* Updated navigation so the **Assets** view opens consistently from
settings and the command palette.
* Improved visual alignment of tooltip/icon elements in asset and scope
displays.
* **Tests**
* Added coverage for Assets, upload/download/delete behaviors, and
related UI components.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Relates to #38670
Several fixes to the policy details page's "Automation runs" feed and
the labels modal:
- Empty state: when activity expiry is enabled, show the configured
retention window ("Automation history is retained for N days");
otherwise show a generic "Automation history will appear here".
- Details column focus: replace the deprecated `text-icon` button
variant
with `inverse`, and inset the keyboard-focus outline so it no longer
hugs the cell text or bleed into adjacent rows.
- Labels modal: render policy labels as react-router links (real
anchors)
instead of buttons, so they can be opened in a new tab via middle-click
or cmd/ctrl-click.
- Status filtering: make the installed_software and VPP
(installed_app_store_app) error/success conditions null-safe complements
of the displayed status, so every row shown under "All" appears under
exactly one of the status filters. Derive the VPP outcome from the
historical details.status (activities are terminal-only) rather than the
live verification columns, which mutate over the install's lifetime.
- Install output: surface the pre-install query output and post-install
script output as separate sections in the activity details modal, and
fall back to them in the grid preview when the install-script output is
empty (e.g. a pre-install-stage failure).
- Add a datastore test asserting the status filters partition the feed
(all = error ⊎ success) for every activity type.
**Related issue:** Resolves#48528
This keys the count, pagination, and the frontend row-combining on the
app's slug token (the prefix before `/`, shared across an app's platform
entries but distinct across apps). The count now equals the rows shown
in every view (macOS, Windows, All), and name-colliding apps stay as
separate rows.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Software listings now group platform-specific installers into a single
app row based on the app identifier, improving how macOS and Windows
entries appear together.
* **Bug Fixes**
* Apps with the same display name but different identifiers now stay
separate instead of being merged incorrectly.
* List counts and pagination now match the combined app view more
accurately across the software pages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#48530
Fixes wrong platform-title capitalization in the "Filtered" tag tooltip
on the Hosts and Vulnerabilities dashboard charts.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved chart tooltip text for host/platform filters, ensuring
branded platform names keep correct capitalization and combined lists
use correct punctuation.
* Refined chart tooltip/platform display mapping to avoid incorrect
capitalization variants.
* **New Features**
* Updated browser chart category labeling to show “Browsers” with
consistent capitalization.
* **Tests**
* Expanded ChartCard tests to validate platform tooltip line formatting
for single and multiple selections.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45710
# Checklist for submitter
- [x] Changes file added (`changes/45710-zorin-os-support`).
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops.
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes.
## Testing
- [x] Added/updated automated tests —
`server/vulnerabilities/oval/oval_platform_test.go` extended with Zorin
→ Ubuntu LTS mapping cases (16/17/18) plus an unknown-version case
(`Zorin OS 99` → `zorin_99`, which `IsSupported()` rejects).
- [x] QA'd all new/changed functionality manually — Zorin OS 17.0 and
18.1 hosts enrolled against a patched Fleet server, host details show
`platform=zorin`, software inventory populates, and OVAL CVE matching
produces results against the corresponding `ubuntu_2204` / `ubuntu_2404`
feeds.
## Database migrations
- N/A. No schema changes.
## New Fleet configuration settings
- N/A. No new settings.
## fleetd/orbit/Fleet Desktop
- N/A. Server + frontend only; no fleetd/orbit changes.
---
## Summary
Fleet previously logged `unrecognized platform` for Zorin OS hosts
(osquery reports `platform=zorin` from `/etc/os-release` `ID=zorin`).
The common workaround was running osquery with
`--force_platform=ubuntu`, which masquerades the host. This change adds
`zorin` as a first-class Linux platform alongside Ubuntu:
- **`server/fleet/hosts.go`** — register `zorin` in `HostLinuxOSs` and
`HostDebPackageOSs`
- **`server/datastore/mysql/linux_mdm.go`** — include Zorin in the Linux
disk-encryption summary query
- **`server/vulnerabilities/oval/oval_platform.go`** — map Zorin major
version to the underlying Ubuntu LTS OVAL feed (16 → 20.04, 17 → 22.04,
18 → 24.04). Unknown future versions fall through to an unsupported
`zorin_<major>` identifier so vulnerability scanning is skipped rather
than served stale data from an aging LTS feed.
- **frontend** — add `zorin` to `HOST_LINUX_PLATFORMS`, the
disk-encryption support list and type guard, the label platform
dropdown, and the icon mapping (Ubuntu icon, since no Zorin-specific
asset exists in the repo).
No new dependency, schema migration, or config setting. Reuses existing
Ubuntu OVAL feeds and the existing Ubuntu icon.
Diff is ~30 lines net across 9 files (8 patched + 1 `changes/` file).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Zorin OS as a supported Linux platform.
* Zorin hosts included in Linux disk-encryption summaries and treated as
disk-encryption capable.
* Zorin OS available as a selectable/filterable platform label and
considered DEB-install compatible.
* Vulnerability scanning enabled for Zorin 16→Ubuntu 20.04, 17→22.04,
18→24.04; unknown/future Zorin versions are marked unsupported and
skipped for CVE matching.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45712?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Fully resolves
https://github.com/fleetdm/fleet/issues/34591.
## Testing
- [X] QA'd all new/changed functionality manually.
<img width="533" height="454" alt="Screenshot 2026-07-03 at 10 40 37 AM"
src="https://github.com/user-attachments/assets/892fb548-21c6-467c-b270-65f1c9338fdc"
/>
<img width="1287" height="259" alt="Screenshot 2026-07-03 at 10 41
55 AM"
src="https://github.com/user-attachments/assets/d3528b0c-0d05-4ace-8512-ab363241b97c"
/>
<img width="1077" height="123" alt="Screenshot 2026-07-03 at 10 41
46 AM"
src="https://github.com/user-attachments/assets/249e80de-320c-48f3-962a-59c98c736c54"
/>
<img width="725" height="208" alt="Screenshot 2026-07-03 at 10 41 32 AM"
src="https://github.com/user-attachments/assets/361764cf-26fc-4a44-b5d6-489d883a392b"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added CachyOS Linux to rolling-release OS detection and reporting.
* Added a CachyOS fleetd package/image variant and a new CachyOS fleetd
service for local testing.
* **Bug Fixes**
* Improved rolling-release OS version labeling for host “Vitals”
display.
* Updated OS inventory normalization so CachyOS is aggregated with Arch
Linux, including correct “rolling” version handling.
* **Tests**
* Expanded OS version ingest test coverage for rolling-release and
CachyOS scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#25574
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
---
## Summary
- Adds a new `splunk` log plugin that sends osquery logs directly to
Splunk's HTTP Event Collector (HEC) endpoint
- Eliminates the need for middleware like AWS Firehose when using Splunk
as a log destination
- Follows the same pattern as existing log destinations (Firehose, Kafka
REST, NATS, etc.)
- Includes `insecure_skip_verify` option for environments with
self-signed TLS certs
## UI changes
Follows the same pattern as the NATS log destination PR (#36527) --
adding "Splunk" to the display name, tooltip, and TypeScript type union.
No new components, pages, or styles.
### Manage automations modal -- "Log destination: Splunk"
<img width="822" height="527" alt="image"
src="https://github.com/user-attachments/assets/2533207f-fa95-4364-8ee0-3c39cd3e8e4d"
/>
### Query details page -- "Log destination: Splunk"
<img width="1905" height="662" alt="image"
src="https://github.com/user-attachments/assets/069a5005-f95c-4562-a819-fd8bdcc349f7"
/>
### Tooltip on hover
<img width="639" height="348" alt="image"
src="https://github.com/user-attachments/assets/809a47a6-b82a-4f45-b731-77b2d2c87947"
/>
### Edit query form -- "sent to your log destination: Splunk"
<img width="451" height="814" alt="image"
src="https://github.com/user-attachments/assets/b78b9a57-1f0c-4413-8b7c-654de1fd40a2"
/>
### Save new query modal -- "sent to your log destination: Splunk"
<img width="536" height="698" alt="image"
src="https://github.com/user-attachments/assets/d0a0ab01-66fe-4d63-9190-9c5e840e456d"
/>
---
### How it works
The Splunk writer (`server/logging/splunk.go`) implements the
`fleet.JSONLogger` interface. On startup it performs a health check
against the HEC `/services/collector/health` endpoint. On each `Write()`
call, it wraps each log entry in Splunk's HEC event format (adding
`time`, `index`, `source`, `sourcetype`), batches them up to 1 MB, and
POSTs to `/services/collector/event` with the `Authorization: Splunk
<token>` header. If a batch exceeds 1 MB it flushes and starts a new
one. Events over 1 MB are dropped with a log warning. Transient errors
(HTTP 503) are retried with exponential backoff (up to 8 retries).
### Configuration
```yaml
osquery:
status_log_plugin: splunk
result_log_plugin: splunk
splunk:
url: https://splunk.example.com:8088
token: <HEC token>
index: main
source: fleet
source_type: fleet:json
insecure_skip_verify: false # set true for self-signed certs
```
Or via environment variables:
```
FLEET_OSQUERY_STATUS_LOG_PLUGIN=splunk
FLEET_OSQUERY_RESULT_LOG_PLUGIN=splunk
FLEET_SPLUNK_URL=https://splunk.example.com:8088
FLEET_SPLUNK_TOKEN=<HEC token>
FLEET_SPLUNK_INDEX=main
FLEET_SPLUNK_SOURCE=fleet
FLEET_SPLUNK_SOURCE_TYPE=fleet:json
```
### Files changed
- `server/logging/splunk.go` -- Splunk HEC log writer with batching,
retry, and health check
- `server/logging/splunk_test.go` -- 9 unit tests
- `server/logging/splunk_integration_test.go` -- 3 integration tests
against real Splunk (gated by env var)
- `server/logging/logging.go` -- Added `SplunkConfig` and `case
"splunk"` to factory
- `server/config/config.go` -- Added `SplunkConfig` struct and config
flags
- `cmd/fleet/logging.go` -- Wired Splunk config into logging builder
- `server/fleet/app.go` -- Added `SplunkConfig` type for API responses
(excludes token)
- `server/service/service_appconfig.go` -- Added `case "splunk"` to
logging plugin validation
- `frontend/interfaces/config.ts` -- Added `"splunk"` to LogDestination
type
-
`frontend/components/LogDestinationIndicator/LogDestinationIndicator.tsx`
-- Added Splunk display name and tooltip
- `docs/Configuration/fleet-server-configuration.md` -- Splunk config
documentation
- `docs/Get started/FAQ.md` -- Updated plugin list
- `articles/log-destinations.md` -- Updated Splunk section with native
HEC docs
- `changes/25574-splunk-log-destination` -- Change file
## Test plan
### Unit tests (9 tests)
- [x] `TestSplunkWrite` -- sends 3 events, verifies HEC format, auth
header, index/source/sourcetype
- [x] `TestSplunkWriteEmpty` -- empty logs don't trigger HTTP request
- [x] `TestSplunkServerError` -- HEC 403 propagates as error
- [x] `TestSplunkHealthCheckFailure` -- constructor fails on bad health
- [x] `TestSplunkRecordTooBig` -- oversized events (>1MB) are dropped,
normal events still sent
- [x] `TestSplunkSplitBatchBySize` -- logs exceeding 1MB batch limit are
split into multiple requests
- [x] `TestSplunkRetryOnServiceUnavailable` -- 503 retried with backoff,
succeeds on 3rd attempt
- [x] `TestSplunkRetryExhausted` -- after 9 attempts (1 + 8 retries)
returns error
- [x] `TestSplunkMissingConfig` -- empty URL/token returns descriptive
error
### Integration tests (3 tests, gated by `SPLUNK_INTEGRATION_TEST=1`)
- [x] `TestSplunkIntegration` -- 3 events sent via writer, queried back
from Splunk REST API
- [x] `TestSplunkIntegrationBatch` -- 100 events in one Write(), all
confirmed indexed
- [x] `TestSplunkIntegrationBadToken` -- bad token Write() returns 403
### End-to-end test (macOS ARM64, real osquery agent)
1. Started Splunk Enterprise, MySQL, Redis via Docker
2. Built Fleet server from this branch with
`--osquery_status_log_plugin=splunk`
3. Set up Fleet, enrolled a real osquery 5.23.0 agent on this MacBook
4. **83 real osquery status log events indexed in Splunk** with correct
source/sourcetype/index
5. Each event contained full osquery data (`hostIdentifier`,
`host_uuid`, `calendarTime`, `severity`, `message`, `decorations`)
### Splunk showing real osquery events from Fleet
<img width="1910" height="861" alt="image"
src="https://github.com/user-attachments/assets/192490bf-d594-4424-a3e3-a18306892873"
/>
Generated with [Claude Code](https://claude.ai/code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added native Splunk HEC logging destination for status, result, and
audit logs.
* Updated the log destination UI to display **Splunk** with a dedicated
tooltip.
* Added Splunk HEC configuration (URL/token/index/source/source type)
including TLS verification control.
* **Bug Fixes**
* Improved log delivery with batching, retries for temporary HTTP
failures, and safeguards for oversized events.
* **Tests**
* Added unit tests and optional integration tests covering routing,
batching, retries, and error scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Should Resolve#34591
# Checklist for submitter
- [x] Changes file added
## User Story
CachyOS lacks from vitals information such as :
* disk encryption status
* disk space
* IP & MAC Addresses
* Installed packages
## Summary
- Add CachyOS as a recognized Linux platform
## Tests
- [x] Enroll a CachyOS host and verify it appears as Linux in Fleet
- [x] Verify disk encryption status displays correctly
- [x] Verify pacman packages are queryable via `fleetd_pacman_packages`
table
- [x] Disk space, mac address, Public/Private IP are well reported
- [x] Script are well executed
- [x] No more errors in fleet service logs (level=error
msg="unrecognized platform" hostID=169 platform=cachyos)
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* CachyOS (Arch-based Linux distribution) is now recognized as a
supported platform, including disk encryption detection and LUKS
support.
* **Bug Fixes**
* Updated host vitals disk-encryption tooltip messaging so CachyOS uses
the correct Linux-specific copy.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: plop28 <plop28@noreply.com>
### 🥞 Stack (review/merge bottom-up)
1. #48164 — Activity types (FE+BE)
2. #48165 — Backend (cron + directory sync)
3. #48166 — Usage statistics
4. #48167 — fleetctl generate-gitops
5. **#48168 — Settings UI ⬅ this PR**
📄 Documentation is tracked separately in #48169 (targets
`docs-v4.89.0`).
---
## Summary
**PR 5 of 6.** **Settings UI**: the Google Workspace section in the IdP
providers card (`GoogleWorkspaceSection/`), interfaces, config mock, and
mutual-exclusion messaging with SCIM. Uses the new `notify` toast API.
> 🥞 **Stacked PR.** Base: `42915-gw-idp-vitals-4-gitops` (PR 4).
**Related issue:** Resolves#42915
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a Google Workspace identity provider configuration section in
the Integrations area (domain, admin impersonation email, and API key
JSON).
* Added premium-tier gating so non-premium users see the upgrade message
and do not see the Google Workspace section.
* **Bug Fixes**
* Improved Google Workspace form validation and submission, including
safe masking of the saved API key JSON and proper disconnect when
clearing all fields.
* **Tests**
* Added tests covering premium visibility, Google Workspace rendering,
pre-filled configuration, and masked API key behavior.
* **Style**
* Updated Identity Providers and Google Workspace section layout styling
for consistent spacing and sizing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
**Related issue:** Resolves#42797
Adds support for pre-install query, post-install script, and uninstall
script on script-only packages (`.sh` and `.ps1`) across the API, UI,
and GitOps; previously these were silently stripped. The install script
remains the uploaded file's contents (file-driven) and is shown
read-only. Automatic install stays unsupported for script-only packages.
- **API** (`POST`/`PATCH /software/package`): stop stripping the fields;
validate post-install and uninstall scripts for script packages
- **GitOps**: allow
`uninstall_script`/`post_install_script`/`pre_install_query` paths
inline in the team YAML for script-only packages
- **UI**: show advanced options for `.sh`/`.ps1`; install script shown
read-only
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Script-only packages (`.sh`/`.ps1`) now expose advanced
options—pre-install query, post-install script, and uninstall
script—consistently across the UI, REST API, and GitOps.
* Script-only packages display advanced options in the UI, and the
“Install script” editor can be made read-only where appropriate.
* **Bug Fixes**
* Preserved advanced option values for script-only packages during
upload, edits, and synchronization (including replace-file scenarios).
* Improved YAML generation and validation so supported fields are
included while unsupported ones are correctly rejected/omitted.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
### 🥞 Stack (review/merge bottom-up)
1. **#48164 — Activity types (FE+BE) ⬅ this PR**
2. #48165 — Backend (cron + directory sync)
3. #48166 — Usage statistics
4. #48167 — fleetctl generate-gitops
5. #48168 — Settings UI
📄 Documentation is tracked separately in #48169 (targets
`docs-v4.89.0`).
---
## Summary
**PR 1 of 6** — splits the Google Workspace IdP host-vitals feature into
a reviewable stack.
Adds the **activity types** for the Google Workspace integration,
frontend and backend:
- Backend: `added_google_workspace_integration`,
`edited_google_workspace_integration`,
`deleted_google_workspace_integration` (`server/fleet/activities.go`).
- Frontend: activity-feed rendering for those three types (`activity.ts`
enum + display names + `domain` detail; `GlobalActivityItem.tsx`
templates).
> 🥞 **Stacked PR.** Base: `main`.
**Related issue:** Resolves#42915
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for new Google Workspace integration activity entries:
added, edited, and deleted.
* Activity feeds now display the integration domain when available.
* New filter labels were added for these activity types.
* **Bug Fixes**
* Activity details now render Google Workspace integration events
correctly in the dashboard feed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#48334
The software title response now returns a per-version `filename` in
`fleet_maintained_versions`, and the Library version rows render each
version's own filename instead of the active installer's. Previously,
every cached-version row showed the active installer's filename because
the array didn't include one.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
**Related issue:** Resolves#47623
## Summary
Wires up the Fleet-maintained app version-pinning UI on the software
title details page:
- **Versions modal** — opened from Actions ▾ → Versions or the active
row's version badge. Choose *Automatically update to latest*, pin to an
exact version, or pin to a major version; pre-selected from the current
pin, and Save is disabled with a tooltip in GitOps mode.
- **Multi-row Library** — one accordion row per cached version; the
active/pinned row is badged (Latest / Pinned / Major version) and older
versions are dimmed.
- Adds `pinned_version` to the software-package interface and a
`version` field to the installer `PATCH` request.
Frontend only; targets the `feat/38504-auto-update-pin-rollback-fma`
feature branch (backend, layout, and accordion already merged there).
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
https://github.com/user-attachments/assets/f9822cfa-57d2-4f0c-9918-c5ee914f0431
**Related issue:** Resolves#45641
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. In other subtask.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added support for tracking and displaying “ran custom MDM command”
activities across dashboard and host activity feeds.
* Added custom MDM command detail modals with status-aware messaging,
actor attribution, target host, and relative “time ago” updates.
* Improved command name rendering by shortening long request types for
cleaner display.
* **Bug Fixes**
* Enhanced command status handling for additional Apple and Windows
status formats so icons and verbs display correctly.
* **Tests**
* Added coverage for custom MDM command rendering and command-status
helper behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
George Karr
