<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44444
# Details
This PR fixes the following edge case when running `fleetctl gitops`:
1. A new fleet is added
2. That fleet is declared as an ABM default fleet and/or a fleet in a
VPP token location
3. The _other_ fleets declared as ABM defaults or VPP fleets are _not_
all provided in the GitOps run
In that case, the GitOps run would fail with an error that one of the
previously-existing fleets could not be found. This PR fixes the bug by
making sure that GitOps looks at both the currently-persisted fleets
(via the API) and any fleets that are being created in the current run.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- Reproduced the issue on `main` by attempting to create a new fleet
_and_ add it both as an ABM default fleet and to the set of VPP token
users in a single run, and getting an error about one of the existing
fleets not being found
- Verified that I was able to complete a gitops run successfully on this
branch with a new fleet as a VPP token user and a default ABM fleet
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Improved validation for Apple Business Manager and Volume Purchasing
Program token team assignments with clearer error messages when
referenced teams aren't found in Fleet.
* Enhanced team name matching to properly handle Unicode characters,
ensuring consistent team identification across GitOps configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes#45624
Part 1 of #45553 -- see there for the full behavioral contract and
Oracle.
## Changes
- New `orbit/pkg/backoff` package: shared, stateful exponential backoff
tracker with jitter, thread-safe, per-path isolation. This package will
serve all agent components that need backoff (orbit API, fleetd paths,
and potentially osquery TLS), but for now only Fleet Desktop uses it. We
are introducing it incrementally to reduce risk.
- Integrated into Fleet Desktop's `checkToken` retry loop -- the exact
tight-retry path that caused the #44816 DB outage. The main
ping/DesktopSummary loop does not need backoff (Ping is unauthenticated
with no DB cost; DesktopSummary already runs at most every 5 min).
- On error: interval doubles each failure (1s, 2s, 4s, 8s, ...) capped
at 5 minutes
- On success: resets immediately to normal polling interval
- Each communication path tracks its own backoff independently
## Manual testing
### Automated tests (17 total, all pass with -race)
\`\`\`
go test ./orbit/pkg/backoff/ -v -race -count=1 # 17 tests, 0 failures
make lint-go-incremental # 0 issues
\`\`\`
- 14 logic tests (exponential doubling, cap, jitter, reset, per-path
isolation, concurrent access, overflow detection, garbage input
flooring)
- 3 real-time ticker tests (actual time.Ticker with wall-clock
measurements)
### Local TUF end-to-end test (macOS)
Set up local TUF server via \`tools/tuf/test/main.sh\` with
\`SYSTEMS=macos FLEET_DESKTOP=1 GENERATE_PKG=1\`. This builds orbit and
Desktop from this branch, generates \`fleet-osquery.pkg\` with local TUF
root keys. Installed the package on macOS, enrolled to a local Fleet
server.
**Test: corrupt token to simulate #44816 expired-token scenario**
Wrote invalid token to \`/opt/orbit/identifier\`, then watched Desktop
and orbit logs.
Desktop backoff (exponential doubling):
\`\`\`
11:57:21 ERR get device URL, backing off next_retry=2.044s (1s * 2^1 +
jitter)
11:57:29 ERR get device URL, backing off next_retry=4.061s (1s * 2^2 +
jitter)
11:57:39 ERR get device URL, backing off next_retry=8.744s (1s * 2^3 +
jitter)
\`\`\`
Orbit detects and rotates the token:
\`\`\`
11:57:42 INF token TTL expired, rotating token
\`\`\`
Desktop recovers instantly:
\`\`\`
11:57:48 DBG enabling tray items
\`\`\`
Previously Desktop would have retried every 5s indefinitely (#44816).
With backoff, retry intervals double each failure and recovery is
immediate on the first success.
### Build verification
\`\`\`
go build ./orbit/cmd/desktop/ # compiles clean
go build ./orbit/cmd/orbit/ # compiles clean
\`\`\`
---
# Checklist for submitter
- [x] Changes file added for user-visible changes in \`orbit/changes/\`.
- [x] Input data is properly validated, no SQL changes, no JS changes.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops (backoff caps at 5 min).
- [x] Added/updated automated tests (17 tests, all pass with \`-race\`).
- [x] QA'd all new/changed functionality manually (local TUF e2e on
macOS).
## fleetd/orbit/Fleet Desktop
- [x] If the change applies to only one platform, confirmed that
\`runtime.GOOS\` is used as needed to isolate changes (backoff is
platform-agnostic).
- [x] Verified that fleetd runs on macOS (local TUF install + e2e test).
Linux/Windows need QA.
- [ ] Verified auto-update works from the released version of component
to the new version.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46656
`server/mdm/apple/vpp.do` retried transient Apple errors by **calling
itself recursively**, with the rate-limit branch nesting `retry.Do`
inside `retry.Do`.
This change replaces the recursion with a single retry loop (respecting
the prior 1 initial attempt + 3 retries), closes each response before
retrying, honors Apple's `Retry-After` capped at 30s so that a
multi-minute value can't block a synchronous request, and threads
`context` through the VPP calls so the backoff is cancellable. The retry
timings are otherwise unchanged from before.
Following @sgress454 suggestion, I considered routing this through the
shared `retry.Do` helper (a single attempt wrapped in `retry.Do` + an
error filter) but figured out that:
- retry.Do` owns its own wait schedule and its error filter returns an
outcome enum rather than a duration, so it can't honor Apple's
per-response `Retry-After` value.
- also, I'd have to change the `retry` package to receive an extra `ctx`
param so that the backoff is context-aware (which IMHO is more blast
radius than this incident fix should carry).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
**What was verified.** The new automated test cannot run against `main`
(the fix changes the VPP function signatures and adds the retry knobs),
so to confirm the actual failure mode I checked out `main` and ran a
small repro that drives the VPP client against an Apple endpoint that
always returns the rate-limit error. On `main`, the call **never
returns** — `do()` recurses without bound — and the repro times out:
```
--- FAIL: TestReproUnboundedRecursionOnMain (10.00s)
zz_repro_main_test.go:30: AssociateAssets did NOT return within 10s — unbounded retry recursion in do() on main
FAIL
FAIL github.com/fleetdm/fleet/v4/server/mdm/apple/vpp 10.642s
```
On this branch the same scenario returns a bounded error promptly. That
behavior is covered by the new `TestDoRetryIsBoundedAndNonRecursive`
(bounded rate-limit retries, `Retry-After` honored-but-capped, and
context cancellation), and the full `server/mdm/apple/vpp` package
passes.
**I did not perform an end-to-end QA against a live Apple endpoint**.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed a server out-of-memory crash that occurred when Apple VPP API
repeatedly returned transient errors during VPP operations, including
app installs, user registration, and license seat releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This was getting flagged by automation when filtering for TODOs on
issues. This is one of the final things that QA needs to do before
wrapping up their work, so we'll remove the TODO from it for parity with
other "Confirmation" steps
Closes: https://github.com/fleetdm/confidential/issues/16057
Changes:
- Added `email-application-submitted`, an email template that is used to
reply to users who fill out the "Apply" form
- Updated the `deliver-application-submission` action to return an
`invalidEmailDomain` response if a user's email address is on the
bannedEmailDomainsForContactFormSubmissions list, and to send a "Thank
you for applying to Fleet" email to the user who submitted the form.
- Stubbed a new custom config variable: `applicationReplyEmailAddress`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Applicants receive a "Thanks for applying to Fleet" confirmation email
with a personalized greeting and ~7-day expectation.
* Added an application-submitted email template and preview using the
email layout.
* **Improvements**
* Added a hidden honeypot field to the application form; submissions
with it filled are silently discarded.
* Added email-domain validation with a specific form error and clearer
error rendering.
* Redirected jobs to the internal handbook open-positions section.
* **Chores**
* Added a commented placeholder for an application reply email setting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/45686
Changes:
- updated layout and content of the /device-management page to match the
latest positioning/wireframes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added testimonial block with scrollable tweets and responsive brand
logo grid
* Introduced new feature sections: patching, real-time compliance,
change management, transparency, and flexible deployment
* **Updates**
* Full redesign of the device management page: layout, typography,
spacing, responsive behavior, and testimonial/tweet styling
* Updated hero copy and primary CTA to “Talk to an engineer”
* **Removals**
* Removed desktop/mobile comparison table, legacy feature blocks, video
modal, and swag request form
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Chores
* Updated package metadata and versioning for maintained applications
(Grammarly Desktop, Granola, Krita, Miro, Opera) to enable proper
release tracking.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
Subsequent PRs will clean up existing failures to enable more checks.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automated security scanning for repository
workflow/configuration changes and pull requests, with manual trigger
and concurrent-run cancellation.
* **Chores**
* Introduced a configurable audit gate to suppress backlog rules with
guidance for removal.
* Enabled runner hardening, pinned tool versions, read-only checkout,
annotation-enabled reporting, and limited-scope analysis for workflow
files.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45282
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Deploy custom OS update configuration profiles for Apple
(macOS/iOS/iPadOS) and Windows; tracks and enforces one custom OS‑update
profile per scope.
* **Improvements**
* Prevent changing OS update settings when a custom profile exists;
returns guidance to remove the custom profile first.
* Batch upload now detects OS‑update payloads and enforces license
requirements.
* UI error handling surfaces API-specific messages.
* FileVault control separated from OS updates and gated behind a
configurable flag/license.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes the race after Windows BYOD MDM enrollment (Settings > Access
work or school > Connect) where mdm_windows_enrollments.host_uuid stayed
empty for ~10s while osquery's distributed-read cycle ran
directIngestMDMDeviceID Windows. During that gap any server-side lookup
keyed on host UUID via MDMWindowsGetEnrolledDeviceWithHostUUID returned
NotFound.
processIncomingMDMCmds now inspects unlinked enrollments on every
management session: it parses any incoming Results for
./DevDetail/Ext/Microsoft/SMBIOSSerialNumber, looks up the Windows host
by hardware_serial, and updates host_uuid. If still unlinked after
processing the incoming message, it appends a Get for that LocURI to the
response so the device replies on the next round-trip. The Get is
idempotent and reinjected each session until linkage succeeds.
The post-link UPN/SCIM/DEP bookkeeping previously inlined in
directIngestMDMDeviceIDWindows is extracted into a shared helper
(osquery_utils.LinkWindowsHostMDMEnrollment) so both the new SyncML path
and the osquery direct-ingest backstop run it exactly once per linkage.
New datastore method WindowsHostLiteByHardwareSerial does a Windows-only
serial lookup and returns NotFound when two Windows hosts share a
serial, so we never mis-link on virtualization-shared SMBIOS values.
For Autopilot and Entra-during-OOBE the host record does not exist until
fleetd installs later in ESP, so the osquery backstop and the name-based
fallback in setup_experience.go remain in place for those flows.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45380
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Immediately link Windows BYOD MDM enrollments to host records during
the first management session when a device serial is present, and prompt
the device to resend serial info if missing.
* Detect and ignore placeholder/ambiguous hardware serials to avoid
incorrect host linking.
* Reduce noisy warnings for internal-sync command IDs.
* **Bug Fixes**
* Resolve a race causing Windows MDM enrollments to remain unlinked for
several seconds.
* **Tests**
* Added coverage for serial-based linkage, retry behavior, placeholder
detection, and internal-command ID handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Konstantin Sykulev <konst@sykulev.com>
Refactored `ListHostSoftware` and `ModifyAppConfig` into smaller helpers
so nilaway can analyze them for nil-pointer dereferences
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46554
Refactoring. No functional changes.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved host software listing by consolidating assembly, merging,
deduplication, and out-of-scope filtering into dedicated helpers for
more reliable and maintainable results.
* Streamlined app configuration updates by extracting conditional-access
(Okta) validation into a focused helper, improving validation
consistency and error reporting.
* **Chores**
* Updated static analysis configuration: bumped a pinned plugin version
and removed a suppression rule that hid certain internal lint messages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Mostly to prevent AIs from picking them instead of using new (because
then the linters in CI complain).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Deprecated internal pointer helper functions in favor of Go's standard
pointer allocation syntax. Updated test files throughout the codebase to
use the standard approach for consistency and maintainability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Implements the optimization described in
[#44191](https://github.com/fleetdm/fleet/issues/44191): inside
`RecordPolicyQueryExecutions`, fetch the existing `policy_membership`
rows for the incoming policies and narrow the UPSERT batch to only the
rows whose stored value differs from incoming. Steady-state rows are
skipped entirely.
The added SELECT is a small indexed lookup on `(host_id, policy_id)`;
the savings are on the writer side, which is the loadtest bottleneck.
Fixes#40362
Use INSERT IGNORE in the sync path so that a policy deleted between
distributed query dispatch and result ingestion is silently skipped,
matching AsyncBatchInsertPolicyMembership which already handles this
race with the same approach.
**Related issue:** Resolves#43116
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fedora/Linux wipe now removes Btrfs snapshots (including read-only)
before wiping so snapshots won’t persist.
* **UI**
* Linux-specific guidance and external links added to wipe dialogs and
wiped/failed-wipe activity items; wipe status tags suppressed for Linux
hosts.
* Activity entries include host platform to enable platform-specific
messaging.
* **Tests**
* Updated tests to cover Linux-specific wipe messaging, links, and
activity payloads.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated ChatGPT Desktop to version 1.2026.119
* Updated Genesys Cloud to version 2.50.28
* Updated GitHub Desktop to version 3.5.12
* Updated Notion to version 7.20.0
* Updated Tailscale to version 1.98.5
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for website swag request contacts in webhook processing,
enabling the system to accept and validate requests from this new
contact source type.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46119
New activities visible on host details page:
<img width="482" height="424" alt="image"
src="https://github.com/user-attachments/assets/8b8b33b2-c135-4061-b258-473fcc109d89"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* MDM unenrollment events now appear on the host activity timeline in
host details.
* **New Features**
* Host activity entries for MDM unenroll show platform- and actor-aware
messaging and appropriate action/icon visibility.
* **Tests**
* Added tests to verify rendering and messaging for various platforms
and actor presence.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46388
Video demo: https://www.youtube.com/watch?v=t3yuGh0kwP8
Docs PR: https://github.com/fleetdm/fleet/pull/46483
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
## New Fleet configuration settings
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* UI to add/remove Entra application (client) IDs for Windows automatic
enrollment; add/delete modals and list management.
* **Enhancements**
* Activity feed entries for added/removed Entra client IDs.
* Entra client ID allowlist surfaced in GitOps and persisted config;
client IDs normalized (trim/lowercase) and de-duplicated.
* **Documentation**
* Note: from July 1, 2026 new on‑prem Windows MDM apps receive Entra v2
tokens with aud = client ID; v1 tokens remain supported.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Every story issue inherited ~14 generic test-plan checkboxes (UI, API,
GitOps, Permissions) plus TODO placeholders, regardless of whether they
applied. The result was that most issues carried large blocks of
uncurated boilerplate, making it hard to see which checks were actually
relevant and adding visible noise to every story.
This restructures the Test plan section into a hybrid format:
- Keep "Core flow" and "Edge cases" visible, with Edge cases retaining a
required QA TODO slot so every story has a curated entry point.
- Move the UI, API, GitOps, and Permissions checklists into a single
commented block headed by a visible nudge. Authors un-comment only the
sections that apply, so the rendered issue shows only relevant checks
instead of orphan headers.
It also expands suggested coverage with three new sections (commented by
default):
- Premium gating: confirm premium-only features are blocked on both the
frontend and backend, not just hidden in the UI.
- Upgrade / data migration: confirm behavior on upgraded servers (not
just fresh installs) and that data migrates/rolls back safely.
- Feature in isolation (MDM / platform independence): confirm
cross-platform or Apple-MDM-independent features work without Apple MDM
configured. This addresses a recurring bug class where features break
when Apple MDM is off — e.g. #44801 (end user auth on
Windows/Linux-only), #44194 (team BitLocker enable when Apple MDM off),
and #46283 (host OS settings API with only Android MDM).
## Summary
- Refactored the conditional access policy query to use `CONCAT('%', ?,
'%')` with a bound parameter instead of string concatenation for the
platform `LIKE` clause, consistent with how other queries in this file
handle string filters.
## Test plan
- [ ] Verify conditional access policy lookup still returns correct
results for macOS/Windows hosts.
- [ ] Confirm no regression in policy filtering behavior.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved platform filtering in conditional access policy queries to
enhance query reliability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds the Google Slides link for the "Fleet for CIOs" deck to the Slide
Decks section in the Go-To-Market operations handbook page, replacing
the previous "work in progress" placeholder.
## Changes
- `handbook/company/go-to-market-operations.md`: Updated the "Fleet for
CIOs" bullet from a WIP placeholder to an active link pointing to the
slide deck.
---
Built for [Chaz
Maclaughlin](https://fleetdm.slack.com/archives/D0AHH0ZEMLY/p1780344948342509?thread_ts=1779381980.385179&cid=D0AHH0ZEMLY)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
**Related issue:** Resolves#46283
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an error in the "Get host's OS settings" API so it no longer
fails when only Android MDM is enabled.
* Configuration profiles endpoint now correctly responds when Android or
Windows MDM is the active platform, in addition to Apple MDM.
* **Tests**
* Added tests covering configuration profiles behavior across Apple,
Windows, and Android MDM configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Check if the `ORBIT_ENABLE_SCRIPTS` plist variable exists and set or add
it accordingly in the plist.
Prior to this change, if the variable was not already present on the
host, the script would fail to set the variable.
This change also sets the `plist_path` variable, which was missing in
the original script.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved macOS setup script to more reliably configure the launchd
environment variable: it now detects whether the variable exists before
updating or adding it, handles errors silently during probes, uses a
single plist path variable instead of a hardcoded path, and ensures the
service is restarted with the updated configuration.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46100?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Removes docs/solutions/windows/scripts/install-yellowkey-extension.ps1
(thin wrapper that fetched Allen's upstream installer) and updates the
policy's run_script.path to install-windows-yellowkey-extension.ps1, the
canonical filename in allenhouchins/fleet-extensions. Users drop Allen's
installer (with its canonical name) into their GitOps scripts directory;
the policy references it directly.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #46360
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Windows YellowKey osquery Fleet policy documentation with
revised script references and remediation instructions for hosts that
fail to load the extension.
* **Chores**
* Removed obsolete installation script; installation procedures have
been consolidated for improved clarity and maintainability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude <noreply@anthropic.com>
While testing for #46482, I noticed that the model name on the Hosts
page is truncated, but a tooltip doesn't show on hover. This felt
inconsistent, since the Host details page truncates the model and does
show a tooltip.
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved display of hardware model information in the hosts management
table with better text truncation and tooltip support for enhanced
readability.
* Adjusted column styling to ensure consistent width and reliable
tooltip behavior for long hardware model names.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Grammarly Desktop macOS package from version 1.167.1 to
1.167.2 with new installer URL and verification checksum.
* Updated NordVPN macOS package from version 10.3.0 to 10.3.1 with new
installer URL and verification checksum.
* Updated Sourcetree macOS package from version 4.2.17 to 4.2.18 with
new installer URL and verification checksum.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#46066
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected MDM status label in the hosts table so enrollment states
display accurately.
* Fixed platform handling so "Not supported" appears appropriately for
Chrome and Linux hosts.
* **New Features**
* Added a hover tooltip on the MDM status in the hosts table to show
additional context.
* **Style**
* Improved tooltip text wrapping to keep status names on a single line.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Reverts fleetdm/fleet#45893
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved application installation for 1Password, Slack, and Zoom by
implementing graceful application shutdown before installation and
automatic restart after completion.
* Enhanced installation reliability by simplifying application lifecycle
management during package updates, reducing potential conflicts from
running applications during installation processes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Scott Gress
