<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41664
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Optimized database performance for vulnerability processing to reduce
contention during routine operations.
* Improved query efficiency for software cleanup processes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Changed "Resources / Blog" to "Resources / blog" in the website
navigation menu (both mobile and desktop variants) in
`website/views/layouts/layout.ejs`
This is a minimal text change — lowercasing "Blog" to "blog" in the nav
menu label, alt text, and data attributes across both mobile and desktop
navigation dropdowns.
Built for
[mikermcneil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1773453585867159)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Replace "signatures on all documents" with "signatures on many
documents"
- Replace "human resources" with "product vision"
- Remove "legal counsel" from CEO DRI responsibilities
- Replace "brand & product marketing (brandfronts, pitchfronts,
featurefronts, ICPs, personas, and targeting)" with "brand strategy"
Changes applied to both `handbook/ceo/README.md` and
`handbook/company/leadership.md`.
Built for
[mikermcneil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1773453403391289)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Updated two links in `handbook/ceo/README.md` that pointed to
`company/communications#schedule-time-with-the-ceo` to instead point to
`company/leadership#schedule-time-with-the-ceo`
- The `#schedule-time-with-the-ceo` section lives on the leadership
page, not the communications page, so these links were broken
## Changes
- `handbook/ceo/README.md` line 16 (Contact us section): updated link
target from `communications` to `leadership`
- `handbook/ceo/README.md` line 43 (Process the CEO's calendar section):
updated link target from `communications` to `leadership`
Built for
[mikermcneil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1773453157605119)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Changes:
- Added a "Modern change management" section to the homepage
- Updated the homepage layout to match the latest wireframes
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
## Summary
- Adds a new "Offboard a consultant" process to the People department
handbook page (`handbook/people/README.md`) with steps for notification,
KPI retirement, and access removal.
- Adds guidance on the Leadership page
(`handbook/company/leadership.md`) in the Consultants section, prompting
project DRIs to notify the Head of People when offboarding a consultant.
## Changes
### `handbook/people/README.md`
- New `### Offboard a consultant` section under Responsibilities, placed
after "Change the DRI of a consultant" and before "Add an advisor".
- Three-step process: DRI notification → retire KPI column (links to
existing [Retire a
KPI](https://fleetdm.com/handbook/people#retire-a-kpi) section) →
offboarding issue.
### `handbook/company/leadership.md`
- New blockquote in the Consultants section directing project DRIs to
notify the Head of People when ending a consultant engagement, with a
link to the new offboarding process.
---
Built for [Isabell
Reedy](https://fleetdm.slack.com/archives/D0AEGJCGJR0/p1773242873045939)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Isabell Reedy <113355639+ireedy@users.noreply.github.com>
Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
## Summary
- Adds a new weekly ritual assigned to @sampfluger88 for sending an
export/email to Primo's CRO every Friday with a list of non-ICP contact
form visitors.
- Adds a corresponding responsibility section ("Send Primo CRO weekly
export") to the Finance handbook README.
- This is in addition to warm-intro's by the support team for any actual
inbound requests that are not Fleet ICP.
## Changes
- `handbook/finance/finance.rituals.yml`: New ritual entry with weekly
frequency, autoIssue enabled, starting 2026-03-13.
- `handbook/finance/README.md`: New responsibility section with
step-by-step process.
Built for [Sam
Pfluger](https://fleetdm.slack.com/archives/C04DNAYL1QF/p1773439214834899?thread_ts=1773078316.093639&cid=C04DNAYL1QF)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41663
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
The 2 first software entries are for FMAs that had multiple versions in
Fleet and had been rolled back. Note that there is 1 row for each.
<img width="2940" height="1912" alt="LWScreenShot 2026-03-13 at 2 53
50 PM"
src="https://github.com/user-attachments/assets/48464655-5728-4965-8fd4-4c4c0c550f35"
/>
## Summary
- Adds new Fleet policies (`update-slack.yml`) for macOS and Windows
that **fail** if a device has an outdated version of Slack installed
(below `4.48.100`).
- Follows the existing `update-*` policy pattern used by 1Password,
Claude, and Firefox.
- Registers both policies in `workstations.yml` under the appropriate OS
sections.
## Changes
| File | Description |
|---|---|
| `it-and-security/lib/macos/policies/update-slack.yml` | New macOS
policy: checks `apps` table for `Slack.app` version via
`version_compare` |
| `it-and-security/lib/windows/policies/update-slack.yml` | New Windows
policy: checks `programs` table for `Slack` version via
`version_compare` |
| `it-and-security/fleets/workstations.yml` | Adds both policy paths to
the workstations fleet |
## Policy behavior
The policy **passes** if Slack is not installed OR if the installed
version is >= `4.48.100`. The policy **fails** if Slack is installed but
at a version older than `4.48.100`.
---
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1773436302175049)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds Slack as managed software to the Workstations fleet for
**macOS**, **Windows**, and **Linux** so it is installed on all new and
existing devices and kept up to date automatically.
- Uses **Fleet-maintained apps** (`slack/darwin`, `slack/windows`) for
macOS and Windows to ensure the latest version is always deployed.
- References the existing `slack-deb.yml` and `slack-rpm.yml` package
definitions for Linux (Debian and RPM).
- All entries include `self_service: true` and `setup_experience: true`
to install on new devices during setup and allow self-service
reinstallation.
- Mobile devices (iOS, iPadOS, Android) already have Slack configured in
both company-owned and personal mobile device fleets — no changes needed
there.
## Changes
Only `it-and-security/fleets/workstations.yml` is modified:
| Platform | Method | Entry |
|----------|--------|-------|
| macOS | `fleet_maintained_apps` | `slack/darwin` (Apple Silicon) |
| Windows | `fleet_maintained_apps` | `slack/windows` (x86) |
| Linux (Debian) | `packages` | `slack-deb.yml` |
| Linux (RPM) | `packages` | `slack-rpm.yml` |
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1773435271021419)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
This pull request removes Slack from the managed software and policy
lists for all platforms (macOS, Linux, and Windows) in the workstation
fleet configuration. The associated policy file for keeping Slack up to
date on macOS has also been deleted.
Key removals by theme:
Slack software and policy removal:
* Removed the `update-slack.yml` policy from the list of enforced macOS
policies in `workstations.yml`.
* Deleted the `update-slack.yml` policy file for macOS, which checked
that Slack was up to date.
Slack application removal from managed software:
* Removed Slack from the list of managed apps for macOS
(`slack/darwin`), Linux (`slack-deb.yml` and `slack-rpm.yml`), and
Windows (`slack/windows`) in the `workstations.yml` configuration.
[[1]](diffhunk://#diff-48e4b7825d0b94911c4b33cccbe16ac3698dfb4b3e365a86432b58f06294daaaL227-L242)
[[2]](diffhunk://#diff-48e4b7825d0b94911c4b33cccbe16ac3698dfb4b3e365a86432b58f06294daaaL287-L292)
[[3]](diffhunk://#diff-48e4b7825d0b94911c4b33cccbe16ac3698dfb4b3e365a86432b58f06294daaaL340-L345)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41190
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
* Improved audit log accuracy when canceling pending lock or wipe
commands. The original activity record is now preserved, with the
cancellation tracked as a separate follow-up entry for better
visibility.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37092
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added per‑IP rate limiting to IdP metadata and SSO endpoints.
* Implemented TTL-backed in‑memory caching for IdP metadata responses to
reduce backend load.
* **Tests**
* Added tests covering metadata caching behavior, cache miss/error
handling, and content type preservation.
* Added tests validating rate limiting behavior across clients, bursts,
and proxy scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41091
# Details
Implements the following config key aliases:
- [x] Add a second name for `bootstrap_package`:
`macos_bootstrap_package`
- Support `bootstrap_package` for backwards compatibility
- [x] Add a second name for `manual_agent_install`:
`macos_manual_agent_install`
- Support `manual_agent_install` for backwards compatibility
- [x] Add a second name for `enable_release_device_manually `: `apple_
enable_release_device_manually `
- Support `enable_release_device_manually` for backwards compatibility
- [x] Add a second name for `script`: `macos_script`
- Support `script` for backwards compatibility
Also cleans up some error messages missed in previous alias PRs.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
ran gitops successfully with new keys
_working on spinning up an ARM Arch Linux host to verify this fix_
**Related issue:** Resolves#33495
- [x] Changes file added for user-visible changes in `changes/`
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved OS name normalization for Arch Linux ARM hosts by removing
redundant system identifiers for cleaner display.
* **Tests**
* Added validation tests for Arch Linux ARM and standard Arch Linux host
configurations to ensure consistent OS naming and architecture mapping.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35528
The existing migrations were bumped in #41624 so they should be good for
the 4.83 release
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- Changes file exists in main (`changes/35528-wrong-title-platform`) but
was reverted out of 4.82 release.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40007
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41328
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must rule]
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue where executable hashes failed to compute for macOS app
bundles with emoji or other Unicode characters in executable names,
improving bundle detection and integrity checks.
* **Tests**
* Added comprehensive tests to ensure correct handling of Unicode escape
sequences and emoji in bundle names and executables.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41532
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved error messaging when deleting a certificate authority that is
referenced by certificate templates. Users now receive a clear,
user-friendly message instead of a generic database error.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#33714
Added alias `GET /api/v1/fleet/scripts/batch/abc-def/host_results` for
`GET /api/v1/fleet/scripts/batch/abc-def/host-results` for consistency
sake.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
This PR contains identical frontend changes to those currently in
`recovery-pw-feature` - this allows separate frontend review of the code
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41653
<img width="810" height="597" alt="Screenshot 2026-03-13 at 8 44 23 AM"
src="https://github.com/user-attachments/assets/b5e7feff-e576-4c0d-a9ee-b2ef1a17a7ea"
/>
- [x] Changes file added for user-visible changes in `changes/`
- [x] QA'd all new/changed functionality manually
Changes:
- Moved the quote higher up the page.
- Updated "configuration as code" to "infrastructure as code".
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
This PR updates the device management landing page to better reflect
Fleet’s positioning around high-agency device management and
infrastructure-as-code.
Changes
- Reordered sections to prioritize speed and agency
- Moved “Modern change management” to the top of the positioning
narrative to highlight Fleet’s ability to ship device management changes
quickly.
- Moved the comparison section further down the page so visitors first
understand the value proposition before evaluating alternatives.
- Updated the customer quote to better reflect the
infrastructure-as-code story and added the customer logo for stronger
social proof.
Changes:
- Changed "Configuration as code" to "Infrastructure as code."
- Updated "UI, API, or infrastructure as code" feature block to not be
duplicative.
- Removed "agent" from the bottom ticker.
- Corrected typo on screenshot.
