<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41233
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
* Fixed pagination on the host software page to prevent the "Next"
button from being incorrectly disabled when a software title has
multiple installer versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds a comprehensive set of AI usage guidelines to the
company's communications handbook. The new section outlines which AI
tools are available, how they should be used responsibly, and provides
clear rules to protect confidential information and ensure
accountability for AI-generated work.
AI usage guidelines:
* Added a new "AI usage guidelines" section to
`handbook/company/communications.md`, covering responsible AI tool use,
available and integrated tools (Gemini, GitHub Copilot, Claude,
ChatGPT), and rules for expensing and accessing additional tools.
* Clarified that users are accountable for the accuracy and
appropriateness of any AI-generated output, including code, written
content, communications, and analysis.
* Established a strict prohibition on inputting confidential or private
company/customer information into personal or non-enterprise AI tools,
with concrete examples of what not to share.
* Provided guidance for situations of uncertainty, encouraging employees
to ask questions and seek clarification via management or the #help-it
Slack channel.
Resolves#33045
When creating or updating queries either via the API or Gitops, make
sure that the license is premium if the query is targeting a label.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41006
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
Added tests for using path, paths and inline declaration for reports,
policies and labels.
- [X] QA'd all new/changed functionality manually
- [x] tested that `path:` works for policies
- [x] tested that `paths:` works for policies
- [x] tested that incline declaration works for policies
- [x] tested that `path:` works for reports
- [x] tested that `paths:` works for reports
- [x] tested that incline declaration works for reports
- [x] tested that `path:` works for labels
- [x] tested that `paths:` works for labels
- [x] tested that incline declaration works for labels
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for glob patterns in path specifications within reports,
labels, and policies configuration sections.
* Enhanced validation and error handling for external file references.
* Improved logging and error messages during configuration parsing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38536
The final activity bounded context PR is in review:
https://github.com/fleetdm/fleet/pull/41194
So, I'm putting up the associated README up for review as well.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#28584
The correct fix for the bug was to add a migration to update existing
software rows to match the new naming convention. However, that should
have been done in Fleet 4.67, and that ship has already sailed.
See the issue description in the `Name changes and the rename problem`
of the doc.
Resolves#40813
* Added configurable body size limits for the `/api/osquery/log`,
`/api/osquery/distributed/write` and `/api/osquery/config` endpoints.
* Fixed false positive `PayloadTooLargeError` errors.
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
## Summary
- **Reverts PR #41257**: Claude Desktop should NOT have
`setup_experience: true` — it should not be automatically installed
during device setup. PR #41257 (which added `setup_experience: true` to
both macOS and Windows Claude Desktop entries) has been closed.
- **Updates Claude Desktop "up to date" policy version strings** to
match the latest fleet-maintained app catalog versions:
- macOS: `1.1.4328` → `1.1.5749` (from
`ee/maintained-apps/outputs/claude/darwin.json`)
- Windows: `1.1.4088` → `1.1.5368` (from
`ee/maintained-apps/outputs/claude/windows.json`)
## Changes
| File | Change |
|------|--------|
| `it-and-security/lib/macos/policies/update-claude.yml` | Version
`1.1.4328` → `1.1.5749` |
| `it-and-security/lib/windows/policies/update-claude.yml` | Version
`1.1.4088` → `1.1.5368` |
Closes#41257
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1773070240095919?thread_ts=1773069775.458399&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Removes the Company Portal software package from the Workstations team
- Removes the Company Portal SSO extension (extensible SSO)
configuration profile from the Workstations team
- Removes the "Conditional access test group" label that was used to
scope both Company Portal and the SSO extension
- Removes the `company-portal-installed` and
`entra-conditional-access-check` policies that were specifically for
Company Portal/Entra conditional access
- Removes the `create-conditional-access-allow-file.sh` and
`user-enroll-entra-company-portal.sh` scripts that were only used by the
removed policies/Company Portal
### Files deleted
-
`it-and-security/lib/macos/configuration-profiles/company-portal-sso-extension.mobileconfig`
- `it-and-security/lib/macos/software/company-portal.yml`
- `it-and-security/lib/macos/policies/company-portal-installed.yml`
-
`it-and-security/lib/macos/policies/entra-conditional-access-check.yml`
-
`it-and-security/lib/macos/scripts/create-conditional-access-allow-file.sh`
-
`it-and-security/lib/macos/scripts/user-enroll-entra-company-portal.sh`
- `it-and-security/lib/all/labels/conditional-access-test-group.yml`
### Files modified
- `it-and-security/teams/workstations.yml` — Removed references to
Company Portal software, SSO extension profile, related policies, and
the conditional access script
- `it-and-security/default.yml` — Removed the "Conditional access test
group" label definition
### Items intentionally kept
- `fleet-okta-conditional-access.mobileconfig` — This is an Okta-based
conditional access profile, not related to Company Portal/Entra SSO
- `conditional_access_enabled: true` in team settings — This is a
team-level integration setting, not Company Portal specific
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1773067955110849)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41012
# Details
This PR makes it allowable to leave out almost all top-level keys from
GitOps files. The only required keys are _either_ `name:` (for a fleet
settings file) or `org_settings:` (for a global settings file). Omitting
a key is identical to supplying it with no value.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
Updated the "missing all global keys test", and added some new tests to
verify that omitting the key was the same as supplying it with an empty
value.
- [X] QA'd all new/changed functionality manually
1. Ran `fleetctl generate-gitops` to get a clean set of GitOps yml files
2. Removed all removable keys from default.yml and ran `fleetctl gitops`
3. Ran `fleetctl generate-gitops` again into a different dir
4. Ran `fleetctl gitops` with the original files to get back to original
state
5. Cleared out all now-removable keys and replaced them with empty value
(e.g. `reports:` with nothing under it)
6. Ran `fleetctl generate-gitops` again into a third dir
7. Compared the files from the second and third generate-gitops runs to
verify that omitting the key had the same result as supplying it with an
empty value
8. Did the above steps with a fleet (i.e. non-global) .yml file.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* GitOps files now support omitting top-level configuration keys instead
of requiring them to be explicitly set to empty values.
* org_settings is now required when team name is not specified.
* **Tests**
* Added integration tests validating behavior when omitting top-level
keys in global and team-level GitOps configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40327
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#36682
- Added similar "not found" handling than the one we have when calling
`getHostScriptExecutionResultDB` within the `GetHostLockWipeStatus`
function for consistency => now return a 404 instead of a 500 when no
rows are returned.
- Applied similar changes to
https://github.com/fleetdm/fleet/issues/33090 (PR:
https://github.com/fleetdm/fleet/pull/40009) => logging an error instead
of returning a 404, so that the Host details page does not crash.
The actual fix would be to remove the `host_mdm_actions` record that
contains the orphan `lock_ref` mentioned in the issue.
I'm not sure what the root cause is, but I think setting up some
monitoring on the logs I added should help determining that.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
## Summary
- Adds Okta Verify as a custom package for x86 Windows workstations in
the Fleet GitOps configuration
- Creates `it-and-security/lib/windows/software/okta-verify.yml` using
the `$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` secret for the download URL
- Configures the app in `workstations.yml` with `self_service: true`,
`setup_experience: true`, the "Security" category, and scoped to
`x86-based Windows hosts` label
## Changes
1. **New file**: `it-and-security/lib/windows/software/okta-verify.yml`
— Software definition with the secret-referenced URL
2. **Modified**: `it-and-security/teams/workstations.yml` — Added Okta
Verify package reference under `software.packages` in the Windows apps
section
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772924912095649)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
This pull request updates the workstation team settings to ensure that
disk space policies are enforced across all major operating systems. The
most important change is the addition of specific policy IDs for
monitoring disk space on Linux, macOS, and Windows.
**Policy enforcement improvements:**
* Added `policy_ids` for disk space monitoring on Linux (`38244`), macOS
(`38230`), and Windows (`38239`) in the `team_settings` section of
`it-and-security/teams/workstations.yml`.
Added a section for the ExpedITioners podcast with episode details,
including dates, guests, and descriptions.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
Updated marketing assets with new case studies and comparisons,
including details on various organizations using Fleet for device
management. Added new entries and modified existing ones for clarity and
completeness.
## Summary
- Add Claude Desktop as a Fleet-maintained app for macOS and Windows on
the Workstations team
- Both platforms have self-service and setup experience enabled
- Windows app scoped to x86 hosts via `x86-based Windows hosts` label
- Add version update policies for both platforms (macOS v1.1.4328,
Windows v1.1.4088)
## Test plan
- [ ] Verify `fleetctl gitops --dry-run` passes with workstations.yml
- [ ] Confirm Claude Desktop appears in self-service for macOS and
Windows hosts
- [ ] Confirm Claude Desktop is part of the macOS and Windows setup
experience
- [ ] Verify update policies flag hosts running older versions
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This pull request makes a small change to the GitHub Actions workflow
configuration by adding a new secret environment variable for use in the
dogfood environment.
- Added the `DOGFOOD_OKTA_VERIFY_WINDOWS_URL` secret to the environment
variables in the `.github/workflows/dogfood-gitops.yml` workflow file.
## Summary
- Adds cross-platform disk space check policies (macOS, Windows, Linux)
scoped to the workstations team
- Each policy calculates the percentage of available disk space relative
to total disk space and **fails when available disk space is 10% or
less**
- macOS/Linux policies query the `mounts` table for the root partition
(`/`); Windows policy queries the `logical_drives` table for NTFS drives
- Resolution contact channel is `#help-it`
### New files
- `it-and-security/lib/macos/policies/disk-space-check.yml`
- `it-and-security/lib/windows/policies/disk-space-check.yml`
- `it-and-security/lib/linux/policies/disk-space-check.yml`
### Modified files
- `it-and-security/teams/workstations.yml` — registers the three new
policies
### How it works
| Platform | Query logic |
|---|---|
| macOS | `SELECT 1 FROM mounts WHERE path = '/' AND
CAST(blocks_available AS REAL) / blocks > 0.10` |
| Linux | `SELECT 1 FROM mounts WHERE path = '/' AND
CAST(blocks_available AS REAL) / blocks > 0.10` |
| Windows | `SELECT 1 WHERE (SELECT CAST(SUM(free_space) AS REAL) /
SUM(size) FROM logical_drives WHERE file_system = 'NTFS') > 0.10` |
- **Pass (returns rows):** available disk space is more than 10%
- **Fail (returns no rows):** available disk space is 10% or less
### Why >10% free disk space matters
Each policy description now includes context on why maintaining
sufficient free disk space is important:
- **System stability:** Low disk space can cause system instability,
slowdowns, and crashes
- **OS requirements:** Operating systems need free space for virtual
memory/swap, temporary files, and system updates
- **Application reliability:** Applications may fail to save data or
function properly when disk space is critically low
- **Data protection:** Keeping sufficient free space ensures reliable
performance and prevents data loss
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772934328893319?thread_ts=1772933835.386689&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds `conditional_access.bypass_disabled: true` to
`it-and-security/default.yml` to disable the bypass option for
conditional access in Fleet's GitOps configuration
- This prevents end users from bypassing conditional access blocking
during login attempts
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772933047288969)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
This pull request makes a small change to the
`it-and-security/teams/workstations.yml` configuration file by clearing
the list of policy IDs for failing policies webhooks. No other settings
are modified.
- Set `policy_ids` to an empty list in the `team_settings` section,
removing the previous policy associations.
## Summary
- Added `calendar_events_enabled: false` to the "macOS - 1Password up to
date" policy to disable webhook/calendar automation
- The "macOS - Enrollment profile up to date" policy already had
`calendar_events_enabled: false` set, so no change was needed
## Changes
Only `it-and-security/lib/macos/policies/update-1password.yml` was
modified — a single line addition of `calendar_events_enabled: false` to
match the pattern used by other policies (e.g., `update-slack.yml`,
`latest-macos.yml`, `enrollment-profile-up-to-date.yml`).
---
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772931433677899)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Restores the Google Calendar integration settings in
`it-and-security/default.yml` that were removed in PR #39532
- Re-adds the `api_key_json` and `domain` configuration under
`org_settings.integrations.google_calendar`, reverting from the empty
array (`[]`) back to the original service account configuration
## Changes
The `google_calendar` integration in `it-and-security/default.yml` was
changed from an empty array back to:
```yaml
google_calendar:
- api_key_json: $DOGFOOD_CALENDAR_API_KEY
domain: fleetdm.com
```
This is an exact reversal of the change made in #39532.
---
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772930523927149?thread_ts=1772928789.366369&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- **Alex Mitchell** — Title changed from "Chief Customer Officer" to
"Head of Account Management". Moved from the Customer Success department
to the Sales department, now reporting to Chaz MacLaughlin (Global SVP
of Sales).
- **Zay Hanlon** — Now heads the Customer Success department (reports
directly to the CEO). Previously listed under Alex Mitchell.
- **Allen Houchins** — Already heads the IT department (reports directly
to the CEO). No handbook changes needed; verified no references placed
him under another manager.
- **Dhruv Majumdar** — Remains in the Customer Success department, now
reporting to Zay Hanlon (who heads the department).
### Files changed
- `handbook/customer-success/README.md` — Removed Alex Mitchell (Chief
Customer Officer) from team table; Zay Hanlon is now the top-listed role
as department head.
- `handbook/sales/README.md` — Added Alex Mitchell as "Head of Account
Management" under Chaz MacLaughlin.
Built for [Savannah
Friend](https://fleetdm.slack.com/archives/D0AK3T404H3/p1772927898988769)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Savannah Friend <157323611+SFriendLee@users.noreply.github.com>
## Summary
- Removes the `okta-verify/windows` Fleet-maintained app entry from the
workstations team GitOps configuration
(`it-and-security/teams/workstations.yml`)
- Okta Verify will no longer be available as self-service software or in
the setup experience for Windows workstations
- All other platform configurations (macOS, iOS, Android) for Okta
Verify remain unchanged
## Changes
**`it-and-security/teams/workstations.yml`**: Removed the following
maintained app entry from the `software.fleet_maintained_apps` section:
```yaml
- slug: okta-verify/windows
self_service: true
setup_experience: true
labels_include_any:
- "x86-based Windows hosts"
categories:
- Security
```
---
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772924324101579)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Irena Reedy