<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48340
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enabled enhanced database performance monitoring for load-testing
environments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
Cherry-pick of #48451 ("Adding changes for Fleet v4.89.0") from
`rc-minor-fleet-v4.89.0` into `main`.
This brings the v4.89.0 CHANGELOG entry and the corresponding `changes/`
cleanup into main. The CHANGELOG conflict was resolved by placing the
4.89.0 section above the existing 4.88.1 section (keeping main's 4.88.1
date of Jul 10, 2026).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added vulnerability filtering by CVSS score and exploitability in
Fleet Desktop.
* Added default enrollment behavior for fleet-owned Apple devices.
* Added additional filtering options to the Vulnerability Exposure
chart.
* Improved certificate template variables, including IdP values and host
platform.
* **Bug Fixes**
* Fixed policy selection pagination, stale policy/report details, and
missing-host reporting.
* Corrected SSO and email links when Fleet is hosted under a URL
subpath.
* Improved Windows profile validation and MDM command labeling.
* Fixed several display and accessibility issues, including host counts,
checkbox wording, and dark-mode badges.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Released a new Fleet chart and application version.
* Updated deployment defaults to use the latest Fleet container image.
* **Tests**
* Adjusted release-candidate branch expectations to match the new
version.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#48988.
I ran `make update-go version=1.26.5`.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] QA'd all new/changed functionality manually
Fleet:
<img width="301" height="102" alt="Screenshot 2026-07-09 at 8 41 49 AM"
src="https://github.com/user-attachments/assets/baf76ce7-6192-4506-a9db-52f5318939ee"
/>
fleetctl:
```
fleetctl --version
fleetctl - version orbit-v1.57.0-402-ge3d0c005dc
branch: 48988-update-go-1.26.5
revision: e3d0c005dc6698c024ad47a124c99e4f264855a0
build date: 2026-07-09
build user: lucas
go version: go1.26.5
```
Also verified orbit in Linux:
<img width="582" height="121" alt="Screenshot 2026-07-09 at 8 51 55 AM"
src="https://github.com/user-attachments/assets/65672676-8010-45a1-8c28-9f9959e72134"
/>
## fleetd/orbit/Fleet Desktop
- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [X] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the project and all included tooling modules to Go 1.26.5.
* Refreshed build images used by desktop Linux, load testing, and
related utilities to the newer Go toolchain.
* Updated change log entries to reflect the Go version bump.
* **Bug Fixes**
* Improved the automation that refreshes Go-pinned Docker image
references to resolve and apply correct digests, helping prevent broken
build images.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Replace the hardcoded FLEET_MYSQL_MAX_OPEN_CONNS=10 in the loadtest
terraform (both the root ecs.tf stack and the infra/ stack) with a
mysql_max_open_conns variable, applied to both the writer and
read-replica pools.
Also document per-tier connection pool sizing in the AWS reference
architecture: 20 for R-class instances (25k+ hosts), 10 for the smaller
T-class instances (5k/10k hosts) whose low default max_connections
(~90/135) leaves little headroom.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44802
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a configurable setting for MySQL connection limits in the load
testing environment.
* Connection settings now use a shared input value instead of fixed
defaults, making it easier to tune database load behavior across
container types.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Bumped Fleet to version **v4.87.1** across Helm, Terraform, and the
npm package.
* Updated deployment image tags so environments using the chart or
infrastructure defaults will pick up the new release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
**Related issue:** Resolves#47488
Smoke tested a Render blueprint deploy using this branch:
<img width="655" height="216" alt="Screenshot 2026-06-30 at 12 11 25 PM"
src="https://github.com/user-attachments/assets/7f5b6e76-1aa6-4ae6-b96c-9757f7cf2baf"
/>
## What & why
The Render deployment blueprint provisioned its MySQL service from the
external
[`render-examples/mysql`](https://github.com/render-examples/mysql)
repo, whose Dockerfile pins `mysql/mysql-server:8.0.24`. MySQL 8.0.24
does not support nesting a `UNION` inside the right-hand operand of
another `UNION`, so host-detail queries fail with:
> Error 1235 (42000): This version of MySQL doesn't yet support 'nesting
of unions at the right-hand side'
This surfaced via the Vanta integration hitting `GET
/api/latest/fleet/hosts/:id` on a Render deployment.
This PR switches the `fleet-mysql` service to pull the official
`mysql:8.0.44` image directly (`runtime: image`), removing the
dependency on the external repo. 8.0.44 is Fleet's documented minimum
supported MySQL version and is what `docker-compose.yml` already uses
for dev/CI. The official image honors the same `MYSQL_DATABASE` /
`MYSQL_USER` / `MYSQL_PASSWORD` / `MYSQL_ROOT_PASSWORD` env contract, so
the rest of the blueprint is unchanged.
`8.0.44` (latest 8.0) was chosen over `8.4` so existing deployments
upgrade in place from their current 8.0.24 data volume without a
cross-major manual step.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
## Testing
- [x] QA'd all new/changed functionality manually
Verified locally (Docker) that the failing query shape behaves as
expected across versions:
| Query shape | MySQL 8.0.24 | MySQL 8.0.44 |
|---|---|---|
| `SELECT 1 UNION (SELECT 2)` | works | works |
| `SELECT 1 UNION (SELECT 2 UNION SELECT 3)` | **ERROR 1235** | works |
| `(SELECT 1 UNION SELECT 2) UNION (SELECT 3 UNION SELECT 4)` | **ERROR
1235** | works |
`docker-compose.yml` already runs `mysql:8.0.44` with the same env
contract, so the image swap is a drop-in. Remaining validation on a real
Render Blueprint instance: fresh provision health (`/healthz`, `fleet
prepare db`, `hostport` resolution) and in-place upgrade from an
existing 8.0.24 volume.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the database deployment target to a newer MySQL version,
resolving a Render deployment error related to union nesting.
* Switched the managed database service to use an explicit MySQL 8.0.44
image for more reliable deployments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Document the scenarios for load testing Windows MDM at scale.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44188
- Updates terraform modules to the latest
- Updates ACL rules
- Updates log retention configuration(s)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated infrastructure dependencies and configurations to enhance
platform stability and monitoring capabilities
* Improved network security settings with enhanced flow log collection
and retention
* Upgraded deployment modules for better performance and reliability
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Resolved an issue where team-scoped host vitals labels (from IdP
attributes) failed to populate associated hosts correctly.
* **Chores**
* Updated Fleet/Helm chart versions and container image/CLI package tags
from v4.86.1 to v4.86.2 across the deployment chart, values,
infrastructure defaults, and tooling manifest, with no other
configuration changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47573
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated observability and telemetry configuration for improved
deployment monitoring.
* Enhanced infrastructure environment variables including logging,
database connection management, and Fleet service settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Bump osquery-perf module version to v1.2.2
- Increases ulimits from 9999 to 999999
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated performance testing infrastructure dependency to the latest
patch version.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#47159.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the Go toolchain to 1.26.4 across modules, Docker build
stages, and build/configuration records to standardize the toolchain
version used for builds and tooling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35405
- fixes broken osquery_perf
- lower max connection lifetime so that loadtest can spread load across
readers faster (we often cause issues and need to recover)
- fixed broken signoz `terraform destroy`
- added README.md for pmm
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved load-testing image build process for more reliable binary
creation.
* Reduced MySQL connection pool timeouts to recycle connections more
frequently.
* Added robust, idempotent infrastructure cleanup steps during teardown
to avoid resource finalizer hangs and release cloud load balancers and
volumes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Fleet version bumped to v4.86.1 across Helm charts, Terraform
configurations, and fleetctl package manager to ensure consistent
deployment versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
- Prevents `terraform destroy` from running against load test
infrastructure, for a given workspace, if an identical osquery perf
workspace exists.
- Adds a check to the osquery perf workflow, to fail fast, if the
specified load test infrastructure workspace is not detected.
- Adds ability for users to configure the osquery perf (increment -
`input.loadtest_containers_increment`) batch size that get deployed to
an environment during every loop. Default: 4.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a configurable load-test container increment input (default: 4)
to control scaling increments.
* **Improvements**
* Prevented destructive runs when an existing infra workspace matches
the requested name.
* Tightened workspace-existence checks to require exact name matching.
* **Chores**
* Default load-test increment reduced from 8 to 4 and input validated as
a positive integer.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Kubernetes deployment chart to v7.0.1 with application version
v4.84.3.
* Updated container image versions across cloud deployment
configurations to v4.84.3.
* Updated command-line tool version to v4.84.3.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
- Enable `standard` RDS database performance insights
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Enhanced database monitoring capabilities by enabling Database
Insights for load testing infrastructure.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Disable performance insights
- Allow redis instance count >=1
- Properly set ecs_cluster logging config path
- Targeted apply with auto approve for pre-creating fleet and execution
roles
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enhanced ECS cluster logging with CloudWatch integration and extended
log retention to 365 days.
* Adjusted RDS monitoring configuration and disabled performance
insights for operational optimization.
* Reduced minimum Redis instance requirement from 3 to 1 for greater
deployment flexibility.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Version bumped to v4.84.2 across Helm charts, container images,
deployment infrastructure, and npm package.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Fleet version from v4.84.0 to v4.84.1 across deployment
configurations (Helm values, container images, Terraform for AWS/GCP,
and npm package) and bumped Helm chart package version v6.9.1 → v6.9.2.
* **Documentation**
* Updated CLI help/example text to reference the v4.84.1 milestone.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#43671.
Bumps the Alpine base image from 3.23.3 to 3.23.4 in the Dockerfiles
that produce published images, picking up patched openssl, musl, and
zlib packages. Follows the same pattern as #38977.
### CVEs resolved
- HIGH: CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31790,
CVE-2026-2673, CVE-2026-40200
- MEDIUM: CVE-2026-27171, CVE-2026-6042, CVE-2026-22184
### Test plan
- CI image build passes.
- Trivy/ECR scan on the resulting fleetdm/fleet image confirms the nine
listed CVEs are gone.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Docker base images to Alpine 3.23.4 across infrastructure and
deployment components for improved stability and security.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Golang 1.26.2 has been released. It fixes some CVEs:
https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Go toolchain to 1.26.2 across the repository and build
configs.
* Updated Docker build images to use Go 1.26.2.
* Expanded the set of tracked modules for the Go version update so
additional module files are included in automated updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Updates wording in `.github/workflows/loadtest-osquery-perf.yml`
- `4098` -> `4096`
- Removes: `(should be a multiple of 8, if setting
loadtest_containers_starting_index)`
- Updates `infrastructure/loadtesting/terraform/osquery_perf/enroll.sh`
to handle values that are not multiples of 8. If the value is not a
multiple of 8, logic has been added to apply the remainder.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Documentation**
* Updated load testing workflow configuration input descriptions for
improved clarity of parameters and their usage examples.
* **Bug Fixes**
* Fixed container count allocation logic in the load testing process to
ensure the final target count is always properly applied, even when
using increment values that don't divide evenly into the specified total
range.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Released patch version v4.83.2 with updated Helm chart and application
metadata.
* Updated deployment configurations to use the latest container image
version across cloud providers.
* Updated published package version to v4.83.2.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Luke Heath <luke@fleetdm.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Released patch v4.83.1: updated chart and app metadata, container
image tags, Terraform deployment defaults, and npm package version to
v4.83.1.
* **Documentation**
* Updated CLI help/example to reference the v4.83.1 milestone.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
## Changes
- Added `FLEET_OSQUERY_POLICY_UPDATE_INTERVAL` environment variable set
to `30m` in the dogfood Terraform configuration
- This configures osquery policy updates to occur every 30 minutes in
the dogfood environment
### Changes
Enable the `FLEET_MDM_ALLOW_ALL_DECLARATIONS` environment variable on
the dogfood infrastructure.
### Details
- Added `FLEET_MDM_ALLOW_ALL_DECLARATIONS = "true"` to the Terraform
configuration in the AWS module
- This allows all MDM declarations to be processed in the dogfood
environment for testing purposes
- Configures internal alb to log to the same bucket as the public alb
- Adds support for osquery-perf task size (cpu/memory) configuration
- Updates defaults for osquery-perf extra_flags
- Updates default enroll.sh loop sleep_time from 60s -> 300s
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves # N/A
- Resolves an issue that prevents some locally pulled docker images from
being pushed to ECR.
Victor Lyuboslavsky
