<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
Fixing/enabling these zizmor checks:
- dependabot-cooldown
- secrets-inherit
- unpinned-uses
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Refined secret handling in CI test workflows: replaced inherited
secrets with explicit secret mappings and conditional forwarding
(scheduled runs vs others).
* Declared additional callable secrets for the reusable test suite: a
GitHub token and a Slack webhook for scheduled-run notifications.
* Updated blocking gate configuration: adjusted which rules are shown as
disabled and updated finding count comments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Disabled Go toolchain/module caching across CI build, release, and
publish workflows.
* Disabled Node package-manager caching in relevant publish workflows.
* **Security**
* Re-enabled the cache-poisoning gate rule so cache-poisoning checks can
now block failing runs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- "encourages" in the "Why handbook-first strategy?" section was linked
to a youtube video that is now set to private, so the link should be
removed.
- Link describing editing in markdown was linking to the main company
page instead of to the markdown section of the writing page.
### Not sure if small text changes need to be documented in the
changelog? I can add this item if needed.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
Noting for next time: I'll make sure to give my branch an actual name
that means something. 🤣
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42508
Renames abm/apple_business_manager to ab/apple_business in API and
fleetctl. Uses existing renameto logic with a slight twist: added
"inline" option to handle cases particularly where a single object tree
has renames in multiple versions so that we don't break backwards
compatibiility since the default behavior when you have multi-level
renames is a new/old split at the top level
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Canonical Apple Business (AB) API endpoints and CLI:
/api/v1/fleet/ab_tokens, /api/v1/fleet/mdm/apple/ab_public_key, plus new
fleetctl get mdm-ab and fleetctl generate mdm-ab
* New GitOps/config key: mdm.apple_business
* Admin UI updated to show Apple Business tokens with fleet-based
associations and updated labels
* **Deprecations**
* Legacy ABM endpoints, CLI aliases, and config keys remain supported
but emit deprecation warnings pointing to the new AB equivalents
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#42818.
(I explicitly removed all checklist items.)
This is the least destructing approach to solve the issue.
Other approaches require like moving all Go code under a sub-directory
or keeping these docs/ directories free from invalid characters.
## Problem
[Publishing of Fleet's go
module](https://github.com/fleetdm/fleet/actions/runs/23857371168/job/69554220876)
is failing with the following error:
```
Run GOPROXY=proxy.golang.org go list -m github.com/fleetdm/fleet/v4@v4.83.0
go: github.com/fleetdm/fleet/v4@v4.83.0: reading https://proxy.golang.org/github.com/fleetdm/fleet/v4/@v/v4.83.0.info: 404 Not Found
server response:
not found: create zip: docs/solutions/windows/configuration-profiles/allow network connectivity during connected standby – [ACConnectivityInStandby_2, DCConnectivityInStandby_2].xml: malformed file path "docs/solutions/windows/configuration-profiles/allow network connectivity during connected standby – [ACConnectivityInStandby_2, DCConnectivityInStandby_2].xml": invalid char '–'
[Truncated: too long.]
```
## Summary
Root cause
The [publish go module
step](https://github.com/fleetdm/fleet/blob/main/.github/workflows/publish-go-module.yml)
asks proxy.golang.org to build a module zip for the v4.X.Y tag. That
build was failing on two independent, each-fatal issues — both stemming
from the monorepo carrying non-Go content that violates Go module zip
rules:
1. Invalid path characters — 35 tracked files with characters Go module
zips forbid: en-dash – in 32
docs/solutions/windows/configuration-profiles/*.xml files (the one in
your error), emoji 📜 in 2 handbook/company/legal/ files, and an
apostrophe in 1 website/assets/ image. This is the literal create zip: …
invalid char '–' error.
2. Source tree too large — 582 MiB tracked vs Go's hard 500 MiB limit;
website/ alone is 318.7 MiB.
## Fix
Added a go.mod to website/, docs/, and handbook/, turning each into a
nested module that x/mod/zip omits from the published v4 module — the
same pattern Fleet already uses under tools/. One move solves both: all
35 bad filenames live in those three dirs, and excluding them drops the
module to 207 MiB tracked → 112 MiB zipped.
Files created:
- website/go.mod, docs/go.mod, handbook/go.mod (module markers, each
with a comment explaining why)
Verified safe: no .go files and no //go:embed references in those dirs,
and go list ./... still resolves all 491 packages.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added standalone module configurations for documentation, handbook,
and website directories.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Adds a load test metrics tool under
[`tools/loadtest/metrics/`](tools/loadtest/metrics/) for capturing and
comparing AWS CloudWatch metrics across Fleet load test runs.
- **`collect-metrics.sh`** — discovers a load test environment's AWS
resources from its Terraform workspace name, pulls CloudWatch metrics
over a lookback interval, and writes a `.json` data file plus a
human-readable `.md` synopsis (with threshold alerts). Supports a
`--category` flag (`baseline` | `migration` | `mdm`) that files output
under `runs/<category>/<workspace>/`.
- **`compare-metrics.sh`** — diffs two or more runs side by side and
flags deltas as `ok` / `WARN` / `ALERT`. Searches `runs/` recursively,
and `--filter` doubles as a category selector thanks to the naming
conventions.
- **`runs/`** — committed historical runs, organized by category:
`baseline/`, `migration/`, `mdm/`.
- New `README.md` documenting usage, run organization, and how to submit
results; linked from the root `tools/README.md`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automated metrics tooling for AWS load-test environments —
collects ECS/RDS/Redis/ALB/network metrics, Performance Insights
top-SQL, CloudWatch Logs error samples, produces consolidated JSON +
Markdown summaries, and performs threshold checks with alerts.
* Added a metrics comparison tool to detect regressions across runs with
run selection, deduplication, per-metric comparisons, percent-change,
and aggregated alert synopsis.
* **Tests**
* Added numerous baseline and sample load-test metrics reports covering
multiple workspaces, intervals, and scenarios for validation and
regression analysis.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#36087 (one of several PRs).
## Testing
- [x] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Dry-run support when creating secret variables.
* **Improvements**
* Standardized API models for secret-variables and targets for more
consistent behavior.
* List secret variables now includes pagination metadata.
* More consistent error reporting across secret-variables and targets
APIs.
* Target search/count behavior refined: pre-selected built-in labels are
omitted as expected.
* **Tests**
* Integration tests updated to validate the new request/response
behavior and target-selection logic.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46196?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced file-path validation for improved handling
* Resolved Fleet Desktop startup issues on openSUSE Leap systems
* Updated Orbit identifier token rotation behavior
* **New Features**
* Added Adobe plugins detection table to identify plug-ins on macOS and
Windows
* **Chores**
* Updated Go version to 1.26.3
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This workflow has been flaky for years.
I've added inline comments explaining the changes.
This is important as a regression test now that we get more code changes
(AI) to review in fleetd.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Bumped osquery used in integration tests (5.9.1 → 5.23.0).
* Release tooling now updates the integration-test workflow when
releasing osqueryd.
* **Tests**
* Improved integration tests: refined trigger paths, separated service
startup, skipped frontend bundling for faster CI, more robust
host-enrollment detection and teardown.
* Limited package build targets (removed RPM) and added sparse checkout
for macOS uninstall script.
* **Stability**
* Added macOS osquery warm-up to prevent startup timeouts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46722
This PR modifies both the FE and BE so that we do not fire a single
request for each software policy automation row. Instead, we build the
custom icon url (if any) into the main `policies` endpoint response.
This also prevents 404ing when there's no custom icon uploaded for the
associated software title.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
#### Before (main branch)
https://github.com/user-attachments/assets/fa358e90-dc08-45e0-8c4d-b8a8b57a6c98
#### After
https://github.com/user-attachments/assets/4ca7b931-a10b-4d57-96b1-ba5a88e04de5
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Policy automations now show software icons when available (custom
installer icons, VPP app icons, and patch icons), sourced from the
server with graceful fallback when missing.
* **Tests**
* Added/updated tests to verify icon propagation and rendering behavior
across policy lists and automation views.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Fleet version bumped to v4.86.1 across Helm charts, Terraform
configurations, and fleetctl package manager to ensure consistent
deployment versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated maintained application versions: Opera to 132.0, Prisma
Browser to 149.10.3.53, Stats to 2.12.16, Tor Browser to 15.0.15, and
Visual Studio Code to 1.123.0 with corresponding installer URLs and
integrity checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added SF Symbols application support for macOS with automated version
detection and comprehensive installation/uninstall management
capabilities.
* Integrated SF Symbols icon component to the software catalog user
interface for improved visual identification and user experience.
* SF Symbols is now registered as a managed application with
Productivity category classification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added VirtualBuddy application to the supported software catalog for
macOS (Apple Silicon compatible).
* Users can now discover, install, and manage VirtualBuddy with
automated installation and uninstallation capabilities.
* Version 2.1 is available with integrated app icon and security
verification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A
Restores the "Wipe pending" and "Wiped" status badges for Linux hosts on
the host details page.
These badges were requested to be hidden as part of work on #43116 and
later requested to be re instated after review.
Manually tested by triggering a wipe on a Linux host and confirming the
badge appears correctly.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Linux hosts now correctly display device wipe status in the host
details view. Wipe status indicators such as "Wipe pending" and "Wiped"
now appear consistently across all platforms. Previously, this
information was not visible for Linux hosts, resulting in incomplete
status visibility during device operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45180
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* MDM profiles can combine label inclusion (include-all/include-any)
with exclusion (exclude-any) so you can target hosts by labels while
excluding specific labeled hosts.
* Profile validation now enforces a single include-mode and explicitly
rejects any label used in both include and exclude lists.
* **Bug Fixes**
* Deleting a label that’s referenced by an MDM configuration profile or
declaration is blocked and returns an error to prevent broken targeting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated 8x8 Virtual Office macOS application metadata from version
8.33.2 to 8.34.1, including updated installer package and verification
checksum.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Extracts the Apple MDM initialization out of `runServeCmd` into testable
functions in a new `cmd/fleet/mdm_apple.go`. Continues the chain of
extractions on this issue (#44929, #45343, #45583, #46166, #46421)
toward the `serve.go` >60% coverage target discussed on #33370.
Five functions come out of the inline block:
- `initAppleMDMStorages` — constructs the MDM, DEP, and SCEP storages.
- `initAppleMDMPushService` — picks the no-op pusher under
`FLEET_DEV_MDM_APPLE_DISABLE_PUSH=1`, otherwise the real APNs pusher.
- `checkMDMAssetsExist` — promotes the inline `checkMDMAssets` closure
to a package function. It was already used at several call sites; they
now all share this one.
- `reconcileAppleMDMAPNsAndSCEPAssets` / `reconcileAppleMDMABMAssets` —
the APNs/SCEP and ABM asset reconciliation blocks.
Behavior is preserved — `runServeCmd` calls these in the same order with
the same arguments, and the full `cmd/fleet` suite passes unchanged
against MySQL + Redis. Each function returns early after `initFatal` so
it's also safe when the caller's `initFatal` doesn't terminate (the case
in tests).
On test scope: the new unit tests cover the dev-mode push gate, all four
branches of `checkMDMAssetsExist`, and the no-op and missing-private-key
paths of both reconcilers. The storage construction and the actual
asset-insert paths need a real datastore, so those stay covered by the
existing integration tests rather than new unit tests — I didn't want to
stand up a full datastore mock for paths that are already exercised
end-to-end.
**Related issue:** Refs #33370
# Checklist for submitter
- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Apple MDM initialization and configuration management for APNs,
SCEP, and Apple Business Manager with automatic reconciliation of
missing assets and a dev-mode option to disable push.
* **Tests**
* Added unit tests covering push-service behavior, asset-existence
checks, reconciliation logic, and fail-fast handling when required key
material is missing.
* **Refactor**
* Simplified Apple MDM initialization flow by extracting initialization,
push-service, and reconciliation logic into helpers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#46190
- Added a package init() to load the catalog from the embedded YAML
once.
- Init() now no longer runs any initialization logic just validation, so
it was renamed to Validate.
Fixes#46639
Hard-coded "/" and "/login" strings bypassed the URL prefix when Fleet
is deployed behind a reverse proxy at a subpath. Replaced with
PATHS.ROOT / PATHS.LOGIN, which embed URL_PREFIX, so redirects now land
at the correct subpath.
Fixes#46640
The root IndexRedirect used an absolute path ("/dashboard"), causing
React Router to push /dashboard to history regardless of the URL prefix.
This made the app fall through to the 404 route when Fleet was deployed
at a subpath (FLEET_SERVER_URL_PREFIX). Removing the leading slash lets
React Router resolve the redirect relative to the mounted route.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated application package definitions for 14 software applications
including 8x8 Work, AWS CLI, Chrome Remote Desktop, Claude, DBeaver
Community, Duo Desktop, Genesys Cloud, GitHub Desktop, GitKraken, Google
Chrome, Ollama, and Postman to their latest available versions with
corresponding installers and checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#45182
## What this does
Changes the foreign key constraints on
`mdm_configuration_profile_labels` and `mdm_declaration_labels` from `ON
DELETE CASCADE` (or no restriction) to `ON DELETE RESTRICT`. This
prevents a label from being deleted while it is still referenced by an
MDM configuration profile or declaration.
Previously, deleting a label that was targeted by a profile would
silently remove the label reference, leaving the profile in a \"broken\"
state in the UI (showing a \"Label deleted\" warning with no way to
recover without re-uploading the profile). With this change, Fleet
returns an error when attempting to delete a label that is in use by a
profile, prompting the user to remove the profile's label targeting
first.
## Why
This is part of a broader set of changes (CPIE include/exclude label
targeting) that introduces combined include+exclude label targeting on
profiles. Allowing silent label deletion would cause ambiguous broken
states when both include and exclude labels are in use on a single
profile.
## Testing
- Migration tested via the accompanying `_test.go` file, which covers:
- Label deletion is blocked when referenced by a configuration profile
label row
- Label deletion is blocked when referenced by a declaration label row
- Label deletion succeeds when not referenced by any profile or
declaration
- Verified that the `ALTER TABLE` DDL change does not trigger `ON UPDATE
CURRENT_TIMESTAMP` on `mdm_configuration_profile_labels.updated_at` (DDL
does not fire row-level triggers)
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42651
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added "Continuous" option for policy automations to re-run
script/software automations on every subsequent failure.
* Editable automations available directly from policy create, edit, and
details pages.
* New modal and field flows for managing automations (webhook/ticket,
calendar, conditional access) and a Patch automation CTA for patch
policies.
* **Improvements**
* Redesigned automations UI, table cell rendering, and list/footer
messaging for clarity.
* Various styling and layout refinements for consistent behavior and
overflow prevention.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#34668
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed profile resend behavior so configuration profiles are retried
using available identity attributes when a host has no linked IdP user
or the referenced IdP user is missing.
* Ensured profile resend markers are cleaned so pending resends behave
correctly after identity changes.
* **Tests**
* Improved test coverage to validate profile resend and status reset
when device mappings or identity links change.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated managed application packages to their latest versions across
macOS and Windows platforms. Includes version updates for 1Password,
Android Studio, AWS CLI, Camtasia, Claude, Cursor, Discord, Docker, Duo
Desktop, Figma, Firefox, GitKraken, Google Chrome, Gemini, Granola,
iTerm2, JetBrains Toolbox, Loom, Microsoft Office applications, Miro,
NordPass, Notion, RustDesk, and WhatsApp installations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41683
Unenroll/wipe Android on Fleet Free:
https://www.youtube.com/watch?v=JvsD3WBcDgE
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Android Lock, Wipe, and Clear passcode commands supported; Lock and
Clear for both personal (BYO) and company-owned (COBO) devices, Wipe for
COBO only.
* Android COBO Wipe exposed in Fleet Free (UI and API).
* **Bug Fixes**
* Personal Android unenroll now removes only the work profile (personal
data preserved) and no longer shows a transient “wiping” status in the
UI.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44652
Docs: https://github.com/fleetdm/fleet/pull/46631
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [x] Setting(s) is/are explicitly excluded from GitOps
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Route-aware OpenTelemetry trace sampling with tiered default ratios
(very low for select high-volume routes, reduced rate for admin reads,
full sampling otherwise).
* Admin-only GET/PATCH /debug/trace_sampler to view and update sampling
ratios and a runtime "force full" toggle.
* Liveness probe endpoints (/healthz, /version, /metrics) are excluded
from tracing; settings propagate to replicas at runtime without restart.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- updated the "show full quote" button on truncated testimonials in the
`<scrollable-tweets>` component to have a larger clickable area
- Updated how the `<scrollable-tweets>` component determines whether or
not to truncate a quote
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Improved quote overflow detection logic to more accurately identify
when quotes exceed their containers.
* Adjusted spacing and padding in tweet cards for better visual
consistency and layout refinement.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Victor Lyuboslavsky
