<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41277
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
## Summary
- Updates the `startedOn` date for the "Prepare Let's get you set up
meeting notes" ritual in `handbook/marketing/marketing.rituals.yml` from
`2025-05-30` (Friday) to `2026-03-05` (Thursday).
- This reflects the team's decision to move this ritual from Friday to
Thursday.
## Changes
- **File:** `handbook/marketing/marketing.rituals.yml` (line 65)
- **Old value:** `startedOn: "2025-05-30"` (a Friday)
- **New value:** `startedOn: "2026-03-05"` (a Thursday)
No other content was modified.
---
Built for [Brock
Walters](https://fleetdm.slack.com/archives/C08BTMFTUCR/p1773102062728929?thread_ts=1773088008.602969&cid=C08BTMFTUCR)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kilocode[bot] <kilocode[bot]@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41233
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
* Fixed pagination on the host software page to prevent the "Next"
button from being incorrectly disabled when a software title has
multiple installer versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds a comprehensive set of AI usage guidelines to the
company's communications handbook. The new section outlines which AI
tools are available, how they should be used responsibly, and provides
clear rules to protect confidential information and ensure
accountability for AI-generated work.
AI usage guidelines:
* Added a new "AI usage guidelines" section to
`handbook/company/communications.md`, covering responsible AI tool use,
available and integrated tools (Gemini, GitHub Copilot, Claude,
ChatGPT), and rules for expensing and accessing additional tools.
* Clarified that users are accountable for the accuracy and
appropriateness of any AI-generated output, including code, written
content, communications, and analysis.
* Established a strict prohibition on inputting confidential or private
company/customer information into personal or non-enterprise AI tools,
with concrete examples of what not to share.
* Provided guidance for situations of uncertainty, encouraging employees
to ask questions and seek clarification via management or the #help-it
Slack channel.
Resolves#33045
When creating or updating queries either via the API or Gitops, make
sure that the license is premium if the query is targeting a label.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41006
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
Added tests for using path, paths and inline declaration for reports,
policies and labels.
- [X] QA'd all new/changed functionality manually
- [x] tested that `path:` works for policies
- [x] tested that `paths:` works for policies
- [x] tested that incline declaration works for policies
- [x] tested that `path:` works for reports
- [x] tested that `paths:` works for reports
- [x] tested that incline declaration works for reports
- [x] tested that `path:` works for labels
- [x] tested that `paths:` works for labels
- [x] tested that incline declaration works for labels
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for glob patterns in path specifications within reports,
labels, and policies configuration sections.
* Enhanced validation and error handling for external file references.
* Improved logging and error messages during configuration parsing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38536
The final activity bounded context PR is in review:
https://github.com/fleetdm/fleet/pull/41194
So, I'm putting up the associated README up for review as well.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#28584
The correct fix for the bug was to add a migration to update existing
software rows to match the new naming convention. However, that should
have been done in Fleet 4.67, and that ship has already sailed.
See the issue description in the `Name changes and the rename problem`
of the doc.
Resolves#40813
* Added configurable body size limits for the `/api/osquery/log`,
`/api/osquery/distributed/write` and `/api/osquery/config` endpoints.
* Fixed false positive `PayloadTooLargeError` errors.
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
## Summary
- **Reverts PR #41257**: Claude Desktop should NOT have
`setup_experience: true` — it should not be automatically installed
during device setup. PR #41257 (which added `setup_experience: true` to
both macOS and Windows Claude Desktop entries) has been closed.
- **Updates Claude Desktop "up to date" policy version strings** to
match the latest fleet-maintained app catalog versions:
- macOS: `1.1.4328` → `1.1.5749` (from
`ee/maintained-apps/outputs/claude/darwin.json`)
- Windows: `1.1.4088` → `1.1.5368` (from
`ee/maintained-apps/outputs/claude/windows.json`)
## Changes
| File | Change |
|------|--------|
| `it-and-security/lib/macos/policies/update-claude.yml` | Version
`1.1.4328` → `1.1.5749` |
| `it-and-security/lib/windows/policies/update-claude.yml` | Version
`1.1.4088` → `1.1.5368` |
Closes#41257
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1773070240095919?thread_ts=1773069775.458399&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Removes the Company Portal software package from the Workstations team
- Removes the Company Portal SSO extension (extensible SSO)
configuration profile from the Workstations team
- Removes the "Conditional access test group" label that was used to
scope both Company Portal and the SSO extension
- Removes the `company-portal-installed` and
`entra-conditional-access-check` policies that were specifically for
Company Portal/Entra conditional access
- Removes the `create-conditional-access-allow-file.sh` and
`user-enroll-entra-company-portal.sh` scripts that were only used by the
removed policies/Company Portal
### Files deleted
-
`it-and-security/lib/macos/configuration-profiles/company-portal-sso-extension.mobileconfig`
- `it-and-security/lib/macos/software/company-portal.yml`
- `it-and-security/lib/macos/policies/company-portal-installed.yml`
-
`it-and-security/lib/macos/policies/entra-conditional-access-check.yml`
-
`it-and-security/lib/macos/scripts/create-conditional-access-allow-file.sh`
-
`it-and-security/lib/macos/scripts/user-enroll-entra-company-portal.sh`
- `it-and-security/lib/all/labels/conditional-access-test-group.yml`
### Files modified
- `it-and-security/teams/workstations.yml` — Removed references to
Company Portal software, SSO extension profile, related policies, and
the conditional access script
- `it-and-security/default.yml` — Removed the "Conditional access test
group" label definition
### Items intentionally kept
- `fleet-okta-conditional-access.mobileconfig` — This is an Okta-based
conditional access profile, not related to Company Portal/Entra SSO
- `conditional_access_enabled: true` in team settings — This is a
team-level integration setting, not Company Portal specific
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1773067955110849)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41012
# Details
This PR makes it allowable to leave out almost all top-level keys from
GitOps files. The only required keys are _either_ `name:` (for a fleet
settings file) or `org_settings:` (for a global settings file). Omitting
a key is identical to supplying it with no value.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
Updated the "missing all global keys test", and added some new tests to
verify that omitting the key was the same as supplying it with an empty
value.
- [X] QA'd all new/changed functionality manually
1. Ran `fleetctl generate-gitops` to get a clean set of GitOps yml files
2. Removed all removable keys from default.yml and ran `fleetctl gitops`
3. Ran `fleetctl generate-gitops` again into a different dir
4. Ran `fleetctl gitops` with the original files to get back to original
state
5. Cleared out all now-removable keys and replaced them with empty value
(e.g. `reports:` with nothing under it)
6. Ran `fleetctl generate-gitops` again into a third dir
7. Compared the files from the second and third generate-gitops runs to
verify that omitting the key had the same result as supplying it with an
empty value
8. Did the above steps with a fleet (i.e. non-global) .yml file.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* GitOps files now support omitting top-level configuration keys instead
of requiring them to be explicitly set to empty values.
* org_settings is now required when team name is not specified.
* **Tests**
* Added integration tests validating behavior when omitting top-level
keys in global and team-level GitOps configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40327
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#36682
- Added similar "not found" handling than the one we have when calling
`getHostScriptExecutionResultDB` within the `GetHostLockWipeStatus`
function for consistency => now return a 404 instead of a 500 when no
rows are returned.
- Applied similar changes to
https://github.com/fleetdm/fleet/issues/33090 (PR:
https://github.com/fleetdm/fleet/pull/40009) => logging an error instead
of returning a 404, so that the Host details page does not crash.
The actual fix would be to remove the `host_mdm_actions` record that
contains the orphan `lock_ref` mentioned in the issue.
I'm not sure what the root cause is, but I think setting up some
monitoring on the logs I added should help determining that.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
## Summary
- Adds Okta Verify as a custom package for x86 Windows workstations in
the Fleet GitOps configuration
- Creates `it-and-security/lib/windows/software/okta-verify.yml` using
the `$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` secret for the download URL
- Configures the app in `workstations.yml` with `self_service: true`,
`setup_experience: true`, the "Security" category, and scoped to
`x86-based Windows hosts` label
## Changes
1. **New file**: `it-and-security/lib/windows/software/okta-verify.yml`
— Software definition with the secret-referenced URL
2. **Modified**: `it-and-security/teams/workstations.yml` — Added Okta
Verify package reference under `software.packages` in the Windows apps
section
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772924912095649)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
This pull request updates the workstation team settings to ensure that
disk space policies are enforced across all major operating systems. The
most important change is the addition of specific policy IDs for
monitoring disk space on Linux, macOS, and Windows.
**Policy enforcement improvements:**
* Added `policy_ids` for disk space monitoring on Linux (`38244`), macOS
(`38230`), and Windows (`38239`) in the `team_settings` section of
`it-and-security/teams/workstations.yml`.
Added a section for the ExpedITioners podcast with episode details,
including dates, guests, and descriptions.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
