## Summary
- Removes six anonymous case studies that are no longer needed:
open-source-software-company, interactive-entertainment-company,
financial-technology-company, open-source-organization,
global-saas-company, and online-marketplace.
- Deletes the 6 article markdown files from `articles/`, which
automatically removes them from the dynamically-rendered customers page
(`fleetdm.com/customers`).
- Removes 7 references to these case studies from
`handbook/marketing/fleet-social-proof.md`.
- Removes 3 redirect routes from `website/config/routes.js` that pointed
to the now-deleted case studies.
## Changes
| File | Change |
|------|--------|
| `articles/financial-technology-company.md` | Deleted |
| `articles/global-saas-company.md` | Deleted |
| `articles/interactive-entertainment-company.md` | Deleted |
| `articles/online-marketplace.md` | Deleted |
| `articles/open-source-organization.md` | Deleted |
| `articles/open-source-software-company.md` | Deleted |
| `handbook/marketing/fleet-social-proof.md` | Removed 7 table rows
referencing the 6 case studies |
| `website/config/routes.js` | Removed 3 redirect rules for deleted case
studies |
---
Built for [Irena
Reedy](https://fleetdm.slack.com/archives/D0APYC9R9SL/p1775761161561979)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Zed + Opus 4.6; prompt: Bump all DB migrations not merged to
`cherry-pick-40177-config-profile-name-status` to happen after the most
recent migration on that branch, while maintaining order otherwise, and
regenerate the test schema.
This pull request updates the handling of `.msix` package extensions in
the software installer logic to clarify support for Fleet-maintained
Windows apps and to ensure custom uploads of `.msix` files remain
unsupported. Test coverage is also expanded to explicitly check these
cases.
**Platform support changes:**
* Updated `packageExtensionToPlatform` in `software_installers.go` to
include `.msix` as a valid extension for Fleet-maintained Windows apps,
while maintaining that custom uploads of `.msix` files are still
rejected.
**Test coverage improvements:**
* Added test cases in `TestSoftwareInstallerPlatformFromExtension` and
`TestSofwareInstallerSourceFromExtensionAndName` to ensure `.msix` files
are correctly handled as unsupported for custom uploads.
[[1]](diffhunk://#diff-581f0146919318ed08c10123ad2f4585bfcfda40cba1dfcb20a65afc40259f32L164-R166)
[[2]](diffhunk://#diff-581f0146919318ed08c10123ad2f4585bfcfda40cba1dfcb20a65afc40259f32L214-R218)
Resolves#40177 and subissues.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [sorta] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Profile names are now displayed alongside mobile device management
commands for installing or removing profiles. These names are visible in
command details modals and within device activity timelines.
* Added "NotNow" status for deferred profile commands, providing
improved transparency into which profiles are being managed and the
current status of profile installation or removal operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Change Claude package from EXE to MSIX: update input metadata, replace
the installer script to provision the MSIX machine-wide and attempt
per-user registration, and rewrite the uninstaller to remove provisioned
and installed Appx packages (with best-effort package matching, timeout
handling, and safer error reporting). Update Windows output metadata:
bump version, update installer URL and sha256, and refresh
install/uninstall script refs to the new MSIX-based implementations.
Delete AdobeAcrobat.tsx (embedded PNG icon) and update icons index to
remove its import and map 'adobe acrobat' to the existing AcrobatReader
component, consolidating Acrobat icon usage.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43287
Changes:
- Added the `ee/fleet-agent-downloader` directory to the
`githubRepoDRIByPath` and `githubRepoMaintainersByPath` config values to
the website's custom configuration, and removed
`ee/bulk-operations-dashboard` (which was removed in the PR that added
that directory).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Adds the `host_managed_local_account_passwords` table to persist encrypted managed local admin account passwords and track MDM delivery status for ADE-enrolled macOS hosts (#42942).
## Summary
Fixes#42897
When Apple's APNs server sends an HTTP/2 GOAWAY frame, the push provider
panics with a nil pointer dereference at
`server/mdm/nanomdm/push/nanopush/provider.go`.
### The Bug
The code calls `http.Client.Do`, and when it returns a
`http2.GoAwayError`, it accesses `r.StatusCode` without checking if `r`
is nil. Per [Go's http.Client.Do
documentation](https://pkg.go.dev/net/http#Client.Do):
> On error, any Response can be ignored.
When `http.Client.Do` returns an error like `http2.GoAwayError`, the
response `r` can be nil, causing a panic when accessing `r.StatusCode`.
### The Fix
Added a nil check for the HTTP response before accessing `StatusCode`:
```go
if errors.As(err, &goAwayErr) {
body := strings.NewReader(goAwayErr.DebugData)
statusCode := 0
if r != nil {
statusCode = r.StatusCode
}
return &push.Response{Err: newError(body, statusCode)}
}
```
When `r` is nil (which is expected when a GoAway error occurs), the
status code defaults to `0`.
### Testing
- The fix is minimal and only adds a nil check — no behavioral changes
beyond preventing the panic.
- Verified `gofmt` passes on the modified file.
- Could not run `go build` or `go test` locally as the repo requires Go
1.26.1+ (which is not yet released).
---
*Note: I am an AI contributor. This PR was created to address issue
#42897 as flagged by @MagnusHJensen.*
---------
Co-authored-by: Bahtya <bahtayr@gmail.com>
Zed + Opus 4.6; prompt: Convert the InputField JSX component to
TypeScript and remove the ts-ignore directives that we no longer need
after doing so.
- [x] Changes file added
- [x] Automated tests updated
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [ ] QA'd all new/changed functionality manually
## Summary
- Comments out the Account Executive (EMEA) position in
`handbook/company/open-positions.yml` to remove it from the open
positions listing.
- The entry is preserved as YAML comments (not deleted) following the
same pattern used for other previously commented-out positions in the
file.
---
Built for [Isabell
Reedy](https://fleetdm.slack.com/archives/D0AEGJCGJR0/p1775740556107389)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds a new weekly ritual to the CEO handbook page: "Connect with
GitOps workshop attendees"
- Each week, the EA checks for completed GitOps workshops, pulls the
attendee list from Eventbrite, and sends blank connect requests from the
CEO to each attendee.
- DRI: @SFriendLee
Built for [Savannah
Friend](https://fleetdm.slack.com/archives/D0AK3T404H3/p1775586068675869)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
## Summary
- Clarifies in the MySQL docs intro that read replica configuration is
fully independent — no values are inherited from the primary config
- Adds explicit callout that `mysql_read_replica_region` must be set
separately when using IAM authentication
- Adds note to `mysql_tls_config` explaining that this setting is
typically not needed for RDS IAM auth since Fleet uses bundled RDS CA
certificates (including GovCloud regions)
These changes address real-world customer confusion where a GovCloud
deployment failed because `FLEET_MYSQL_READ_REPLICA_REGION` was not set
independently of `FLEET_MYSQL_REGION`.
Note: related to #39832
## Testing
Documentation-only change — no code impact.
Add script-only package documentation to the packages section.
Script-only packages (.sh and .ps1 files) are a supported package type
but had no example or guidance in the YAML configuration docs. This adds
a "Script-only" example after the existing URL and Hash examples,
documenting:
- Script-only packages must be configured inline in the team YAML file
- self_service, categories, labels, and icon are specified inline
- Script packages do not support install_script, uninstall_script,
post_install_script, pre_install_query, or automatic install
- Separate package YAML files are not currently supported for
script-only packages
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38647
<img width="398" height="230" alt="image"
src="https://github.com/user-attachments/assets/7e68e0d7-54b0-4039-a0be-8b0ad4bb1fbf"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43273
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- Added new test for this case (policies without software automation
being pushed by two different users), verified it fails on main and
passes on this branch
- [X] QA'd all new/changed functionality manually
- [X] Verified that changing `webhooks_and_tickets_enabled` on a policy
AND running gitops as another user doesn't wipe stats
- [X] Verified that changing `query` on a policy and running gitops does
wipe stats
- [X] Verified that changing `query` on a policy and running gitops does
wipe stats
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue where policy stats were incorrectly reset during GitOps
policy updates. Policy statistics now remain accurate when policies are
re-applied without modification to installation or script
configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41484
Unreleased bug.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **License Enforcement Updates**
* Team-scoped Mobile Device Management operations now require a premium
license. Free-tier users will receive an error when attempting to create
or manage team-level MDM declarations and profiles.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Register AWS VPN Client in fleet configs: add an IdP group label (IdP
group: SAML-aws-vpn), include that label in default.yml, and add
aws-vpn-client/darwin to fleet_maintained_apps (self_service=true,
labeled for the SAML-aws-vpn group). Add a dynamic label for macOS hosts
with AWS VPN Client installed (bundle id com.amazonaws.acvc.osx) and add
a macOS patch policy to surface/update hosts with out-of-date AWS VPN
Client. These changes enable inventorying, self-service installation,
and patch tracking for the AWS VPN Client.
Steven Palmesano