## Summary
- Removes Brock Walters (Product Education Manager) from the marketing
team table in `handbook/marketing/README.md`
- Removes Brock Walters' row from the marketing responsibilities table
in `handbook/marketing/marketing-responsibilities.md`
No other content was modified.
Built for [Isabell
Reedy](https://fleetdm.slack.com/archives/D0AEGJCGJR0/p1774032215052769)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Adds `docs/solutions/api-scripts/sync_jamf_users_to_fleet.py`, a Python
script that:
- Scrapes every computer in Jamf Pro via the Classic API
(`/JSSResource/computers/subset/basic`)
- Pulls the assigned user's email (falls back to username if no email is
set)
- Matches each device to a Fleet host by serial number
- Assigns that user to the host in Fleet via `PUT
/api/v1/fleet/hosts/:id/device_mapping`
Features:
- Supports both OAuth 2.0 client credentials and username/password auth
for Jamf
- `--dry-run` flag to preview changes without modifying Fleet
- Summary statistics on completion (assigned, skipped, errors)
Resolvesfleetdm/confidential#14972
## Summary
Fixes all errors and warnings reported by the [W3C Feed Validation
Service](https://validator.w3.org/feed/check.cgi?url=https%3A%2F%2Ffleetdm.com%2Frss%2Farticles)
for the `/rss/articles` endpoint (and all other `/rss/:categoryName`
endpoints).
## Changes
Only one file modified: `website/api/controllers/download-rss-feed.js`
### Errors fixed
- **`lastBuildDate` not RFC-822 format**: Changed from `new
Date(Date.now())` (which produces JS `toString()` format like `Thu Mar
19 2026 14:45:30 GMT+0000 (Coordinated Universal Time)`) to `new
Date().toUTCString()` (which produces RFC-822 format like `Thu, 19 Mar
2026 14:45:30 GMT`)
- **`pubDate` not RFC-822 format** (431 occurrences): Changed from
`.toJSON()` (ISO 8601) to `.toUTCString()` (RFC-822)
- **Missing channel `<link>` element**: Added `<link>` element at the
channel level pointing to the category page
### Warnings fixed
- **Missing `guid` on items** (431 occurrences): Added `<guid
isPermaLink="true">` to each item using the article's permalink URL
- **Missing `atom:link` with `rel="self"`**: Added `xmlns:atom`
namespace to the `<rss>` element and an `<atom:link href="..."
rel="self" type="application/rss+xml"/>` element in the channel
### Additional fix
- Fixed a minor bug where the image `<link>` URL was missing a `/`
separator between the domain and category name (`fleetdm.comarticles` →
`fleetdm.com/articles`)
### Not addressed
- The "Invalid HTML: Named entity expected" warning about `'`
entities in descriptions. This is produced by Lodash's `_.escape()`
which correctly escapes apostrophes for XML content. The `'` entity
is valid XML — the validator flags it only in an HTML parsing context,
and it does not affect feed validity or reader interoperability.
---
Built for [Brock
Walters](https://fleetdm.slack.com/archives/C097P4TAPRR/p1773932018039599)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
1. Added DB metrics via otelsql.RegisterDBStatsMetrics()
`db.sql.connection.open`
`db.sql.connection.max_open`
`db.sql.connection.wait`
`db.sql.connection.wait_duration`
`db.sql.connection.closed_max_idle`
`db.sql.connection.closed_max_idle_time`
`db.sql.latency.*`
2. renamed these metrics to signoz convention/expected names
`db.sql.connection.open` -> `db.client.connection.usage`
`db.sql.connection.max_open` -> `db.client.connection.max`
`db.sql.connection.wait` -> `db.client.connection.wait_count`
`db.sql.connection.wait_duration` -> `db.client.connection.wait_time`
`db.sql.connection.closed_max_idle` -> `db.client.connection.idle.max`
`db.sql.connection.closed_max_idle_time` ->
`db.client.connection.idle.min`
3. created custom dashboard to display these metrics, (import via json)
<img width="1580" height="906" alt="Screenshot 2026-03-19 at 2 44 43 PM"
src="https://github.com/user-attachments/assets/f1b64ed6-e534-4490-8955-bc1205dd21d4"
/>
4. Fixed metrics for service db dashboards
Signoz expects
`db.system` : Identifies the database type (e.g., postgresql, mysql,
mongodb).
`db.statement` : The actual query being executed (e.g., SELECT * FROM
users).
`db.operation` : The type of operation (e.g., SELECT, INSERT).
`service.name` : The name of the service making the call.
We needed to set the `db.system` attribute explicitly.
`db.operation` is missing because otelsql doesn't capture this by
default. Decided not to add this for now as the dashboards work without.
Can be a future enhancement.
<img width="1563" height="487" alt="Screenshot 2026-03-19 at 2 45 18 PM"
src="https://github.com/user-attachments/assets/51028e16-ee2c-45a9-9025-26f17b0db67a"
/>
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added a new observability dashboard for database and connection
performance metrics, including RPS, latency, connection pool saturation,
and queue statistics.
* Enhanced database metrics collection with automatic registration of
connection and query performance indicators.
* Standardized OpenTelemetry metric naming to align with industry
conventions for improved observability compatibility.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41672
# Details
Updates GitOps label functionality so that omitting the `hosts:` key
under a manual label will _not_ clear hosts from that label, but will
instead preserve the existing membership. This allows users to manage
manual hosts with an external system (via the labels API), while still
managing the labels themselves in GitOps.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] verified that you can still add a manual label with `hosts:`
- [X] verified that leaving `hosts:` off a manual label doesn't change
the host assignment
- [X] verified that putting `hosts:` with no value on a manual label
clears the hosts
- [X] verified that you can still add a dynamic label
- [X] verified that generate-gitops still exports manual hosts
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41586
The fix is speculative since I wasn't able to find/get the "Admin By
Request" app to install.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed false-positive vulnerability reports for "Admin By Request" on
macOS and Linux. Vulnerabilities CVE-2019-17201 and CVE-2019-17202 are
Windows-specific and will now only be reported on Windows systems,
eliminating unnecessary alerts on other platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41603
# Details
Fixes an issue where the nested `query` key in the get, create and
update query API responses, which is the literal SQL query, was getting
duplicated into a `report` key with the SQL. This was happening because
our JSON field duplicator which adds the renamed version of deprecated
keys to responses is intentionally naive; it doesn't account for cases
where the parent and child structs have the same key with different
meanings because that is... not ideal. In Fleet 5 we won't have this
problem since it'll just be `report.query`, but for now the solution is
to just hard-code a `Report` field onto the response structs, rather
than over-complicate the duplicator code to account for different
nesting levels.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] verified no `query.report` or `report.report` present in get query
response
- [X] verified no `query.report` or `report.report` present in create
query response
- [X] verified no `query.report` or `report.report` present in modify
query response
Updating actions/setup-go to v6.3.0 from a mix of different versions.
This gets us faster CI runs, with improvements such as:
- built in Go module cache AND Go build cache (separate cache no longer
needed)
- using go.mod resulting in fewer cache invalidations
- faster Node 24 runtime
- using go.dev download URL, which is more reliable
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#39968
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35067
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed MSRC vulnerability scanning on Windows hosts with empty display
version data, ensuring CVEs are now correctly retrieved instead of
returning zero vulnerabilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42092
Renamed the major anonymous functions so that NilAway analyzes them.
Disable whitespace differences when reviewing.
lint-incremental catches issues that were there already. Not a concern.
Main doesn't run lint-incremental, so we can merge with errors.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
## Summary
- Moved the "Monitor compliance tests" (Vanta) responsibility section
from the Finance department handbook page to the IT department handbook
page.
- Moved the corresponding "Vanta check" ritual entry from
`finance.rituals.yml` to `it.rituals.yml`, updating the `moreInfoUrl` to
point to `handbook/it#monitor-compliance-tests` and the label to
`:help-it`.
- Updated the GitHub label reference in the responsibility text from
`:help-finance` to `:help-it`.
- Added a backward-compatible stub on the Finance page redirecting old
links to the new IT location.
## Changes
| File | Change |
|------|--------|
| `handbook/finance/README.md` | Removed "Monitor compliance tests"
section; added redirect stub |
| `handbook/it/README.md` | Added "Monitor compliance tests" section
under Responsibilities |
| `handbook/finance/finance.rituals.yml` | Removed "Vanta check" ritual
entry |
| `handbook/it/it.rituals.yml` | Added "Vanta check" ritual entry with
updated URL and label |
---
Built for [Isabell
Reedy](https://fleetdm.slack.com/archives/D0AEGJCGJR0/p1773933615134779)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Isabell Reedy <113355639+ireedy@users.noreply.github.com>
- **DB migration: Add `require_all` column to installers labels tables
(#41279)**
- **Backend: Support labels_include_all for installers/apps (#41324)**
- **ui impl for labels include all (#41836)**
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#39916
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
## New Fleet configuration settings
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#34433
It speeds up the cron, meaning fleetd, bootstrap and now profiles should
be sent within 10 seconds of being known to fleet, compared to the
previous 1 minute.
It's heavily based on my last PR, so the structure and changes are close
to identical, with some small differences.
**I did not do the redis key part in this PR, as I think that should
come in it's own PR, to avoid overlooking logic bugs with that code, and
since this one is already quite sized since we're moving core pieces of
code around.**
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Faster macOS onboarding: device profiles are delivered and installed
as part of DEP enrollment, shortening initial setup.
* Improved profile handling: per-host profile preprocessing, secret
detection, and clearer failure marking.
* **Improvements**
* Consolidated SCEP/NDES error messaging for clearer diagnostics.
* Cron/work scheduling tuned to prioritize Apple MDM profile delivery.
* **Tests**
* Expanded MDM unit and integration tests, including
DeclarativeManagement handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40910
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
Closes: https://github.com/fleetdm/fleet/issues/41799
Changes:
- Added support for a new required meta tag for anonymous case study
articles: `cardTitleForCustomersPage`. The value of this meta tag is
used as the title of the automatically generated card link for the
article on the /customers page.
- Added support for a new meta tag for anonymous case study articles:
`cardBodyForCustomersPage`. If provided, the card link for the article
will use this value for the body text, if not provided, the card link
will display the `articleTitle` meta tag value.
- Updated the /customers page to automatically create card links for
case study articles that have `useBasicArticleTemplate` and
`cardTitleForCustomersPage` meta tags.
