**Related issue:** Resolves#44391
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added release notes documenting vulnerability scanning performance
improvements
* **Refactor**
* Optimized vulnerability scanning performance through enhanced CVE
product matching efficiency
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Make it match
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated messaging on the observability page's hero section headline
from "Open orchestration" to "Real-time reporting"
* Updated the bottom call-to-action headline similarly to "Real-time
reporting"
* Changed secondary call-to-action text to emphasize faster insights
("Find things out in seconds")
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
50% of Fleet customers don't use IaC, and have huge fleets. It's not
that ClickOps doesn't scale-- it's that there's another way.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the "There is another way" section header on the
Infrastructure as Code page with revised wording.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Mike T to review
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Updated homepage hero with new CTAs: "Try it yourself" and "Join a
workshop"
* Added "Explore device management" and "More about visibility"
call-to-action buttons
* Enhanced marketing messaging highlighting multi-OS support and
flexible deployment options
* Reordered comparison table dropdown options for better navigation
* Updated CTAs from "Get a demo" to "See case studies" for case study
access
* Refreshed banner heading to emphasize high-agency device management
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Updated Claude desktop macOS to version 1.6608.0
* Updated Dialpad macOS to version 2605.0.2
* Updated Tor Browser macOS to version 15.0.13
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
## Summary
- Adds a customer testimonial from Oscar Taracena (Technical Operation
Engineer, Anduril Industries) to the `/linux-management` landing page
- Both testimonials (Oscar Taracena and Roger Cantrell) are now styled
to match the Dan Jackson testimonial format on the
`/infrastructure-as-code` page, including:
- Company logo displayed above the quote text (Anduril Industries logo
for Oscar, Nutanix logo for Roger)
- Horizontal author layout with `name-and-title` wrapper
- Updated CSS for `quote-image`, `name-and-title`, row-based
`quote-author-info`, and matching font sizes
## Changes
- `website/views/pages/landing-pages/linux-management.ejs` — Updated
both testimonial sections to include company logos and use the
`name-and-title` wrapper structure
- `website/assets/styles/pages/landing-pages/linux-management.less` —
Added `quote-image` and `name-and-title` styles, changed author info to
horizontal row layout, aligned font sizes with infrastructure-as-code
page
- `website/assets/images/logo-anduril-104x40@2x.png` — Added Anduril
Industries logo (sourced from official company logo)
-
`website/assets/images/testimonial-author-oscar-taracena-100x100@2x.png`
— Added Oscar's headshot image
---
Built for [Daniel
Gordon](https://fleetdm.slack.com/archives/D0AHXRWHZD1/p1778186427565669?thread_ts=1778183252.605929&cid=D0AHXRWHZD1)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Updates the "GitOps mode" indicator in the top navigation bar to
become a clickable link that navigates to
`/settings/integrations/change-management` when the current user is a
global admin.
- For non-global-admin users, the indicator remains as a non-clickable
text badge (unchanged behavior).
## Changes
- **`frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx`**: Added
`isGlobalAdmin` prop to `GitOpsModeIndicator` component. When true,
wraps the indicator content in a `<Link>` to
`PATHS.ADMIN_INTEGRATIONS_CHANGE_MANAGEMENT`. Otherwise, renders the
content as-is.
- **`frontend/components/top_nav/SiteTopNav/_styles.scss`**: Added
`.gitops-mode-indicator__link` styles to ensure the link has no default
link styling (no underline, inherited color) and shows a pointer cursor.
Built for [Rachael
Shaw](https://fleetdm.slack.com/archives/D0AFC5BRFHD/p1777410934139609?thread_ts=1777406096.224979&cid=D0AFC5BRFHD)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44958
# Details
Fixes two issues on the checkerboard:
1. Ensures that the chart shows data going back 30 calendar days (not
720 hours) if it has it
2. Leaves `0` values out of the chart color band calculations in
"relative" color mode
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
**Before**
Colors clustered in top 3 levels, empty boxes in first column:
<img width="705" height="416" alt="image"
src="https://github.com/user-attachments/assets/b867a1a9-4c52-4b96-92fd-04e7848c6295"
/>
**After**
Colors spread over all levels, no empty boxes in first column:
<img width="707" height="412" alt="image"
src="https://github.com/user-attachments/assets/c67e11c5-6dd8-4e66-9c32-9d9213ccb24f"
/>
For unreleased bug fixes in a release candidate, one of:
- [X] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Charts request an extra day to ensure full calendar-day coverage
across timezones.
* Checkerboard visualization excludes empty/no-data slots from relative
color scaling so color ramps reflect non-zero data.
* Calendar view trims leading partial days so the displayed window
matches the selected range.
* **New Features**
* Chart date-range selection expanded to support any value from 1–31
days.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Microsoft Edge macOS managed app payload to version
148.0.3967.54 with updated installer and verification checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Fixed an overly long first title on the en and fr version of landing
page which made the page look sloppy. Made the language tighter. Also
updated the filenames to all lowercase to match the slugs to align with
standards, and make it easier to find the files when editing.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated installer metadata for multiple applications on macOS: Arc
(1.146.0), Brave Browser (148.1.90.121), Cursor (3.3.22), Firefox
(150.0.2), Firefox ESR (140.10.2), GitKraken (12.1.1), Signal (8.9.0),
and Tor Browser (15.0.12) with the latest version information, download
URLs, and checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Kubernetes deployment chart to v7.0.1 with application version
v4.84.3.
* Updated container image versions across cloud deployment
configurations to v4.84.3.
* Updated command-line tool version to v4.84.3.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41472
-
[Figma](https://www.figma.com/design/2jRQoXofC1caxyNhWl8F0m/Android-certificates--support-for-subject-alternative-name--SAN--attributes-in-certificates?node-id=2-130&p=f&m=dev)
- Needs to merge to main after
https://github.com/fleetdm/fleet/pull/44690
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Subject Alternative Name (SAN) field to the certificate
management modal with comprehensive validation support.
* **Tests**
* Expanded test coverage for the certificate modal with enhanced
validation scenarios and server response handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Update SHA256 checksums for fleet-desktop (v1.2.0) across Homebrew cask,
API metadata, and darwin output. Adjusts the cask sha256, API sha256 and
ruby_source_checksum to match the rebuilt package artifact.
Set macos_updates.update_new_hosts to false in the workstations fleet
config to prevent automatic updates from being applied to newly enrolled
macOS hosts. This change enables controlled rollout and testing of
updates before enabling automatic updates for new machines.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Modified macOS workstation update configuration to disable automatic
updates for newly provisioned hosts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves
#https://github.com/fleetdm/confidential/issues/15648
Updated IT Leader's Linux Guide and landing page with version of the
asset translated to French.
Website:
- Removed the stripe script tag from the website layout
- Removed the stripe-card-element component
- Removed stripe from the assets eslint configuration
- Removed unused methods and modals from the customer dashboard
- Removed the unused sails account-overview page
- Removed the open-stripe-checkout utility
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Removed Stripe payment integration from the application.
* Removed account overview page and associated billing management
features.
* Removed payment card management functionality (add, update, remove
cards) from the dashboard.
* **Style**
* Removed styles for deprecated payment components.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#34103
The SSO invite acceptance page submitted a create-user request without
the invitee's email, because it read `email` from the URL query string
which the invite email link never populates. To resolve this the email
was loaded by calling GET /api/_version_/fleet/invites/{token} endpoint.
As part of this fix, the ConfirmSSOInvite components were refactored
from 'classical' components to functional components.
Missing https:// in original commit
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
For the following issue:
- https://github.com/fleetdm/fleet/issues/41419
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated tooling and documentation wording across scripts, utilities,
and infrastructure files to reflect the product terminology change from
“teams” to “fleets” (references now note “fleets” and indicate the
former “teams” naming).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
## Summary
- Adds a new "Mark an account as a Top target" section to the
Go-To-Market operations handbook page
- Placed after the existing "Remove a contact from the Top contacts list
in Salesforce" section, as both relate to account/contact management in
Salesforce
## Changes
- `handbook/company/go-to-market-operations.md`: Added new `### Mark an
account as a "Top target"` section with instructions for labeling
accounts and a callout about stack ranking target accounts.
---
Built for [Sam
Pfluger](https://fleetdm.slack.com/archives/D0AF8QFBVHB/p1778106382921239?thread_ts=1775094096.519039&cid=D0AF8QFBVHB)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
Relates to: https://github.com/fleetdm/fleet/issues/44529
## Summary
- Adds "Fleet will try again." text to the host-level activity feed for
MDM commands with a "NotNow" status, matching the existing behavior in
the CommandDetailsModal.
- Previously, users had to open the modal to see this retry information;
now it's visible directly in the activity feed.
## Changes
-
`frontend/pages/hosts/details/cards/Activity/CommandItem/CommandItem.tsx`:
When a command's `status` is `"NotNow"`, append " Fleet will try again."
to the activity text displayed in the feed.
## QA
1. Navigate to a host details page with MDM commands enabled.
2. Trigger or find a command with "NotNow" status (host locked or
running on battery in Power Nap).
3. Verify the activity feed item shows "The **{command}** command is
deferred. Fleet will try again."
4. Verify the CommandDetailsModal still shows the full deferred message
with "Fleet will try again."
---
Built for [Mel
Pike](https://fleetdm.slack.com/archives/D0AKX7DJFCN/p1777575458215749?thread_ts=1777299502.461149&cid=D0AKX7DJFCN)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: melpike <79950145+melpike@users.noreply.github.com>
Resolves#34104
When saving SMTP settings with SSL/TLS off, STARTTLS on, and SSL cert
verification on, the test-email send produced an opaque Go cert error
that gave users no actionable hint. The two TLS-related toggles also
live on different settings cards with no cross-reference, which made the
conflict hard to spot before hitting Save.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42218
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Note: Sim update included and validated with and without supplemental,
screen shots attached
<img width="760" height="87" alt="Host List"
src="https://github.com/user-attachments/assets/c55f0ace-a205-4242-95da-510e8e6ec4ad"
/>
<img width="1511" height="523" alt="Standard"
src="https://github.com/user-attachments/assets/74a42e57-9391-4ce0-8b0a-ad3de6ab4745"
/>
<img width="1505" height="526" alt="Supplimental"
src="https://github.com/user-attachments/assets/392fc603-c7a2-4d6f-8ae0-87767cab7e3c"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* iOS/iPadOS devices managed via MDM now include reported supplemental
OS version text (e.g., Rapid Security Response suffixes) in the
displayed OS version string.
* **Bug Fixes**
* Supplemental extras are validated; invalid values are ignored.
Combined version strings are length-limited and safely truncated.
* **Tests**
* Added tests for supplemental handling, validation, fallback, and
truncation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42637
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
### Reproduction steps:
- Created Label X and Label Y as manual labels in the UI.
- Applied gitops referencing the labels. The specified profile
referenced Label X:
```yaml
macos_settings:
custom_settings:
- path: ../repro-42637-profile.mobileconfig
labels_exclude_any:
- "Repro Label X 42637"
```
- Manually ran a SQL query to update `label_id` to NULL.
<img width="712" height="46" alt="Screenshot 2026-05-06 at 6 19 51 PM"
src="https://github.com/user-attachments/assets/32f386c7-adf3-48e8-adee-03102831e556"
/>
- Re-ran gitops referencing Label Y in the profile config.
```yaml
macos_settings:
custom_settings:
- path: ../repro-42637-profile.mobileconfig
labels_include_any:
- "Repro Label Y 42637"
```
- Old row was preserved AND a new one was created (association to Label
Y):
<img width="709" height="68" alt="Screenshot 2026-05-06 at 6 22 07 PM"
src="https://github.com/user-attachments/assets/fe2c4644-eb95-45a0-a582-994ad88e45be"
/>
### Testing steps
- Re-built fleetctl with the fix applied and re-ran gitops, still
referencing Label Y for the profile.
- Confirmed the orphan row was deleted.
<img width="740" height="212" alt="Screenshot 2026-05-06 at 6 24 43 PM"
src="https://github.com/user-attachments/assets/da9e9461-c352-4266-80b8-625a98e055ec"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
* Fixed an issue where MDM configuration profiles would remain enforced
on hosts after their associated labels were deleted during fleetctl
gitops apply operations. Label associations are now properly cleared
when profiles are reapplied with updated targeting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44676
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
## Testing
- [ ] Added/updated automated tests
just style fixes, but the ["disable features: frontend"
PR](https://github.com/fleetdm/fleet/pull/44797) has some tests
- [X] QA'd all new/changed functionality manually
- [x] make hosts enrolled chart match height w/ checkerboard
- [x] use empty boxes with outline instead of filled boxes for 0 value
- [x] use dark-mode colors for green theme
- [x] put host enrolled chart bars between horizontal rules instead of
on top of them
- [x] only show date and # of hosts in tooltip, no percentage or
denominator
- [X] add day of week to checkerboard tooltip
- [x] use comma in tooltip numbers
- [x] use relative shading in both datasets
- [x] make text size match between hosts enrolled and checkerboard
titles
- [x] on vuln chart tooltip, add "Want more control over this chart?
Comprehensive vulnerability filtering is [coming soon](link to this
issue: https://github.com/fleetdm/fleet/issues/44746)."
- [x] on vuln chart tooltip, fix link styling in dark mode
- [x] change "Hosts active" => "Hosts online"
- [x] Update tooltip copy to "The number of hosts detected online during
a given hour. A host is considered online if it's actively checking in
to Fleet. This includes sleeping hosts (e.g. lid closed)."
- [X] Fix issue where at smaller widths, the entire page has a
horizontal scrollbar
- [X] Make charts stay pegged to the right side when first loaded and
when resizing window
Charts align:
<img width="1223" height="479" alt="image"
src="https://github.com/user-attachments/assets/4a7ba859-a0aa-43c6-a06b-4ef8361e2418"
/>
Data tooltip:
<img width="162" height="77" alt="image"
src="https://github.com/user-attachments/assets/5b1768e4-0736-4e45-ad49-6faf31958352"
/>
Vuln tooltip:
<img width="387" height="123" alt="image"
src="https://github.com/user-attachments/assets/98c2096f-fa4e-4b06-917e-ec6eed844b05"
/>
Hosts online tooltip:
<img width="360" height="113" alt="image"
src="https://github.com/user-attachments/assets/bd65cd1d-0f0c-4c72-a31d-ffe602cacd9c"
/>
For unreleased bug fixes in a release candidate, one of:
- [X] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Optional relative scaling for chart visualizations
* Responsive chart sizing in the Hosts Enrolled card
* **Improvements**
* Dataset label updated to "Hosts online"
* Tooltips and labels show formatted host counts with proper
pluralization
* Day labels now include weekday for clearer dates
* Chart descriptions mention upcoming vulnerability filtering
* Tighter header, dropdown, scrollbar, and dark‑mode styling
* **Tests**
* Updated dataset heading test and added a relative‑scale color ramp
test
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Luke Heath <luke@fleetdm.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** For #44077
# Details
This PR implements enforcement of the "disable dataset" feature.
When a dataset is disabled globally, we:
* Stop collecting all data for that dataset (the `Collect` method for
that dataset is not called in the cron job)
* Remove all previously-collected data for the dataset via an
asynchronous job
When a dataset is disabled for one or more fleets, we:
* Provide the list of disabled fleets as an argument to each dataset's
`Collect` method. Each dataset is responsible for filtering out hosts in
the most efficient way possible
* Scrub the data for the relevant datasets using a bitmask, so that all
hosts from the disabled fleets are removed from the data. This is done
via an asynchronous job.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [X] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [X] Added/updated automated tests
- [X] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
### Prerequisites / Test Setup
- [ ] Fleet running with at least 3 teams (call them T1, T2, T3) and ≥3
hosts in each, plus ≥2 hosts with no team
- [ ] At least one host on each team has reported recent uptime (within
the bucket window)
- [ ] At least one host in each team is affected by a tracked CVE (so
`host_scd_data` for `dataset='cve'` will have non-empty bitmaps)
- [ ] AppConfig: both `features.historical_data.uptime` and
`features.historical_data.vulnerabilities` start as `true`; same for
every team
- [ ] Let the collection cron run at least one full tick to populate
baseline rows in `host_scd_data` for both `uptime` and `cve`
- [ ] Note the current row count per dataset: `SELECT dataset, COUNT(*)
FROM host_scd_data GROUP BY dataset;`
---
### 1. Cron Skips Globally-Disabled Datasets
#### 1.1 Global disable of `uptime`
- [x] Disable globally: `PATCH /api/v1/fleet/config` with
`features.historical_data.uptime = false`
- [x] Verify activity feed shows `disabled_historical_dataset` for
`uptime` (existing behavior)
- [x] Wait for next collection tick (or trigger it via fleetctl debug if
available)
- [x] Confirm **no new rows** appear for `dataset='uptime'`:
`SELECT MAX(valid_from) FROM host_scd_data WHERE dataset='uptime';`
should not advance after the disable
- [x] Confirm cron still writes `cve` rows on the same tick (per-dataset
isolation)
- [x] Re-enable: PATCH `historical_data.uptime = true`
- [x] Verify next tick resumes writing `uptime` rows
#### 1.2 Global disable of `vulnerabilities`
- [x] Repeat 1.1 with `features.historical_data.vulnerabilities`
- [x] Confirm `cve` writes stop, `uptime` continues
#### 1.3 Both disabled globally
- [x] Disable both globally
- [x] Confirm cron tick produces zero new rows for either dataset
- [x] Confirm cron does not error or get stuck
- [x] Re-enable both
---
### 2. Per-Fleet Disable — Cron Filters at SQL
#### 2.1 Single team disabled for one dataset
- [x] Disable uptime for T1 only: PATCH team T1 with
`features.historical_data.uptime = false`
- [x] Verify scoped `disabled_historical_dataset` activity emitted for
T1
- [x] Wait for next cron tick / trigger cron
- [x] Pick a host known to be in T1 (call it `H_T1`); confirm its bit is
NOT set in any `uptime` row written *after* the disable by filtering the
chart to that host
- [x] Pick a host in T2 (`H_T2`); confirm its bit IS still set in the
same rows (T2 is not disabled)
- [x] Pick a no-team host (`H_none`); confirm its bit IS still set
(no-team hosts follow the global value)
#### 2.2 Same fleet, different dataset
- [x] With T1's uptime disabled, confirm T1's hosts ARE still written
into `cve` rows on subsequent ticks (per-dataset isolation)
#### 2.3 All teams disabled, global on, no-team hosts
- [x] Disable uptime on every team (T1, T2, T3)
- [x] Confirm next tick still writes a row containing only no-team
hosts' bits (global is on, no-team hosts always count)
- [x] Re-enable uptime on all teams
---
### 3. Global Scrub — DELETE
#### 3.1 Successful global scrub
- [x] Note baseline:
`SELECT COUNT(*) FROM host_scd_data WHERE dataset='uptime';`
(should be > 5000 to exercise the loop; if not, manually
insert filler rows or run multiple cron ticks)
- [x] Disable uptime globally via the API
- [x] Wait for the worker to pick up the scrub / trigger the job
- [x] Confirm the count drops to 0:
`SELECT COUNT(*) FROM host_scd_data WHERE dataset='uptime';`
- [x] Confirm rows for **other datasets** are untouched
- [ ] Test again but disable via GitOps
---
### 4. Per-Fleet Scrub — ANDNOT
#### 4.1 Single-fleet scrub clears bits
- [x] Identify hosts in T1 and record their IDs (call this set `S`)
- [x] Pre-disable, confirm at least one `host_scd_data` row for
`dataset='uptime'` has bits set at positions in `S` by filtering the
chart to those hosts
- [x] Disable uptime on T1 only, via the API
- [x] Wait for the scrub to run / trigger it
- [x] Confirm: every existing row for `dataset='uptime'` now has NO bits
set at any position in `S`. Spot-check by filtering the chart to those
hosts
- [x] Confirm rows for `dataset='cve'` (different dataset) are untouched
- [x] Confirm bits for hosts in T2/T3 (not disabled) are still set
- [x] Run test again but disable via GitOps
#### 4.2 Multi-fleet scrub via GitOps batch
- [x] Apply a GitOps spec that flips cve to false on T1 and T3 in a
single apply
- [x] Wait for scrub(s) to complete
- [x] Confirm bits for the union of T1∪T2 hosts are cleared from every
row of `dataset='cve'`
- [x] Confirm T2 hosts' bits remain set
---
### 5. Activity Feed Cross-Check
- [x] Each global flip emits exactly one `disabled_historical_dataset`
activity (existing behavior, unchanged)
- [x] Each per-team flip emits one scoped activity with the team's
ID and name
- [x] PATCH submitting unchanged values emits **no** activity and
causes **no** scrub (no `host_scd_data` data change observed
after the cron tick)
- [x] No new "scrub completed" or "scrub started" activity is
emitted (out of scope for v1)
- [x] Re-enable flips emit `enabled_historical_dataset` activities
and do NOT emit any scrub-related activity
---
### 6. Regression Spot Checks
- [x] With everything enabled (default), the chart UI renders the
same data as before this change (no behavior change in the
"all on" case)
- [x] AppConfig YAML round-trip (`fleetctl apply`) is benign:
applying the unchanged config produces no scrub jobs and no
activities
- [x] GitOps apply with `historical_data` omitted from team specs
defaults to `true` (per the gitops-api change) and does not
trigger spurious scrubs
- [x] After a full disable+scrub of cve, the `host_scd_data` table
has no `dataset='cve'` rows; the chart UI for "vulnerable
hosts over time" shows an empty/zero state without errors
---
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Chart collection now supports per-dataset scoping and honors
team-level disables; new scrub jobs are registered and worker handlers
added.
* New dataset scrub operations: global and fleet-scoped scrubs; scrubs
can be enqueued and are deduplicated to avoid duplicate pending jobs.
Historical-data changes enqueue scrubs after save (errors logged,
non-blocking).
* **Tests**
* Added unit tests for scope resolution, scrub enqueue/dedup behavior,
scrub workers, scrub application, and low-level blob scrub logic.
* **Documentation**
* Added OpenSpec metadata for the chart scrub change.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Updated Linux page main cta to download new Linux white paper.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Replaced primary demo/contact CTAs with a prominent "Read the
whitepaper" CTA on the Linux management landing page (hero and bottom
sections).
* Preserved the "See Fleet in action" video CTA in the hero section;
layout updated for consistent presentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Keka macOS to version 1.6.4
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Adds a link to the partner logo scrollbar for Primo's logo
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Primo partner logo in both carousel rows is now clickable and opens
the Primo site in a new tab.
* Both carousel links use a no-icon presentation for a cleaner,
consistent appearance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
Resolves#41996
Some IdPs push SCIM PATCH operations that bundle `department` with other
RFC 7643 §4.3 enterprise attributes that Fleet does not store. Before
this change the SCIM library rejected those payloads with a 400 because
the schema only declared 'department'.
An environment variable was added (FLEET_DEBUG_SCIM_PAYLOADS) for aiding
in further debugging this if the issue persist.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43890
Frontend for macOS Local Admin Password Rotation
Changes file added during past work
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added ability to rotate managed local account passwords for hosts
* Added visibility for auto-rotation scheduling and pending rotation
status
* New activity feed entries for managed local account password rotation
events (successful and failed rotations)
* **Improvements**
* Enhanced host action menu to display managed account options when
password is available
* Added real-time status updates and notifications during password
rotation operations
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43887
Adds the password rotation state machine for macOS local admin accounts.
Changes file covered in prior PR
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Automatic macOS managed-local-account password rotation (5‑minute
scheduler) with queued SetAutoAdminPassword device commands
* Manual rotation API: POST /hosts/{id}/managed_local_account/rotate
(returns 204)
* API now reports auto-rotation timing and pending-rotation state
(auto_rotate_at, pending_rotation)
* Activity records for successful and failed rotations
* **Behavior Changes**
* Password availability is based on stored encrypted password (broader
than before)
* Rotate-while-in-flight is rejected to prevent duplicate rotations
* **Tests**
* New unit and integration tests for rotation flows, cron behavior, and
failure paths
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44082
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced GitOps script logging: reports how many scripts would be
applied in dry‑run mode or were actually applied, with per-team and
per-fleet breakdowns.
* **Tests**
* Added test coverage validating logging output for both dry‑run and
real execution, ensuring reported script counts and per-team/fleet
messages are accurate.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Konstantin Sykulev
