<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45163
# Details
Limits CVE data collection to only those CVEs which we report on in the
chart. This is a performance optimization necessitated by the large
amount of data that bigger fleets may generate. The plan is to implement
a data compression strategy so that we can go back to collecting full
CVE data soon.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] Ran some collection jobs and verified that only tracked CVEs were
represented in "open" rows.
- [ ] Ran load test w/ new code
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
should improve results!
- [X] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Enhancements**
* CVE vulnerability tracking is now scoped to a curated set of critical
vulnerabilities, improving the relevance of security impact data
displayed across your systems.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45247)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42405
Unreleased bug fix.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Android MDM profile detail messages (e.g., certificate status) are
preserved when adding additional profiles or marking profiles pending,
preventing loss of important status information.
* **Tests**
* Added an integration test verifying ONC/certificate detail is retained
when additional Android MDM profiles are uploaded for the same team.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45299)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Updated the build-static-content script to modify links to embedded
YouTube videos to use youtube-nocookie.com instead
- Removed unused video modals on the homepage and orchestration page
- Updated embedded video links to use youtube-nocookie.com instead of
youtube
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced privacy for embedded YouTube videos site-wide by switching to
a privacy-focused embed domain.
* **Bug Fixes**
* Removed several end-of-page video modals (homepage and observability)
and consolidated homepage content into a preferences-focused modal;
minor content cleanup including a hidden identifier for page handling.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45275)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44046
# Details
Updates GitOps to ensure that team labels are created before any
consumers (e.g. profiles, policies, software) that might use the labels
are applied. It does this by adding a new `afterTeamApply` callback
option to `ApplyGroup` that is called after team config is applied --
this is when team labels are now created, instead of after `ApplyGroup`
runs.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed GitOps deployments failing when a label and a profile that
references it are created in the same run.
* Ensures the correct apply ordering so dry-run/log output shows label
application before profile application.
* **Tests**
* Added a regression test validating label → profile apply ordering to
prevent future regressions.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45194)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Updated test fixtures for Apple VPP configuration in GitOps workflows
to better reflect real-world scenarios.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45305)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44801
Fixed remaining issue setting end user authentication in the UI.
The root cause was that the frontend was always sending
`enable_managed_local_account : false` even when macOS MDM was disabled.
Fix:
<img width="756" height="363" alt="image"
src="https://github.com/user-attachments/assets/5f88797d-c5c3-4c03-9048-c8ee2981c374"
/>
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Automatic syncing of "Lock end user info" when toggling End User
Authentication now only runs when Apple MDM is enabled and configured
(with an exception when EUA is being disabled to preserve behavior).
* Save payloads omit Apple-only fields unless Apple MDM is configured.
* **UI**
* "Lock end user info" checkbox shows an Apple MDM–gated tooltip and is
disabled when Apple MDM is not configured.
* **Tests**
* Added coverage for Apple MDM–gated behaviors and saved-payload
variations.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45212)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42026
- Show "uninstall" button if the status is `installed` (or
`recently_installed`) which just reflects that the install script ran
successfully, not that the software title for the installer is in the
software inventory. For example, even with a no-op install script that
exits successfully the button will be available.
- Make the status clickable by removing the recentlyTakenAction check,
since that only represents the last install script that ran. This should
only really affect the `recently_installed` status (according to claude
at least).
This behaviour is already possible through the API, but it mostly
depends on the specific uninstall scripts if they will pass or fail when
the software doesn't even exist.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Uninstall option now appears for installers even when the host
inventory lacks a matching software entry, ensuring uninstall remains
accessible.
* **Tests**
* Added regression tests verifying the uninstall button is visible and
enabled for relevant installed states, including on personal device
pages.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45273)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45220 (one of many small PRs)
## Testing
- [x] QA'd all new/changed functionality manually. (Ran basic smoke
testing.)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added a consolidated test utilities package to boot full test servers,
seed users, retrieve auth tokens, and provide common mocks for
integration/service tests.
* Updated integration and service tests to use the new helpers for more
consistent, reliable test setup and wiring.
* **Chores**
* Centralized and reorganized test configuration types and options, and
standardized test wiring for clearer, maintainable test setup.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45221)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add Jonathan Porter to the Customer Success team.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Adding documented profiles for PSSO simplified setup. These are
specifically for the macOS 26+ feature, though most of what's in them is
also applicable to lower versions
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Documentation**
* Added example configuration profiles for macOS SSO extension setup
with Entra and Okta platforms.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45157)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Part of #38790. Stacked on top of #44935.
Closes#43968.
The two activate functions are the only `InstallApplication` command
builders, so fetching configuration and substituting `$FLEET_VAR_*`
inside them covers every enqueue path (manual, self-service, policy
auto-install, scheduled auto-update, setup experience, retry, admin
reinstall) by construction. Documents this invariant on each function.
Adds integration tests asserting an iOS install enqueues
`<key>Configuration>` with the host UUID substituted in, and macOS
installs omit the field.
---------
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
Part of #38790. Stacked on top of #44934.
Closes#43967.
Adds `SubstituteFleetVarsInAppConfig` in `server/mdm/apple`, called from
`nanoEnqueueVPPInstall` and `activateNextInHouseAppInstallActivity`
right before the `InstallApplication` plist is built. Reuses
`profiles.ReplaceFleetVariableInXML` (XML-escapes substituted values)
and `profiles.ReplaceHostEndUserIDPVariables` for IDP fields.
Supports the full `FleetVarsSupportedInAppleAppConfig` allow-list:
`HOST_UUID`, `HOST_HARDWARE_SERIAL`, `HOST_PLATFORM`,
`HOST_END_USER_EMAIL_IDP`, `HOST_END_USER_IDP_USERNAME` / `_LOCAL_PART`
/ `_GROUPS` / `_DEPARTMENT` / `_FULLNAME`. Returns
`ErrUnresolvableAppConfigVar` when the host can't supply a referenced
variable (e.g. end-user IDP not enrolled) so the caller can fail the
install rather than send an empty value to the device.
Pulls `hardware_serial` onto the host SELECT so `HOST_HARDWARE_SERIAL`
is available without a second round-trip.
---------
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
Part of #38790. Stacked on top of #44933.
Closes#43966.
The `InstallApplication` MDM command for VPP and in-house (`.ipa`) apps
was assembled inline in SQL via `CONCAT`, which can't carry
per-(adam_id, team_id, platform) configuration. Move the assembly into
Go: new `BuildInstallApplicationCommand` helper in `server/mdm/apple`,
plus refactored `nanoEnqueueVPPInstall` and
`activateNextInHouseAppInstallActivity` to SELECT pending tuples,
bulk-fetch configurations, build per-host plist bytes, and batch-INSERT
into `nano_commands`.
For iOS / iPadOS, the `Configuration` dict is inlined when stored
configuration is present. macOS VPP installs always drop the field
regardless of input. Empty / absent configuration omits the
`<key>Configuration>` entry — Apple treats this as "clear any managed
config for this app on next apply."
`$FLEET_VAR_*` tokens in the configuration are passed through
unsubstituted in this PR; per-host substitution comes in #43967.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced Apple app installation handling with improved command
generation and configuration management for VPP and in-house app
deployments.
* **Tests**
* Added comprehensive test coverage for app installation command
generation.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44934)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
Part of #38790. Stacked on top of #44932.
Closes#43969.
`fleetctl gitops` reads `configuration.path` for iOS / iPadOS VPP apps
and in-house `.ipa` apps, validates the file via
`fleet.ValidateAppleAppConfiguration`, and stores the bytes through the
service layer.
`fleetctl generate-gitops` emits `configuration.path` for apps that have
a stored configuration, writing the XML to
`lib/<team>/software/<app-slug>-config.xml`. Apps without configuration
omit the block entirely.
Round-trip integration tests
(`cmd/fleetctl/integrationtest/gitops/software_test.go`) cover apply +
generate for both VPP and in-house, plus a negative case for invalid
configuration content.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added managed app configuration support for enterprise software
deployments through GitOps
* Configurations now support platform-specific formats: XML for
iOS/iPadOS, JSON for Android
* Configuration validation ensures compatibility and prevents invalid
variable references
* **Tests**
* Added integration tests for configuration handling in software
deployment workflows
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44933)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
Resolves#45256
In macOS:
before: 129 MB build/fleet, 58 MB build/fleetctl.
after: 86 MB build/fleet, 42 MB build/fleetctl.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] QA'd all new/changed functionality manually. (Basic smoke testing
of the binaries in macOS.)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Optimized binary sizes for fleet and fleetctl releases.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45260)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#43279
On the My device page (DeviceUserPage), the Location and MDM status rows
in the Vitals card rendered as <Button variant="link"> even though no
modal was wired up, so clicking did nothing while the link styling
implied otherwise.
Resolves#39727
Fixed bug on QueryDetailsPage's backPath() implementation, so the "Back
to host details" button does not followed the stale filteredQueriesPath
set when the user previously visited the reports page.
Added additional API endpoints for Account-driven User Enrollment for
iOS devices.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves
https://github.com/fleetdm/fleet/issues/44742
Part of #38790. Stacked on top of #44931.
Closes#43965.
Wires managed configuration through the existing REST endpoints (`POST
/api/.../app_store_apps`, `PATCH
/api/.../software/titles/:id/app_store_app`, in-house `.ipa` upload /
update). Validation runs at the service layer for iOS / iPadOS; macOS
VPP installs silently drop the field. Wire format: a JSON-encoded string
of the XML plist on POST/PATCH and on GET single-title responses (not
base64).
Includes `server/service/integration_apple_vpp_config_test.go` with
end-to-end coverage: add / update with valid plist, allowed
`$FLEET_VAR_HOST_UUID`, omit-field-no-change, **`configuration: null` →
row deleted** (regression test for the clear-on-null fix in #43964),
malformed XML → 422, disallowed Fleet variable → 422, and macOS
silent-drop pre- / post-validation.
Also drops a stray `fmt.Println("auth")` in `SoftwareTitleByID`'s
authorization-failure branch.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for managed app configuration on iOS/iPadOS devices
through VPP and in-house installers.
* Configuration now validates plist format and detects disallowed Fleet
variables.
* **Bug Fixes**
* macOS apps now correctly ignore configuration settings as expected.
* **Tests**
* Added comprehensive integration tests for Apple VPP and in-house
installer configuration workflows.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44932)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
Co-authored-by: Jonathan Katz <44128041+jkatz01@users.noreply.github.com>
Part of #38790. Stacked on top of #44930.
Closes#43964.
Adds VPP and in-house datastore methods (`GetVPPAppConfiguration`,
`BulkGetVPPAppConfigurations`, `DeleteVPPAppConfiguration`,
`HasVPPAppConfigurationChanged`, plus in-house equivalents) keyed on the
merged `vpp_app_configurations` and `in_house_app_configurations`
tables. Wires them into `InsertVPPAppWithTeam`, `SaveInHouseAppUpdates`,
and the team / app removal paths.
Two follow-up bug fixes folded into this branch:
1. iPadOS in-house apps received no configuration: a single `.ipa`
upload creates two `in_house_apps` rows but config was only stored
against the iOS row's id, so iPadOS lookups returned NotFound. Now
writes to both sibling rows on insert and propagates updates / clears
via `installerIDsForInHouseAppSibling`.
2. Single-app PATCH with `"configuration": null` was inserting empty
bytes instead of deleting; aligned the iOS/iPadOS branch in
`InsertVPPAppWithTeam` with the batch path's `len > 0` upsert / `len ==
0` delete semantics.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for managing in-house app configurations including
storage, updates, and deletion.
* Expanded VPP app configuration support for iOS/iPadOS platforms with
configuration storage and change detection.
* **Refactor**
* Updated Android app configuration handling to improve internal data
consistency and streamline configuration management workflows across all
app types.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44931)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
Closes: https://github.com/fleetdm/fleet/issues/45204
Changes:
- Updated the margins in the `purpose="feature-with-text"` divs on the
/device-management and /software-management pages
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43776
ESP (Enrollment Status Page) related fixes after manual QA.
Note that we have an email thread with Microsoft regarding improving the
UX of the ESP page/flow.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Windows MDM Enrollment Status Page (ESP) handling so
user-scoped provisioning nodes are created reliably during the
enrollment hold phase, reducing transient provisioning failures.
* On timeout paths, emit a canceled setup-experience activity for the
first pending/running setup item to ensure clearer provisioning state.
* **Tests**
* Strengthened tests to assert precise ESP command outputs and require
completion signals at both device and user scopes.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44740)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Konstantin Sykulev <konst@sykulev.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Add additional endpoints that need to be exposed to the public internet
for account-driven user enrollment.
Without these exposed, a user cannot enroll using account-driven user
enrollment.
Tested using our own internal Fleet instance.
Co-authored-by: Jordan Moore <jordan@unchained.com>
Co-authored-by: melpike <79950145+melpike@users.noreply.github.com>
**Related issue:** Resolves#44798
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Performance Improvements**
* Optimized Windows MDM profile removal operations for improved
performance when managing device profiles.
* **Bug Fixes**
* Enhanced Windows profile handling during host team transfers to ensure
correct profiles are properly installed and removed based on team
configuration.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45203)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#42930
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
Ready for review, pending
[this](https://fleetdm.slack.com/archives/C084F4MKYSJ/p1778593457182719)
UX question.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Host activity details are now recorded and displayed for every attempt
— including queued and pending retries — of script executions and
software installations triggered by policy automations.
* **Tests**
* Integration tests updated to assert activity creation for each failed
attempt and retry flows.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45233)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes#45024
## Summary
- Fixed the MDM SSO callback handler returning a `"missing profile:
missing profile"` error when an Android device enrolls via SSO (OTA
enrollment) on a Fleet instance that does **not** have Apple MDM
configured.
- Refactored all MDM SSO initiator magic strings (`"ota_enroll"`,
`"setup_experience"`, `"account_driven_enroll"`) into named constants
(`fleet.SSOInitiatorOTAEnroll`, etc.) to prevent typos and missed cases
— which is the class of bug that caused this issue.
## Code walkthrough
### The bug
The bug is in `ee/server/service/mdm.go` in
`mdmSSOHandleCallbackAuth()`.
**The flow:**
1. Android enrollment hits `/enroll?enroll_secret=xxx` → frontend calls
`InitiateMDMSSO` with initiator `"ota_enroll"`
(`server/service/frontend.go:248`)
2. User authenticates at the SAML IdP
3. The SSO callback arrives at `MDMSSOCallback` → calls
`mdmSSOHandleCallbackAuth`
4. After successful SAML auth, the function checks early-exit
conditions:
- Line 1133: account-driven enrollment (`originalURL ==
appleMDMAccountDrivenEnrollmentUrl`) → **no match** for OTA
- Line 1139: `Initiator != "setup_experience"` → **true** for
`"ota_enroll"` → enters the block
5. Line 1140: calls `getAutomaticEnrollmentProfile()` → returns `nil`
because **no Apple MDM is configured**
6. Line 1144–1146: `depProf == nil` → **returns `"missing profile"`
error**
Note that `MDMSSOCallback` (the caller) already has a guard at line 931
that correctly skips the Apple MDM verification for `/enroll?` paths:
```go
if !strings.HasPrefix(originalURL, "/enroll?") && ssoRequestData.Initiator != "setup_experience" {
if err := svc.VerifyMDMAppleConfigured(ctx); err != nil { ... }
}
```
But `mdmSSOHandleCallbackAuth` was missing the equivalent guard — it
unconditionally tried to fetch the Apple DEP profile for any
non-`setup_experience` initiator.
### The fix
Adds an early return for OTA enrollments (where `originalURL` starts
with `/enroll?`), matching the existing pattern for account-driven
enrollments right above it. OTA enrollments don't use the Apple DEP
profile token.
### The refactor
Replaced all raw initiator string literals across the backend with named
constants defined in `server/fleet/app.go`:
| Constant | Value | Used by |
|---|---|---|
| `fleet.SSOInitiatorOTAEnroll` | `"ota_enroll"` | `/enroll` page
(Android, BYOD iPhone/iPad) |
| `fleet.SSOInitiatorSetupExperience` | `"setup_experience"` | Orbit
agent (macOS Setup Assistant) |
| `fleet.SSOInitiatorAccountDrivenEnroll` | `"account_driven_enroll"` |
Apple account-driven MDM enrollment |
Constants are in `server/fleet/` (not `server/sso/`) so orbit can import
them without pulling in Redis dependencies.
**Files changed:**
- `ee/server/service/mdm.go` — 6 string replacements (switch cases +
comparisons)
- `server/service/frontend.go` — 1 replacement
- `orbit/cmd/orbit/orbit.go` — 1 replacement
- `server/service/testing_client.go` — 1 replacement
- `server/service/integration_mdm_test.go` — 1 replacement
## Local reproduction
### Setup
1. Started dev server: `build/fleet serve --dev --dev_license`
2. Infrastructure: MySQL, Redis, SimpleSAML IdP via `docker compose up`
3. Created admin user and enroll secret
4. Configured MDM SSO (`entity_id: mdm.test.com`, SimpleSAML IdP at
`localhost:9080`)
5. Set `enable_end_user_authentication: true` directly in DB (API blocks
this without Apple MDM — matches customer state)
6. **Did NOT configure Apple MDM** — only SSO + EUA, simulating
Android-only instance
### Steps
1. `GET https://localhost:8080/enroll?enroll_secret=test_enroll_secret`
→ 303 redirect to SimpleSAML IdP
2. Completed SAML login programmatically (user: `sso_user`, pass:
`user123#`)
3. `POST https://localhost:8080/api/v1/fleet/mdm/sso/callback` with the
SAMLResponse
### Before fix
```
=== CALLBACK RESULT ===
Status: HTTP/2 303
Location: /mdm/sso/callback?error=true
=== SERVER LOGS ===
ts=2026-05-08T16:53:49Z level=error component=http method=POST
uri=/api/v1/fleet/mdm/sso/callback took=12.148708ms
err="missing profile: missing profile"
```
### After fix
```
=== CALLBACK RESULT ===
Status: HTTP/2 303
Location: /enroll?enroll_secret=test_enroll_secret&enrollment_reference=7c67326c-...&initiator=ota_enroll&profile_token=
=== SERVER LOGS ===
ts=2026-05-08T17:27:54Z level=info component=http method=POST
uri=/api/v1/fleet/mdm/sso/callback took=15.973ms
```
No errors. Successful redirect back to the enrollment page with the
enrollment reference.
## Integration test
Added `TestOTAEnrollSSOWithoutAppleDEPProfile` which:
1. Configures SSO and creates a team with IdP enabled
2. **Deletes all Apple DEP enrollment profiles** to simulate an
Android-only instance
3. Runs the full OTA enrollment SSO flow (GET `/enroll` → SAML IdP login
→ callback)
4. Verifies the callback redirects to `/enroll?...` with
`enrollment_reference` and `initiator=ota_enroll` (not `?error=true`)
Confirmed the test **fails without the fix** (`err="missing profile:
missing profile"`) and **passes with the fix**.
Also added a `LoginOTAEnrollSSOUser` test helper that drives the
complete OTA SSO flow starting from `GET /enroll` through SAML IdP login
to the callback, using a single cookie jar.
## Test plan
- [ ] Verify Android SSO enrollment works on an instance with **only**
Android MDM configured (no Apple MDM)
- [ ] Verify Apple DEP enrollment with SSO still works (the DEP profile
path is unchanged)
- [ ] Verify Apple OTA enrollment with SSO still works (also uses
`/enroll?` path)
- [ ] Verify account-driven enrollment with SSO still works (has its own
early return)
- [ ] Verify setup experience SSO still works (uses `Initiator ==
"setup_experience"`)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Resolved a regression where OTA enrollment via SSO could return a
"missing profile" error on Android when Apple MDM is not configured; OTA
SSO now redirects correctly to the enrollment flow.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45046)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
## Summary
- Adds a new "Why think like a historian?" section to the [Why this
way?](https://fleetdm.com/handbook/company/why-this-way) handbook page.
- Explains why docs, issues, and plans should include context beyond
bare task descriptions — making them more discoverable in search, more
accessible for others to understand and contribute to, and more useful
for the company now and in the future.
- Includes a concrete before/after example: an agenda for a meeting
improved from "Write up scavenger hunt" to "Write up scavenger hunt for
SF party on May 12 celebrating launch."
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/C03U703J0G5/p1778589572377249?thread_ts=1778588885.302819&cid=C03U703J0G5)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
During the confirmation and celebration, we received feedback that the
current copy is confusing.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Clarified timeout/failure messaging for app installs: the modal now
states the install "took longer than {timeout}, so Fleet marked it as
failed," and the follow-up text clarifies the status will update if the
install finishes later.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45138)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
First PR in the staged plan from
[#33370](https://github.com/fleetdm/fleet/issues/33370#issuecomment-4394807680).
Adds unit tests for several testable helpers in `cmd/fleet/serve.go` —
argument stringification, TLS profile config, license initialization,
and the missing-migrations warning.
The migrations-warning test required threading `io.Writer` through
`printMissingMigrationsWarning` so it can pass `*bytes.Buffer` instead
of mutating `os.Stdout`. The other two database-state print functions
stay as-is since they aren't tested in this PR.
**Related issue:** Part of #33370 (intentionally not using auto-close
keywords since this is the first of multiple PRs against this issue).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
## Database migrations
_N/A — no database migrations in this PR._
## New Fleet configuration settings
_N/A — no new configuration settings._
## fleetd/orbit/Fleet Desktop
_N/A — no agent code changes._
Scott Gress
