Zed + Opus 4.6; prompt: Convert the InputField JSX component to
TypeScript and remove the ts-ignore directives that we no longer need
after doing so.
- [x] Changes file added
- [x] Automated tests updated
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [ ] QA'd all new/changed functionality manually
## Summary
- Comments out the Account Executive (EMEA) position in
`handbook/company/open-positions.yml` to remove it from the open
positions listing.
- The entry is preserved as YAML comments (not deleted) following the
same pattern used for other previously commented-out positions in the
file.
---
Built for [Isabell
Reedy](https://fleetdm.slack.com/archives/D0AEGJCGJR0/p1775740556107389)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds a new weekly ritual to the CEO handbook page: "Connect with
GitOps workshop attendees"
- Each week, the EA checks for completed GitOps workshops, pulls the
attendee list from Eventbrite, and sends blank connect requests from the
CEO to each attendee.
- DRI: @SFriendLee
Built for [Savannah
Friend](https://fleetdm.slack.com/archives/D0AK3T404H3/p1775586068675869)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
## Summary
- Clarifies in the MySQL docs intro that read replica configuration is
fully independent — no values are inherited from the primary config
- Adds explicit callout that `mysql_read_replica_region` must be set
separately when using IAM authentication
- Adds note to `mysql_tls_config` explaining that this setting is
typically not needed for RDS IAM auth since Fleet uses bundled RDS CA
certificates (including GovCloud regions)
These changes address real-world customer confusion where a GovCloud
deployment failed because `FLEET_MYSQL_READ_REPLICA_REGION` was not set
independently of `FLEET_MYSQL_REGION`.
Note: related to #39832
## Testing
Documentation-only change — no code impact.
Add script-only package documentation to the packages section.
Script-only packages (.sh and .ps1 files) are a supported package type
but had no example or guidance in the YAML configuration docs. This adds
a "Script-only" example after the existing URL and Hash examples,
documenting:
- Script-only packages must be configured inline in the team YAML file
- self_service, categories, labels, and icon are specified inline
- Script packages do not support install_script, uninstall_script,
post_install_script, pre_install_query, or automatic install
- Separate package YAML files are not currently supported for
script-only packages
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38647
<img width="398" height="230" alt="image"
src="https://github.com/user-attachments/assets/7e68e0d7-54b0-4039-a0be-8b0ad4bb1fbf"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43273
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- Added new test for this case (policies without software automation
being pushed by two different users), verified it fails on main and
passes on this branch
- [X] QA'd all new/changed functionality manually
- [X] Verified that changing `webhooks_and_tickets_enabled` on a policy
AND running gitops as another user doesn't wipe stats
- [X] Verified that changing `query` on a policy and running gitops does
wipe stats
- [X] Verified that changing `query` on a policy and running gitops does
wipe stats
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue where policy stats were incorrectly reset during GitOps
policy updates. Policy statistics now remain accurate when policies are
re-applied without modification to installation or script
configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41484
Unreleased bug.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **License Enforcement Updates**
* Team-scoped Mobile Device Management operations now require a premium
license. Free-tier users will receive an error when attempting to create
or manage team-level MDM declarations and profiles.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Register AWS VPN Client in fleet configs: add an IdP group label (IdP
group: SAML-aws-vpn), include that label in default.yml, and add
aws-vpn-client/darwin to fleet_maintained_apps (self_service=true,
labeled for the SAML-aws-vpn group). Add a dynamic label for macOS hosts
with AWS VPN Client installed (bundle id com.amazonaws.acvc.osx) and add
a macOS patch policy to surface/update hosts with out-of-date AWS VPN
Client. These changes enable inventorying, self-service installation,
and patch tracking for the AWS VPN Client.
Remove wording that suggested deleting/uninstalling apps from resolution
text in fleet-maintained app patch policies. Updated macOS and Windows
policy files to only advise updating via Self-service or each app's
built-in update functionality (no mention of deleting/uninstalling).
Affected files:
it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml and
it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml.
Update .github/workflows/dogfood-gitops.yml to raise the fleet-gitops
job timeout from 10 to 30 minutes. This prevents premature cancellation
for longer-running steps (e.g., runner hardening and related tasks).
Our workflow is starting to timeout now that we have more apps being
applied via GitOps.
## Summary
- Adds a new commented-out testimonial entry to
`handbook/company/testimonials.yml` sourced from a LinkedIn comment (URN
7279546151945519104) on Mike Meyer's Foursquare-to-Fleet migration post.
- The entry is commented out per handbook instructions since it contains
TODO placeholders that need to be filled in manually from the LinkedIn
comment (requires authentication to access).
- The LinkedIn comment URL:
https://www.linkedin.com/feed/update/urn:li:activity:7267672056970788866/?dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287279546151945519104%2Curn%3Ali%3Aactivity%3A7267672056970788866%29
## TODO before merging
The following fields need to be filled in from the LinkedIn comment
(requires logging in to LinkedIn to view):
1. `quote` - The text of the comment
2. `quoteAuthorName` - The commenter's name
3. `quoteAuthorJobTitle` - The commenter's job title
4. `quoteAuthorProfileImageFilename` - Upload the commenter's profile
image and update the filename
5. `productCategories` - Verify the correct category (currently set to
`[Device management]`)
6. `quoteLinkUrl` - Verify or update to the commenter's LinkedIn profile
URL if preferred
---
Built for [Dan
Gordon](https://fleetdm.slack.com/archives/C0AN44FQC01/p1775665779923419?thread_ts=1775661619.633759&cid=C0AN44FQC01)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Dan Gordon <daniel@fleetdm.com>
Co-authored-by: Ashish Kuthiala <53918208+akuthiala@users.noreply.github.com>
Bump Cursor to 3.0.12 and Docker to 4.67.0: update installer URLs and
SHA256 hashes, add 'patched' SQL queries for version checks in Windows
outputs, and normalize default_categories from "Developer Tools" to
"Developer tools" in winget inputs and outputs.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** For #40015
* Moves repeated empty mocks into a new `setupEmptyGitOpsMocks` method
* Adds new "deprecation" tests:
* In TestGitOpsFullGlobal, TestGitOpsFullTeam and
TestGitOpsFullGlobalAndTeam tests "kitchen sink" with both new and
deprecated keys
* Added keys and checks to verify `setup_experience`,
`apple_business_manager` and `volume_purchasing_program` configs
* Consolidated map of deprecated -> new GitOps keys in one place
Related to #40309
Changes:
- Added ee/fleet-agent-downloader/ - A Sails app that has a single page
locked behind SSO that end-users can use to download a Fleet installer
hosted in an S3 bucket.
Related to: https://github.com/fleetdm/fleet/issues/42738
Changes:
- Uncommented and updated the code that replaces text content in double
parentheses with `<bubble>` elements in build-static-content to not
replace content inside of `<code>` elements
- Created a `<bubble>` component based on the ((bubbles)) in the
Sails.js docs.
Fixed filename which was breaking rendering of the page. Fixed extra
spaces on code blocks. Also added more headers for cleaner reading, and
added a link to the end of the page to get to the raw text for easy
copying that can be dropped right in for AI input.
Ian Littman