<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42508
Renames abm/apple_business_manager to ab/apple_business in API and
fleetctl. Uses existing renameto logic with a slight twist: added
"inline" option to handle cases particularly where a single object tree
has renames in multiple versions so that we don't break backwards
compatibiility since the default behavior when you have multi-level
renames is a new/old split at the top level
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Canonical Apple Business (AB) API endpoints and CLI:
/api/v1/fleet/ab_tokens, /api/v1/fleet/mdm/apple/ab_public_key, plus new
fleetctl get mdm-ab and fleetctl generate mdm-ab
* New GitOps/config key: mdm.apple_business
* Admin UI updated to show Apple Business tokens with fleet-based
associations and updated labels
* **Deprecations**
* Legacy ABM endpoints, CLI aliases, and config keys remain supported
but emit deprecation warnings pointing to the new AB equivalents
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#42818.
(I explicitly removed all checklist items.)
This is the least destructing approach to solve the issue.
Other approaches require like moving all Go code under a sub-directory
or keeping these docs/ directories free from invalid characters.
## Problem
[Publishing of Fleet's go
module](https://github.com/fleetdm/fleet/actions/runs/23857371168/job/69554220876)
is failing with the following error:
```
Run GOPROXY=proxy.golang.org go list -m github.com/fleetdm/fleet/v4@v4.83.0
go: github.com/fleetdm/fleet/v4@v4.83.0: reading https://proxy.golang.org/github.com/fleetdm/fleet/v4/@v/v4.83.0.info: 404 Not Found
server response:
not found: create zip: docs/solutions/windows/configuration-profiles/allow network connectivity during connected standby – [ACConnectivityInStandby_2, DCConnectivityInStandby_2].xml: malformed file path "docs/solutions/windows/configuration-profiles/allow network connectivity during connected standby – [ACConnectivityInStandby_2, DCConnectivityInStandby_2].xml": invalid char '–'
[Truncated: too long.]
```
## Summary
Root cause
The [publish go module
step](https://github.com/fleetdm/fleet/blob/main/.github/workflows/publish-go-module.yml)
asks proxy.golang.org to build a module zip for the v4.X.Y tag. That
build was failing on two independent, each-fatal issues — both stemming
from the monorepo carrying non-Go content that violates Go module zip
rules:
1. Invalid path characters — 35 tracked files with characters Go module
zips forbid: en-dash – in 32
docs/solutions/windows/configuration-profiles/*.xml files (the one in
your error), emoji 📜 in 2 handbook/company/legal/ files, and an
apostrophe in 1 website/assets/ image. This is the literal create zip: …
invalid char '–' error.
2. Source tree too large — 582 MiB tracked vs Go's hard 500 MiB limit;
website/ alone is 318.7 MiB.
## Fix
Added a go.mod to website/, docs/, and handbook/, turning each into a
nested module that x/mod/zip omits from the published v4 module — the
same pattern Fleet already uses under tools/. One move solves both: all
35 bad filenames live in those three dirs, and excluding them drops the
module to 207 MiB tracked → 112 MiB zipped.
Files created:
- website/go.mod, docs/go.mod, handbook/go.mod (module markers, each
with a comment explaining why)
Verified safe: no .go files and no //go:embed references in those dirs,
and go list ./... still resolves all 491 packages.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added standalone module configurations for documentation, handbook,
and website directories.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Adds a load test metrics tool under
[`tools/loadtest/metrics/`](tools/loadtest/metrics/) for capturing and
comparing AWS CloudWatch metrics across Fleet load test runs.
- **`collect-metrics.sh`** — discovers a load test environment's AWS
resources from its Terraform workspace name, pulls CloudWatch metrics
over a lookback interval, and writes a `.json` data file plus a
human-readable `.md` synopsis (with threshold alerts). Supports a
`--category` flag (`baseline` | `migration` | `mdm`) that files output
under `runs/<category>/<workspace>/`.
- **`compare-metrics.sh`** — diffs two or more runs side by side and
flags deltas as `ok` / `WARN` / `ALERT`. Searches `runs/` recursively,
and `--filter` doubles as a category selector thanks to the naming
conventions.
- **`runs/`** — committed historical runs, organized by category:
`baseline/`, `migration/`, `mdm/`.
- New `README.md` documenting usage, run organization, and how to submit
results; linked from the root `tools/README.md`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automated metrics tooling for AWS load-test environments —
collects ECS/RDS/Redis/ALB/network metrics, Performance Insights
top-SQL, CloudWatch Logs error samples, produces consolidated JSON +
Markdown summaries, and performs threshold checks with alerts.
* Added a metrics comparison tool to detect regressions across runs with
run selection, deduplication, per-metric comparisons, percent-change,
and aggregated alert synopsis.
* **Tests**
* Added numerous baseline and sample load-test metrics reports covering
multiple workspaces, intervals, and scenarios for validation and
regression analysis.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#36087 (one of several PRs).
## Testing
- [x] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Dry-run support when creating secret variables.
* **Improvements**
* Standardized API models for secret-variables and targets for more
consistent behavior.
* List secret variables now includes pagination metadata.
* More consistent error reporting across secret-variables and targets
APIs.
* Target search/count behavior refined: pre-selected built-in labels are
omitted as expected.
* **Tests**
* Integration tests updated to validate the new request/response
behavior and target-selection logic.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46196?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced file-path validation for improved handling
* Resolved Fleet Desktop startup issues on openSUSE Leap systems
* Updated Orbit identifier token rotation behavior
* **New Features**
* Added Adobe plugins detection table to identify plug-ins on macOS and
Windows
* **Chores**
* Updated Go version to 1.26.3
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This workflow has been flaky for years.
I've added inline comments explaining the changes.
This is important as a regression test now that we get more code changes
(AI) to review in fleetd.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Bumped osquery used in integration tests (5.9.1 → 5.23.0).
* Release tooling now updates the integration-test workflow when
releasing osqueryd.
* **Tests**
* Improved integration tests: refined trigger paths, separated service
startup, skipped frontend bundling for faster CI, more robust
host-enrollment detection and teardown.
* Limited package build targets (removed RPM) and added sparse checkout
for macOS uninstall script.
* **Stability**
* Added macOS osquery warm-up to prevent startup timeouts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46722
This PR modifies both the FE and BE so that we do not fire a single
request for each software policy automation row. Instead, we build the
custom icon url (if any) into the main `policies` endpoint response.
This also prevents 404ing when there's no custom icon uploaded for the
associated software title.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
#### Before (main branch)
https://github.com/user-attachments/assets/fa358e90-dc08-45e0-8c4d-b8a8b57a6c98
#### After
https://github.com/user-attachments/assets/4ca7b931-a10b-4d57-96b1-ba5a88e04de5
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Policy automations now show software icons when available (custom
installer icons, VPP app icons, and patch icons), sourced from the
server with graceful fallback when missing.
* **Tests**
* Added/updated tests to verify icon propagation and rendering behavior
across policy lists and automation views.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Fleet version bumped to v4.86.1 across Helm charts, Terraform
configurations, and fleetctl package manager to ensure consistent
deployment versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated maintained application versions: Opera to 132.0, Prisma
Browser to 149.10.3.53, Stats to 2.12.16, Tor Browser to 15.0.15, and
Visual Studio Code to 1.123.0 with corresponding installer URLs and
integrity checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added SF Symbols application support for macOS with automated version
detection and comprehensive installation/uninstall management
capabilities.
* Integrated SF Symbols icon component to the software catalog user
interface for improved visual identification and user experience.
* SF Symbols is now registered as a managed application with
Productivity category classification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added VirtualBuddy application to the supported software catalog for
macOS (Apple Silicon compatible).
* Users can now discover, install, and manage VirtualBuddy with
automated installation and uninstallation capabilities.
* Version 2.1 is available with integrated app icon and security
verification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A
Restores the "Wipe pending" and "Wiped" status badges for Linux hosts on
the host details page.
These badges were requested to be hidden as part of work on #43116 and
later requested to be re instated after review.
Manually tested by triggering a wipe on a Linux host and confirming the
badge appears correctly.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Linux hosts now correctly display device wipe status in the host
details view. Wipe status indicators such as "Wipe pending" and "Wiped"
now appear consistently across all platforms. Previously, this
information was not visible for Linux hosts, resulting in incomplete
status visibility during device operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45180
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* MDM profiles can combine label inclusion (include-all/include-any)
with exclusion (exclude-any) so you can target hosts by labels while
excluding specific labeled hosts.
* Profile validation now enforces a single include-mode and explicitly
rejects any label used in both include and exclude lists.
* **Bug Fixes**
* Deleting a label that’s referenced by an MDM configuration profile or
declaration is blocked and returns an error to prevent broken targeting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated 8x8 Virtual Office macOS application metadata from version
8.33.2 to 8.34.1, including updated installer package and verification
checksum.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Extracts the Apple MDM initialization out of `runServeCmd` into testable
functions in a new `cmd/fleet/mdm_apple.go`. Continues the chain of
extractions on this issue (#44929, #45343, #45583, #46166, #46421)
toward the `serve.go` >60% coverage target discussed on #33370.
Five functions come out of the inline block:
- `initAppleMDMStorages` — constructs the MDM, DEP, and SCEP storages.
- `initAppleMDMPushService` — picks the no-op pusher under
`FLEET_DEV_MDM_APPLE_DISABLE_PUSH=1`, otherwise the real APNs pusher.
- `checkMDMAssetsExist` — promotes the inline `checkMDMAssets` closure
to a package function. It was already used at several call sites; they
now all share this one.
- `reconcileAppleMDMAPNsAndSCEPAssets` / `reconcileAppleMDMABMAssets` —
the APNs/SCEP and ABM asset reconciliation blocks.
Behavior is preserved — `runServeCmd` calls these in the same order with
the same arguments, and the full `cmd/fleet` suite passes unchanged
against MySQL + Redis. Each function returns early after `initFatal` so
it's also safe when the caller's `initFatal` doesn't terminate (the case
in tests).
On test scope: the new unit tests cover the dev-mode push gate, all four
branches of `checkMDMAssetsExist`, and the no-op and missing-private-key
paths of both reconcilers. The storage construction and the actual
asset-insert paths need a real datastore, so those stay covered by the
existing integration tests rather than new unit tests — I didn't want to
stand up a full datastore mock for paths that are already exercised
end-to-end.
**Related issue:** Refs #33370
# Checklist for submitter
- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Apple MDM initialization and configuration management for APNs,
SCEP, and Apple Business Manager with automatic reconciliation of
missing assets and a dev-mode option to disable push.
* **Tests**
* Added unit tests covering push-service behavior, asset-existence
checks, reconciliation logic, and fail-fast handling when required key
material is missing.
* **Refactor**
* Simplified Apple MDM initialization flow by extracting initialization,
push-service, and reconciliation logic into helpers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#46190
- Added a package init() to load the catalog from the embedded YAML
once.
- Init() now no longer runs any initialization logic just validation, so
it was renamed to Validate.
Fixes#46639
Hard-coded "/" and "/login" strings bypassed the URL prefix when Fleet
is deployed behind a reverse proxy at a subpath. Replaced with
PATHS.ROOT / PATHS.LOGIN, which embed URL_PREFIX, so redirects now land
at the correct subpath.
Fixes#46640
The root IndexRedirect used an absolute path ("/dashboard"), causing
React Router to push /dashboard to history regardless of the URL prefix.
This made the app fall through to the 404 route when Fleet was deployed
at a subpath (FLEET_SERVER_URL_PREFIX). Removing the leading slash lets
React Router resolve the redirect relative to the mounted route.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated application package definitions for 14 software applications
including 8x8 Work, AWS CLI, Chrome Remote Desktop, Claude, DBeaver
Community, Duo Desktop, Genesys Cloud, GitHub Desktop, GitKraken, Google
Chrome, Ollama, and Postman to their latest available versions with
corresponding installers and checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#45182
## What this does
Changes the foreign key constraints on
`mdm_configuration_profile_labels` and `mdm_declaration_labels` from `ON
DELETE CASCADE` (or no restriction) to `ON DELETE RESTRICT`. This
prevents a label from being deleted while it is still referenced by an
MDM configuration profile or declaration.
Previously, deleting a label that was targeted by a profile would
silently remove the label reference, leaving the profile in a \"broken\"
state in the UI (showing a \"Label deleted\" warning with no way to
recover without re-uploading the profile). With this change, Fleet
returns an error when attempting to delete a label that is in use by a
profile, prompting the user to remove the profile's label targeting
first.
## Why
This is part of a broader set of changes (CPIE include/exclude label
targeting) that introduces combined include+exclude label targeting on
profiles. Allowing silent label deletion would cause ambiguous broken
states when both include and exclude labels are in use on a single
profile.
## Testing
- Migration tested via the accompanying `_test.go` file, which covers:
- Label deletion is blocked when referenced by a configuration profile
label row
- Label deletion is blocked when referenced by a declaration label row
- Label deletion succeeds when not referenced by any profile or
declaration
- Verified that the `ALTER TABLE` DDL change does not trigger `ON UPDATE
CURRENT_TIMESTAMP` on `mdm_configuration_profile_labels.updated_at` (DDL
does not fire row-level triggers)
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42651
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added "Continuous" option for policy automations to re-run
script/software automations on every subsequent failure.
* Editable automations available directly from policy create, edit, and
details pages.
* New modal and field flows for managing automations (webhook/ticket,
calendar, conditional access) and a Patch automation CTA for patch
policies.
* **Improvements**
* Redesigned automations UI, table cell rendering, and list/footer
messaging for clarity.
* Various styling and layout refinements for consistent behavior and
overflow prevention.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#34668
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed profile resend behavior so configuration profiles are retried
using available identity attributes when a host has no linked IdP user
or the referenced IdP user is missing.
* Ensured profile resend markers are cleaned so pending resends behave
correctly after identity changes.
* **Tests**
* Improved test coverage to validate profile resend and status reset
when device mappings or identity links change.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated managed application packages to their latest versions across
macOS and Windows platforms. Includes version updates for 1Password,
Android Studio, AWS CLI, Camtasia, Claude, Cursor, Discord, Docker, Duo
Desktop, Figma, Firefox, GitKraken, Google Chrome, Gemini, Granola,
iTerm2, JetBrains Toolbox, Loom, Microsoft Office applications, Miro,
NordPass, Notion, RustDesk, and WhatsApp installations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41683
Unenroll/wipe Android on Fleet Free:
https://www.youtube.com/watch?v=JvsD3WBcDgE
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Android Lock, Wipe, and Clear passcode commands supported; Lock and
Clear for both personal (BYO) and company-owned (COBO) devices, Wipe for
COBO only.
* Android COBO Wipe exposed in Fleet Free (UI and API).
* **Bug Fixes**
* Personal Android unenroll now removes only the work profile (personal
data preserved) and no longer shows a transient “wiping” status in the
UI.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44652
Docs: https://github.com/fleetdm/fleet/pull/46631
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [x] Setting(s) is/are explicitly excluded from GitOps
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Route-aware OpenTelemetry trace sampling with tiered default ratios
(very low for select high-volume routes, reduced rate for admin reads,
full sampling otherwise).
* Admin-only GET/PATCH /debug/trace_sampler to view and update sampling
ratios and a runtime "force full" toggle.
* Liveness probe endpoints (/healthz, /version, /metrics) are excluded
from tracing; settings propagate to replicas at runtime without restart.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- updated the "show full quote" button on truncated testimonials in the
`<scrollable-tweets>` component to have a larger clickable area
- Updated how the `<scrollable-tweets>` component determines whether or
not to truncate a quote
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Improved quote overflow detection logic to more accurately identify
when quotes exceed their containers.
* Adjusted spacing and padding in tweet cards for better visual
consistency and layout refinement.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated internal workflow configuration for weekly export task
assignments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Updated a link on the device management page to go to the deployment
page (previously, it was going to /deploy, which redirects to the
deployment documentation page.)
- Updated the styles for the testimonials section on the device
management page
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed the "Deployment options" link on the device management page to
point to the correct destination.
* **Style**
* Improved layout by centering the tweets container on the device
management page.
* Slightly increased the hero content max-width to improve page balance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44053
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Error messages for undefined environment variables in GitOps
configurations now include clearer, actionable guidance with examples of
how to escape literal dollar-sign syntax (e.g., showing escaped forms).
This improves clarity when a variable is missing and helps users
distinguish between intended variable references and literal values,
reducing confusion.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46476?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44444
# Details
This PR fixes the following edge case when running `fleetctl gitops`:
1. A new fleet is added
2. That fleet is declared as an ABM default fleet and/or a fleet in a
VPP token location
3. The _other_ fleets declared as ABM defaults or VPP fleets are _not_
all provided in the GitOps run
In that case, the GitOps run would fail with an error that one of the
previously-existing fleets could not be found. This PR fixes the bug by
making sure that GitOps looks at both the currently-persisted fleets
(via the API) and any fleets that are being created in the current run.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- Reproduced the issue on `main` by attempting to create a new fleet
_and_ add it both as an ABM default fleet and to the set of VPP token
users in a single run, and getting an error about one of the existing
fleets not being found
- Verified that I was able to complete a gitops run successfully on this
branch with a new fleet as a VPP token user and a default ABM fleet
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Improved validation for Apple Business Manager and Volume Purchasing
Program token team assignments with clearer error messages when
referenced teams aren't found in Fleet.
* Enhanced team name matching to properly handle Unicode characters,
ensuring consistent team identification across GitOps configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes#45624
Part 1 of #45553 -- see there for the full behavioral contract and
Oracle.
## Changes
- New `orbit/pkg/backoff` package: shared, stateful exponential backoff
tracker with jitter, thread-safe, per-path isolation. This package will
serve all agent components that need backoff (orbit API, fleetd paths,
and potentially osquery TLS), but for now only Fleet Desktop uses it. We
are introducing it incrementally to reduce risk.
- Integrated into Fleet Desktop's `checkToken` retry loop -- the exact
tight-retry path that caused the #44816 DB outage. The main
ping/DesktopSummary loop does not need backoff (Ping is unauthenticated
with no DB cost; DesktopSummary already runs at most every 5 min).
- On error: interval doubles each failure (1s, 2s, 4s, 8s, ...) capped
at 5 minutes
- On success: resets immediately to normal polling interval
- Each communication path tracks its own backoff independently
## Manual testing
### Automated tests (17 total, all pass with -race)
\`\`\`
go test ./orbit/pkg/backoff/ -v -race -count=1 # 17 tests, 0 failures
make lint-go-incremental # 0 issues
\`\`\`
- 14 logic tests (exponential doubling, cap, jitter, reset, per-path
isolation, concurrent access, overflow detection, garbage input
flooring)
- 3 real-time ticker tests (actual time.Ticker with wall-clock
measurements)
### Local TUF end-to-end test (macOS)
Set up local TUF server via \`tools/tuf/test/main.sh\` with
\`SYSTEMS=macos FLEET_DESKTOP=1 GENERATE_PKG=1\`. This builds orbit and
Desktop from this branch, generates \`fleet-osquery.pkg\` with local TUF
root keys. Installed the package on macOS, enrolled to a local Fleet
server.
**Test: corrupt token to simulate #44816 expired-token scenario**
Wrote invalid token to \`/opt/orbit/identifier\`, then watched Desktop
and orbit logs.
Desktop backoff (exponential doubling):
\`\`\`
11:57:21 ERR get device URL, backing off next_retry=2.044s (1s * 2^1 +
jitter)
11:57:29 ERR get device URL, backing off next_retry=4.061s (1s * 2^2 +
jitter)
11:57:39 ERR get device URL, backing off next_retry=8.744s (1s * 2^3 +
jitter)
\`\`\`
Orbit detects and rotates the token:
\`\`\`
11:57:42 INF token TTL expired, rotating token
\`\`\`
Desktop recovers instantly:
\`\`\`
11:57:48 DBG enabling tray items
\`\`\`
Previously Desktop would have retried every 5s indefinitely (#44816).
With backoff, retry intervals double each failure and recovery is
immediate on the first success.
### Build verification
\`\`\`
go build ./orbit/cmd/desktop/ # compiles clean
go build ./orbit/cmd/orbit/ # compiles clean
\`\`\`
---
# Checklist for submitter
- [x] Changes file added for user-visible changes in \`orbit/changes/\`.
- [x] Input data is properly validated, no SQL changes, no JS changes.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops (backoff caps at 5 min).
- [x] Added/updated automated tests (17 tests, all pass with \`-race\`).
- [x] QA'd all new/changed functionality manually (local TUF e2e on
macOS).
## fleetd/orbit/Fleet Desktop
- [x] If the change applies to only one platform, confirmed that
\`runtime.GOOS\` is used as needed to isolate changes (backoff is
platform-agnostic).
- [x] Verified that fleetd runs on macOS (local TUF install + e2e test).
Linux/Windows need QA.
- [ ] Verified auto-update works from the released version of component
to the new version.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46656
`server/mdm/apple/vpp.do` retried transient Apple errors by **calling
itself recursively**, with the rate-limit branch nesting `retry.Do`
inside `retry.Do`.
This change replaces the recursion with a single retry loop (respecting
the prior 1 initial attempt + 3 retries), closes each response before
retrying, honors Apple's `Retry-After` capped at 30s so that a
multi-minute value can't block a synchronous request, and threads
`context` through the VPP calls so the backoff is cancellable. The retry
timings are otherwise unchanged from before.
Following @sgress454 suggestion, I considered routing this through the
shared `retry.Do` helper (a single attempt wrapped in `retry.Do` + an
error filter) but figured out that:
- retry.Do` owns its own wait schedule and its error filter returns an
outcome enum rather than a duration, so it can't honor Apple's
per-response `Retry-After` value.
- also, I'd have to change the `retry` package to receive an extra `ctx`
param so that the backoff is context-aware (which IMHO is more blast
radius than this incident fix should carry).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
**What was verified.** The new automated test cannot run against `main`
(the fix changes the VPP function signatures and adds the retry knobs),
so to confirm the actual failure mode I checked out `main` and ran a
small repro that drives the VPP client against an Apple endpoint that
always returns the rate-limit error. On `main`, the call **never
returns** — `do()` recurses without bound — and the repro times out:
```
--- FAIL: TestReproUnboundedRecursionOnMain (10.00s)
zz_repro_main_test.go:30: AssociateAssets did NOT return within 10s — unbounded retry recursion in do() on main
FAIL
FAIL github.com/fleetdm/fleet/v4/server/mdm/apple/vpp 10.642s
```
On this branch the same scenario returns a bounded error promptly. That
behavior is covered by the new `TestDoRetryIsBoundedAndNonRecursive`
(bounded rate-limit retries, `Retry-After` honored-but-capped, and
context cancellation), and the full `server/mdm/apple/vpp` package
passes.
**I did not perform an end-to-end QA against a live Apple endpoint**.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed a server out-of-memory crash that occurred when Apple VPP API
repeatedly returned transient errors during VPP operations, including
app installs, user registration, and license seat releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Jordan Montgomery
