**Related issue:** Resolves#45180
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* MDM profiles can combine label inclusion (include-all/include-any)
with exclusion (exclude-any) so you can target hosts by labels while
excluding specific labeled hosts.
* Profile validation now enforces a single include-mode and explicitly
rejects any label used in both include and exclude lists.
* **Bug Fixes**
* Deleting a label that’s referenced by an MDM configuration profile or
declaration is blocked and returns an error to prevent broken targeting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#46190
- Added a package init() to load the catalog from the embedded YAML
once.
- Init() now no longer runs any initialization logic just validation, so
it was renamed to Validate.
Fixes#46639
Hard-coded "/" and "/login" strings bypassed the URL prefix when Fleet
is deployed behind a reverse proxy at a subpath. Replaced with
PATHS.ROOT / PATHS.LOGIN, which embed URL_PREFIX, so redirects now land
at the correct subpath.
Fixes#46640
The root IndexRedirect used an absolute path ("/dashboard"), causing
React Router to push /dashboard to history regardless of the URL prefix.
This made the app fall through to the 404 route when Fleet was deployed
at a subpath (FLEET_SERVER_URL_PREFIX). Removing the leading slash lets
React Router resolve the redirect relative to the mounted route.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42651
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added "Continuous" option for policy automations to re-run
script/software automations on every subsequent failure.
* Editable automations available directly from policy create, edit, and
details pages.
* New modal and field flows for managing automations (webhook/ticket,
calendar, conditional access) and a Patch automation CTA for patch
policies.
* **Improvements**
* Redesigned automations UI, table cell rendering, and list/footer
messaging for clarity.
* Various styling and layout refinements for consistent behavior and
overflow prevention.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#34668
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed profile resend behavior so configuration profiles are retried
using available identity attributes when a host has no linked IdP user
or the referenced IdP user is missing.
* Ensured profile resend markers are cleaned so pending resends behave
correctly after identity changes.
* **Tests**
* Improved test coverage to validate profile resend and status reset
when device mappings or identity links change.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41683
Unenroll/wipe Android on Fleet Free:
https://www.youtube.com/watch?v=JvsD3WBcDgE
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Android Lock, Wipe, and Clear passcode commands supported; Lock and
Clear for both personal (BYO) and company-owned (COBO) devices, Wipe for
COBO only.
* Android COBO Wipe exposed in Fleet Free (UI and API).
* **Bug Fixes**
* Personal Android unenroll now removes only the work profile (personal
data preserved) and no longer shows a transient “wiping” status in the
UI.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44652
Docs: https://github.com/fleetdm/fleet/pull/46631
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [x] Setting(s) is/are explicitly excluded from GitOps
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Route-aware OpenTelemetry trace sampling with tiered default ratios
(very low for select high-volume routes, reduced rate for admin reads,
full sampling otherwise).
* Admin-only GET/PATCH /debug/trace_sampler to view and update sampling
ratios and a runtime "force full" toggle.
* Liveness probe endpoints (/healthz, /version, /metrics) are excluded
from tracing; settings propagate to replicas at runtime without restart.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44053
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Error messages for undefined environment variables in GitOps
configurations now include clearer, actionable guidance with examples of
how to escape literal dollar-sign syntax (e.g., showing escaped forms).
This improves clarity when a variable is missing and helps users
distinguish between intended variable references and literal values,
reducing confusion.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46476?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46656
`server/mdm/apple/vpp.do` retried transient Apple errors by **calling
itself recursively**, with the rate-limit branch nesting `retry.Do`
inside `retry.Do`.
This change replaces the recursion with a single retry loop (respecting
the prior 1 initial attempt + 3 retries), closes each response before
retrying, honors Apple's `Retry-After` capped at 30s so that a
multi-minute value can't block a synchronous request, and threads
`context` through the VPP calls so the backoff is cancellable. The retry
timings are otherwise unchanged from before.
Following @sgress454 suggestion, I considered routing this through the
shared `retry.Do` helper (a single attempt wrapped in `retry.Do` + an
error filter) but figured out that:
- retry.Do` owns its own wait schedule and its error filter returns an
outcome enum rather than a duration, so it can't honor Apple's
per-response `Retry-After` value.
- also, I'd have to change the `retry` package to receive an extra `ctx`
param so that the backoff is context-aware (which IMHO is more blast
radius than this incident fix should carry).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
**What was verified.** The new automated test cannot run against `main`
(the fix changes the VPP function signatures and adds the retry knobs),
so to confirm the actual failure mode I checked out `main` and ran a
small repro that drives the VPP client against an Apple endpoint that
always returns the rate-limit error. On `main`, the call **never
returns** — `do()` recurses without bound — and the repro times out:
```
--- FAIL: TestReproUnboundedRecursionOnMain (10.00s)
zz_repro_main_test.go:30: AssociateAssets did NOT return within 10s — unbounded retry recursion in do() on main
FAIL
FAIL github.com/fleetdm/fleet/v4/server/mdm/apple/vpp 10.642s
```
On this branch the same scenario returns a bounded error promptly. That
behavior is covered by the new `TestDoRetryIsBoundedAndNonRecursive`
(bounded rate-limit retries, `Retry-After` honored-but-capped, and
context cancellation), and the full `server/mdm/apple/vpp` package
passes.
**I did not perform an end-to-end QA against a live Apple endpoint**.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed a server out-of-memory crash that occurred when Apple VPP API
repeatedly returned transient errors during VPP operations, including
app installs, user registration, and license seat releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45282
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Deploy custom OS update configuration profiles for Apple
(macOS/iOS/iPadOS) and Windows; tracks and enforces one custom OS‑update
profile per scope.
* **Improvements**
* Prevent changing OS update settings when a custom profile exists;
returns guidance to remove the custom profile first.
* Batch upload now detects OS‑update payloads and enforces license
requirements.
* UI error handling surfaces API-specific messages.
* FileVault control separated from OS updates and gated behind a
configurable flag/license.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes the race after Windows BYOD MDM enrollment (Settings > Access
work or school > Connect) where mdm_windows_enrollments.host_uuid stayed
empty for ~10s while osquery's distributed-read cycle ran
directIngestMDMDeviceID Windows. During that gap any server-side lookup
keyed on host UUID via MDMWindowsGetEnrolledDeviceWithHostUUID returned
NotFound.
processIncomingMDMCmds now inspects unlinked enrollments on every
management session: it parses any incoming Results for
./DevDetail/Ext/Microsoft/SMBIOSSerialNumber, looks up the Windows host
by hardware_serial, and updates host_uuid. If still unlinked after
processing the incoming message, it appends a Get for that LocURI to the
response so the device replies on the next round-trip. The Get is
idempotent and reinjected each session until linkage succeeds.
The post-link UPN/SCIM/DEP bookkeeping previously inlined in
directIngestMDMDeviceIDWindows is extracted into a shared helper
(osquery_utils.LinkWindowsHostMDMEnrollment) so both the new SyncML path
and the osquery direct-ingest backstop run it exactly once per linkage.
New datastore method WindowsHostLiteByHardwareSerial does a Windows-only
serial lookup and returns NotFound when two Windows hosts share a
serial, so we never mis-link on virtualization-shared SMBIOS values.
For Autopilot and Entra-during-OOBE the host record does not exist until
fleetd installs later in ESP, so the osquery backstop and the name-based
fallback in setup_experience.go remain in place for those flows.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45380
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Immediately link Windows BYOD MDM enrollments to host records during
the first management session when a device serial is present, and prompt
the device to resend serial info if missing.
* Detect and ignore placeholder/ambiguous hardware serials to avoid
incorrect host linking.
* Reduce noisy warnings for internal-sync command IDs.
* **Bug Fixes**
* Resolve a race causing Windows MDM enrollments to remain unlinked for
several seconds.
* **Tests**
* Added coverage for serial-based linkage, retry behavior, placeholder
detection, and internal-command ID handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Konstantin Sykulev <konst@sykulev.com>
Refactored `ListHostSoftware` and `ModifyAppConfig` into smaller helpers
so nilaway can analyze them for nil-pointer dereferences
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46554
Refactoring. No functional changes.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved host software listing by consolidating assembly, merging,
deduplication, and out-of-scope filtering into dedicated helpers for
more reliable and maintainable results.
* Streamlined app configuration updates by extracting conditional-access
(Okta) validation into a focused helper, improving validation
consistency and error reporting.
* **Chores**
* Updated static analysis configuration: bumped a pinned plugin version
and removed a suppression rule that hid certain internal lint messages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#40362
Use INSERT IGNORE in the sync path so that a policy deleted between
distributed query dispatch and result ingestion is silently skipped,
matching AsyncBatchInsertPolicyMembership which already handles this
race with the same approach.
**Related issue:** Resolves#43116
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fedora/Linux wipe now removes Btrfs snapshots (including read-only)
before wiping so snapshots won’t persist.
* **UI**
* Linux-specific guidance and external links added to wipe dialogs and
wiped/failed-wipe activity items; wipe status tags suppressed for Linux
hosts.
* Activity entries include host platform to enable platform-specific
messaging.
* **Tests**
* Updated tests to cover Linux-specific wipe messaging, links, and
activity payloads.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46119
New activities visible on host details page:
<img width="482" height="424" alt="image"
src="https://github.com/user-attachments/assets/8b8b33b2-c135-4061-b258-473fcc109d89"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* MDM unenrollment events now appear on the host activity timeline in
host details.
* **New Features**
* Host activity entries for MDM unenroll show platform- and actor-aware
messaging and appropriate action/icon visibility.
* **Tests**
* Added tests to verify rendering and messaging for various platforms
and actor presence.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46388
Video demo: https://www.youtube.com/watch?v=t3yuGh0kwP8
Docs PR: https://github.com/fleetdm/fleet/pull/46483
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
## New Fleet configuration settings
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* UI to add/remove Entra application (client) IDs for Windows automatic
enrollment; add/delete modals and list management.
* **Enhancements**
* Activity feed entries for added/removed Entra client IDs.
* Entra client ID allowlist surfaced in GitOps and persisted config;
client IDs normalized (trim/lowercase) and de-duplicated.
* **Documentation**
* Note: from July 1, 2026 new on‑prem Windows MDM apps receive Entra v2
tokens with aud = client ID; v1 tokens remain supported.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Refactored the conditional access policy query to use `CONCAT('%', ?,
'%')` with a bound parameter instead of string concatenation for the
platform `LIKE` clause, consistent with how other queries in this file
handle string filters.
## Test plan
- [ ] Verify conditional access policy lookup still returns correct
results for macOS/Windows hosts.
- [ ] Confirm no regression in policy filtering behavior.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved platform filtering in conditional access policy queries to
enhance query reliability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#46283
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an error in the "Get host's OS settings" API so it no longer
fails when only Android MDM is enabled.
* Configuration profiles endpoint now correctly responds when Android or
Windows MDM is the active platform, in addition to Apple MDM.
* **Tests**
* Added tests covering configuration profiles behavior across Apple,
Windows, and Android MDM configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#46066
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected MDM status label in the hosts table so enrollment states
display accurately.
* Fixed platform handling so "Not supported" appears appropriately for
Chrome and Linux hosts.
* **New Features**
* Added a hover tooltip on the MDM status in the hosts table to show
additional context.
* **Style**
* Improved tooltip text wrapping to keep status names on a single line.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#44970 (1/2).
---
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* `fleetctl get fleets` / `get teams` now display software and setup
experience from authoritative software endpoints.
* Preserve literal setup_experience fields (avoid erroneous macos_setup
renames) when applying and when transmitting JSON for software entries.
* **Tests**
* Added regression tests and test helpers to ensure
software/setup_experience are sourced correctly and to prevent nil
panics in related tests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#43045
Fixed a bug where the carve cleanup cron job called the MySQL
implementation instead of the S3-aware implementation on S3-configured
deployments, meaning expired carves were never marked as expired in S3.
Also fixed a panic in S3 carve cleanup that occurred when there were no
non-expired carves.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46338
Changes load tested (osquery load test).
<img width="1532" height="282" alt="image"
src="https://github.com/user-attachments/assets/9eb38629-918e-4e05-bc0b-e2ae22e8b148"
/>
<img width="1414" height="937" alt="image"
src="https://github.com/user-attachments/assets/1b90afd3-087c-452e-939f-b495df3e59c8"
/>
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Performance Improvements**
* Extended host cache retention period from 60 seconds to 180 seconds to
improve overall cache efficiency and hit rates.
* Optimized host cache invalidation strategy to eliminate unnecessary
reverse-index lookups, significantly reducing database reader load and
Redis CPU consumption.
* **Tests**
* Added test coverage for host update cache invalidation edge cases to
ensure proper behavior.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46458?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
We allow this already with "Preview payload" under Settings >
Integrations > MDM > End user migration workflow.
**Related issue:** Resolves#44719
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Closes#46153
This PR is big, but I found it worth it to include in the same PR to
keep the mental change context in one place.
This PR moves away from our previous version of a big SQL computing the
desired state and label membership with big union branches. It does so
by switching the model up completely, first:
- We batch read hosts (current hardcoded is 5k), and we always iterate
5k hosts and then decide if they have changes, so that means a tick
(30s) could read 5k hosts that DOES NOT require changes, but that is
computed in code after, rather than relying on a big SQL to do it
(twice).
- We then for those hosts, bulk fetch label memberships, their related
team profiles and current rows. This performs much better as we can
lookup everything we need by primary key or super fast indexed columns,
simple fetch all these calls.
- Then once gathered the information we move to the code to determine if
the operation is install, remove, NO-OP (Desired state calculation),
then we check the label membership to further determine it's final
action.
- We then move to what we did before, which is queue the correct command
etc.
It comes with some slight caveats, which is we now load a lot more data
into memory (but before we could spike worse), so when loadtesting we
watched CPU/Memory utilization, which never seemed to spike as the
datasets are kept as small as possible.
_Cleanup will come in a follow-up PR where we remove all the old code._
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Performance**
* Optimized Apple profile and DDM (Declarations) reconciliation engine
with batched processing for significantly improved performance in
environments with large numbers of Apple-enrolled hosts.
* Implemented cursor-based pagination for more efficient reconciliation
across large fleets.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45573?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude <noreply@anthropic.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45286
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Create local admin account = true
Primary account type = none
End user auth required = true
= No primary account setup screen shown - jumps straight to
username/password login which I can login to with the password shown in
the UI.
Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’`
only returns `_fleetadmin`
**Note: EACAS is not available on this mac (or this user?)** - however
it’s still possible to Wipe via MDM commands.
Create local admin account = true
Primary account type = standard
End user auth required = true
= Primary account setup screen shown (also works with IDP info being
locked and populated).
Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’`
returns `_fleetadmin` and my end user (IDP info locked in this case)
Opening Settings -> Users & Groups -> Shows my primary account as
“Standard”
**Note: Benefit of the user can’t do EACAS** (Prompted: “Admin user
required”)
__fleetadmin also can’t do EACAS_
Create local admin account = false
Primary Account type = N/A (but admin)
End user auth required = true
= Shown primary account setup screen with IDP info populated and locked
Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’`
only returns my primary user
Opening Settings -> Users & groups -> shows my primary account as
“Admin"
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* macOS setup now supports end-user account types: `admin`, `standard`,
or `none`.
* Setup flows and device commands respect the selected primary account
type (e.g., create regular user or skip creation).
* **Validation**
* Configuration now enforces that a local admin account exists/enabled
when required by the chosen end-user account type.
* **Tests**
* Added coverage for `standard` and `none` validation and command
behavior.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46179?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#43456
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Android MDM profiles now include content checksums; devices are
re-synced only when profile content changes, reducing unnecessary
deliveries.
* **Migrations**
* Database schema updated to add and backfill checksum fields for
Android configuration and host profiles.
* **Tests**
* Added and updated tests to validate checksum generation, backfill, and
behavior in profile delivery scenarios.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46276?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes#43030
## Summary
- Batches title IDs in `getDisplayNamesByTeamAndTitleIds` (chunks of
32,000) to avoid exceeding MySQL's 65,535 prepared statement placeholder
limit
- Uses the existing `BatchProcessSimple` utility, matching the pattern
already used in `software_titles.go`
## Root cause
When `GET /api/v1/fleet/software/versions` is called without a
`per_page` parameter, `DefaultPerPage` (1,000,000) is used.
`ListSoftware` collects all `titleIDs` from the paginated results and
passes them to `getDisplayNamesByTeamAndTitleIds`, which builds an `IN
(?)` clause that exceeds MySQL's 65,535 placeholder limit.
## Manual testing
1. Started a local Fleet server with MySQL via `docker compose up` and
`fleet serve --dev`
2. Seeded the database with 70,000 software titles, software entries,
and software_host_counts records
3. **Before the fix**: `GET /api/latest/fleet/software/versions` (no
`per_page`) returned HTTP 422 with `"Prepared statement contains too
many placeholders"`
4. **After the fix**: the same request returns HTTP 200 with all 70,000
results
5. `GET /api/latest/fleet/software/versions?per_page=20` continued to
work correctly in both cases
## Test plan
- [x] Manual reproduction and verification (see above)
- [x] `make lint-go-incremental` passes
- [x] `go build ./server/datastore/mysql/...` compiles cleanly
- [ ] CI passes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed `GET /api/v1/fleet/software/versions` endpoint to prevent errors
when returning results from large software inventories.
* **Tests**
* Added test coverage for high-volume display name queries.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45737?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46226
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Add CA certificate rollover CLI to renew MDM CA certs with an
extend-years option while preserving the private key and certificate
properties.
* **Improvements**
* Decryption logic updated to accept previously-rolled CA certificates
so escrowed disk-encryption keys can be decrypted after rollover.
* **Tests**
* Expanded tests and mocks to cover rollover and decryption scenarios.
* **Chores**
* Updated ignore rules and added a changelog entry for the rollover
process.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46226?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
After ADE enrollment with enable_disk_encryption: true, hosts reported
as unencrypted with the disk-encryption policy failing and no recovery
key escrowed until the user logged out/in or restarted.
## Root cause
Fleet's shared macOS disk-encryption probe was:
```
SELECT 1 FROM disk_encryption
WHERE user_uuid IS NOT "" AND filevault_status = 'on' LIMIT 1
```
On the osquery disk_encryption table, filevault_status and user_uuid
are populated from independent sources: filevault_status from
`fdesetup status`, user_uuid from `diskutil apfs listCryptoUsers`
(the UUID of a user with SecureToken authority to unlock the volume).
In the post-ADE window, even with ForceEnableInSetupAssistant=true,
SecureToken propagation can lag — filevault_status='on' but
user_uuid='' for a brief period that resolves on a session event.
When the predicate failed, the query returned 0 rows and three
downstream behaviors broke in lockstep:
- host_disks.encrypted flipped to false ("unencrypted")
- the built-in "Full disk encryption enabled (macOS)" policy failed
- mdm_disk_encryption_key_file_*_darwin returned encrypted=0,
gating the PRK ingest and leaving the recovery key un-escrowed
The predicate originated in groob's standard query library entry
from 2021 as a strict compliance check ("is the host actually
protected, with a user able to unlock it?"). When the disk-encryption
status feature shipped in Nov 2022 (PR #8526, issue #3906), the
same string was reused verbatim and later extracted into
usesMacOSDiskEncryptionQuery — never revisited for whether the
SecureToken gate made sense outside the compliance-policy context.
**Related issue:** Resolves#45369
Closes#42249
Supersedes #42247 (stale draft with merge conflicts)
## Summary
- Hides the "Rotate password" button entirely in the Recovery Lock
password modal when the user has the Observer role (`canRotatePassword`
is false), instead of showing a disabled span with a tooltip
- Removes unused `TooltipWrapper` import and orphaned SCSS styles for
the disabled state
- Consistent with the existing pattern in `ManagedAccountModal` which
already hides the button for observers
## Changes
- `RecoveryLockPasswordModal.tsx`: Return `null` when
`!canRotatePassword` instead of rendering disabled tooltip
- `_styles.scss`: Remove `__rotate-button--disabled` styles
- Added `RecoveryLockPasswordModal.tests.tsx` with two tests covering
button visibility based on role
## How I tested
- Added unit tests (following the `ManagedAccountModal.tests.tsx`
pattern) that verify:
- The "Rotate password" button is **not rendered** when
`canRotatePassword={false}` (Observer role)
- The "Rotate password" button **is rendered** when
`canRotatePassword={true}` (Admin/Maintainer role)
- Both tests pass locally
- ESLint passed clean on all changed files
- Webpack build succeeded; verified the built bundle no longer contains
the old tooltip text or disabled-button CSS class
## Test plan
- [ ] Log in as an Observer, navigate to a macOS host with Recovery
Lock, open the Recovery Lock password modal, and confirm the "Rotate
password" button is not visible
- [ ] Log in as an Admin/Maintainer and confirm the "Rotate password"
button still appears and works
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* The "Rotate password" control in the Recovery Lock Password modal is
now hidden when password rotation is unavailable (e.g., for Observer
role) instead of being shown as a disabled control.
* **Tests**
* Added tests verifying the rotate-button visibility behavior based on
rotation availability/permissions.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45649?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#46009.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Resolved an authorization issue preventing users from viewing past
host activities on hosts that contained user-initiated operations such
as lock, wipe, run script, or install software.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46362?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42744
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- Tested setup experience on a macOS virtual machine, see below.
This is what happens after the change:
- Editing pkg while setup experience is running, whether the package is
pending or currently running, doesn't cancel anything. Installs were
successful.
- Editing pkg while queueing a normal install caused it to cancel with
no record.
- Deleting while an installer is running causes the row to disappear
immediately in the setup experience UI, HSI row removed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Editing a software installer no longer cancels in-progress
setup-experience installs; running setup-experience flows are preserved
when installer scripts are updated.
* Deleting an installer still removes its associated pending
setup-experience entries and related pending host-install records.
* GitOps batch updates: editing installers in a batch preserves running
setup experiences; omitting an installer from a batch deletes only that
installer’s pending entries.
* **Tests**
* Added/updated integration tests validating edit/delete behavior during
setup experience.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46236?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Fixes a security issue where `POST /api/latest/fleet/targets` returned
sensitive fleet configuration to users with insufficient privileges.
Other team-facing endpoints apply proper access controls; the target
search path did not.
- Replaces the `teamSearchResult` struct with a slim version containing
only the non-sensitive fields documented in the API response (`id`,
`created_at`, `name`, `description`, `user_count`, `host_count`,
`display_text`, `count`).
- Removes the `MarshalJSON`/`UnmarshalJSON` methods (~70 lines) that
serialized fields the target picker never uses.
- Verified that no frontend component, fleetctl client, or integration
test reads sensitive fields from the target search response.
- Validated the response shape matches the documented API contract in
`docs/REST API/rest-api.md`.
Closesfleetdm/confidential#16054
Related advisory: GHSA-88p2-jj8w-j8qg
## How we reproduced
1. Started local dev server (`fleet serve --dev --dev_license`)
2. Created a global observer user and a saved query with
`observer_can_run = true`
3. Logged in as the observer
**Before fix** -- same observer session, same team:
```
GET /api/latest/fleet/fleets/2/secrets
-> secret: "********" (correctly masked)
POST /api/latest/fleet/targets {"query":"","query_id":7,"selected":{"hosts":[],"labels":[],"teams":[]}}
-> sensitive configuration leaked for all teams
```
**After fix** -- rebuilt binary, restarted server, same observer:
```
GET /api/latest/fleet/fleets/2/secrets
-> secret: "********" (unchanged)
POST /api/latest/fleet/targets (same request)
-> only non-sensitive fields returned (id, name, display_text, count, etc.)
```
Also verified admin target search still returns team metadata correctly.
## Test plan
- [x] Manual reproduction on local dev server
- [x] Manual verification after fix
- [x] Admin target search still returns team metadata (id, name,
host_count, display_text)
- [x] Verified no consumers (frontend, fleetctl, tests) read sensitive
fields from target search
- [x] Validated response matches documented API contract in `docs/REST
API/rest-api.md`
- [x] Unit test verifies response contains only documented non-sensitive
fields
- [x] `go test ./server/service/ -run TestSearchTargets` passes
- [ ] CI passes
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] QA'd all new/changed functionality manually
## Database migrations
- [X] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a migration cleanup tool to recover from failed starts after
migration renumbering.
* Supports dry-run mode to preview the SQL changes and apply mode to
execute fixes.
* Includes secure database connection options and safe, transactional
execution with reporting for detected issues.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46177?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
Resolves#45149 and #45150.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [X] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [X] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [X] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [X] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added team policy setting continuous_automations_enabled (default:
false) to re-run software/script automations on every failing
evaluation; exposed in APIs and GitOps YAML. Disallowed for "All fleets"
and requires a premium license.
* **Tests**
* Added integration tests for CRUD, GitOps, and re-queuing behavior
validating continuous automations.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45999?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#41053
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Android hosts associated with an IdP now display as "{IdP first
name}'s {device model}" when IdP fullname is available.
* Enrollment now links hosts to an MDM IdP account when enrollment
payload includes IdP info.
* **Bug Fixes / Behavior**
* Unenrollment records and host naming use device brand+model for
hardware identification and sensible fallbacks when IdP data is missing.
* Re-enrollment updates IdP association without creating duplicate
hosts.
* **Tests**
* Added tests covering display-name and hardware-model behavior with and
without IdP data.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46135?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#46009.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed permissions for host activity items by aligning serialized field
names used by authorization rules, ensuring fleet-scoped users receive
correct access rights when listing and reading host activities.
* **Tests**
* Added authorization tests validating host activity access control
across user roles and team scopes, including denial cases for
unauthorized and GitOps-scoped users, and verifying policy evaluation
depends on correct serialized field naming.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46203?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41683
Support for Android lock, wipe, and clear passcode commands. Behavior is
slightly different between BYOD and CODO. The fleetdm.com proxy isn't
wired up, so they only work with direct Google connection.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Clear-passcode CLI plus Android Lock and Wipe commands (Wipe
restricted to company-owned devices).
* BYO unenroll now removes only the work profile, preserving personal
data.
* Commands issued with a 10-year duration; UI/CLI show Android-specific
messaging and command IDs.
* **Improvements**
* Host MDM pages reflect command lifecycle transitions (pending →
acknowledged or error with code/message) via Pub/Sub updates.
* **Documentation**
* Updated docs for Android MDM commands, ownership rules, and command
duration.
* **Tests**
* New unit and integration tests for Android MDM flows.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46031?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42219Resolves#42224
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced Windows MDM profile validation: uploads that are non-XML,
empty, or lack required SyncML top-level elements are rejected; LocURI
values that are empty, start with `/`, contain `..` path traversal, or
are otherwise malformed are now rejected (whitespace-trimmed),
preventing later device deployment failures.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46029?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Andrew Mellor
