**Related issue:** Resolves#21818
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* The CLI now detects when SSO is enabled on the server and shows a
warning directing users to authenticate with an API token (with guidance
link) instead of email/password.
* **Bug Fixes**
* Authentication error messaging is now SSO-aware, improving guidance
when credential login fails.
* **Tests**
* Added coverage to verify the authentication guidance changes correctly
based on whether SSO is enabled.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Juan Fernandez <juan@fleetdm.com>
## Summary
Adds the loadtest metrics for the **4.86 → 4.87 migration** run,
following the existing `tools/loadtest/metrics/runs/migration/`
convention (cf. `485to486mig`).
Two files:
- `486to487mig-2026-06-17-195042Z-1h.md` — 1h metrics synopsis
- `486to487mig-2026-06-17-195042Z-1h.json` — raw collected metrics
## Results (1h window, 2026-06-17)
✅ All metrics within expected thresholds
- Fleet errors: **0**
- RDS deadlocks: **0**
- Abnormal container stops: **0**
- ALB 5xx: **0**
Data only — no code changes.
cc @AndreyKizimenko for approval.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added load testing metrics data capturing performance statistics for
infrastructure components including Fleet Server, database, caching, and
load balancer metrics during a 1-hour test window.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Pd macOS app to version 0.56.5
* Updated Postman macOS app to version 12.15.6
* Updated SideNotes macOS app to version 1.6.2
* Updated Zed macOS app to version 1.7.2
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#35615
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved YAML output generation for agent options. Empty command line
flags are now cleanly omitted, and unnecessary comment blocks are
removed for a more concise output structure.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** #44719
Also, make sure the **Dashboard > Activity > Automations** modal is
grayed out when in GitOps mode.
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Standardized button labels across modals to use "Example payload" /
"Example data" consistently instead of mixed "Preview" or "Show/Hide"
variants.
* **Bug Fixes**
* Disabled relevant controls (example toggles, payload preview,
destination URL inputs, toggles) when GitOps mode is enabled so UI
reflects read-only mode.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Baseline loadtest results for Fleet 4.87.0 (20h run).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added baseline load test performance metrics for infrastructure
monitoring and analysis.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Introduce Spokenly to the catalog and UI: add homebrew input metadata,
add apps.json entry, and add darwin output with version 2.22.1,
installer URL, sha256, and install/uninstall script refs. Also add
frontend icon component and image, and register Spokenly in the icon
index mapping.
**Related issue:** Resolves#47524
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
## Context
[CVE-2026-34182](https://nvd.nist.gov/vuln/detail/CVE-2026-34182) (CVSS
9.1, Critical) is an OpenSSL CMS `AuthEnvelopedData` input-validation
flaw fixed in `openssl 3.5.7-r0`. The Alpine base image used by
`fleetdm/fleet` ships `3.5.6-r0`, which scanners (Aikido, Trivy) flag on
our published image.
`fleet serve` itself is statically compiled and does not link OpenSSL,
so the running process is unaffected — but the package is present in the
base image and shows up in customer-side SBOM scans.
## Approach
The issue's preferred path is a base-image SHA bump to `alpine:3.23.5`.
Docker Hub's latest `3.23.x` tag is still `3.23.4` (pushed 2026-04-15),
so that path isn't yet available. Applying the issue's fallback:
```dockerfile
RUN apk --no-cache upgrade openssl libcrypto3 libssl3
```
This pulls the patched `openssl 3.5.7-r0` from the Alpine 3.23 repos at
image build time without waiting on a new base tag. Once `alpine:3.23.5`
lands we can revert to a clean SHA-pinned `FROM` bump per the pattern in
#43671.
## Scope
Limited to `tools/fleet-docker/Dockerfile` per the issue's scope
guidance. Other Dockerfiles pinned to the same Alpine SHA (loadtest,
scep, mdmproxy) are out of scope here.
## Test plan
- [ ] CI image build passes.
- [ ] Trivy/scanner re-scan of the resulting `fleetdm/fleet` image
confirms CVE-2026-34182 is gone and `openssl` reports `3.5.7-r0`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated OpenSSL and related packages in Docker image build
configuration to ensure the latest versions are included during image
creation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47678
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Teams can now pin software titles to designate preferred versions for
tracking and management.
* **Chores**
* Database schema updated to support software title pinning.
* Updated team deletion procedures to handle associated pins.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated macOS application versions: 4k-YouTube-to-MP3 (26.1.5), Claude
for Desktop (1.13576.1), CMake (4.3.4), Codex (26.611.62324), and Loom
(0.354.2).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Updated version metadata and installer information for 63 maintained
applications across macOS and Windows platforms, including development
tools, browsers, communication utilities, and productivity software.
Updated version numbers, download links, and integrity checksums to
support deployment of latest stable application releases across
supported systems.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46059
Added `daemon_reachable` and `error` columns to the `santa_status`
fleetd table so the table reports a row when the Santa daemon is
unreachable instead of silently returning zero rows.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Reproduced the issue:
<img width="1476" height="255" alt="Screenshot 2026-06-17 at 11 12
55 AM"
src="https://github.com/user-attachments/assets/bf7f20c2-9e77-499d-9962-0996f5c57cb1"
/>
<img width="1644" height="632" alt="Screenshot 2026-06-17 at 11 14
34 AM"
src="https://github.com/user-attachments/assets/57c790b6-ccf2-4446-90a4-164cdcbacadd"
/>
Pushed a new orbit version with the fix to the TUF server:
<img width="689" height="58" alt="Screenshot 2026-06-17 at 11 34 25 AM"
src="https://github.com/user-attachments/assets/77b70d51-856f-4957-869e-1458540154dd"
/>
Ran the query again: we now return one row instead of no rows, and
`daemon_reachable = 0` is returned. Rest of the values are null.
<img width="2542" height="545" alt="Screenshot 2026-06-17 at 11 36
37 AM"
src="https://github.com/user-attachments/assets/6d71167e-9711-4284-9142-48629edbd9be"
/>
Approved the system extension and granted full disk access:
<img width="791" height="664" alt="Screenshot 2026-06-17 at 11 38 39 AM"
src="https://github.com/user-attachments/assets/3f4f91b0-d20a-4afc-93f9-347efe823beb"
/>
<img width="733" height="643" alt="Screenshot 2026-06-17 at 11 39 20 AM"
src="https://github.com/user-attachments/assets/596d3fb8-7b0e-4532-94d6-f5c28802f343"
/>\
Verified the state changed from `[activated waiting for user]` to
`[activated enabled]` and `santactl status` did not return errors:
<img width="1429" height="708" alt="Screenshot 2026-06-17 at 11 40
02 AM"
src="https://github.com/user-attachments/assets/f9402808-0755-478c-9c95-78aa2e5c65f4"
/>
Ran queries again and verified `daemon_reachable = 1`
<img width="2525" height="548" alt="Screenshot 2026-06-17 at 11 41
33 AM"
src="https://github.com/user-attachments/assets/bf65ec55-c719-48e1-9a29-4b38aa52a882"
/>
<img width="1656" height="528" alt="Screenshot 2026-06-17 at 11 42
34 AM"
src="https://github.com/user-attachments/assets/42b51b5b-9123-4919-beeb-b847a0a99668"
/>
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added `daemon_reachable` to Santa status monitoring to clearly
indicate reachability (`1` reachable, `0` unreachable).
* Added an `error` column to expose the `santactl status` error when the
daemon is not reachable.
* **Bug Fixes**
* Updated Santa status behavior so daemon communication failures now
return exactly one row with `daemon_reachable = 0` (and `error`
populated) instead of returning no rows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47650
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Improved authentication resilience by debouncing repeated unauthorized
responses and only triggering recovery after a grace period.
* Updated node-key handling to avoid treating empty key files as valid
and to prevent accidental deletion during short failures.
* Ensured node-key storage is written atomically to avoid partial or
empty credential files.
* **Tests**
* Added comprehensive test coverage for node re-enrollment behavior,
authentication grace-period timing, and atomic file write guarantees.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Relates to #43045
Skip carves whose upload has not completed (BlocksComplete) so cleanup
only reconciles carves that should already have a listable object.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45661
I couldn't really find another good solution that would solve it all, as
the path resolution is spread out, plus unassigned merging into global
config definitely makes it more complex (root cause of the issue).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed GitOps relative path resolution so controls and nested
organization settings correctly resolve referenced files from their
source directory, including cases with `unassigned.yml`.
* Corrected macOS setup assistant uploads to use the base filename
instead of the full configured path/URL.
* **Tests**
* Added regression coverage for GitOps relative path handling across
working-directory and nested-file scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45353
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added support for `$FLEET_VAR_HOST_*` variables in Android managed app
configurations, including host UUID, hardware serial, platform, and
end-user IdP details.
* **Improvements**
* Android app configurations are now validated to reject unsupported
Fleet variables.
* Fleet variables are substituted with real per-host values during
Android app configuration deployment, including batch/GitOps and
host-specific workflows.
* **Tests**
* Added unit and integration coverage for supported/unsupported
variables, substitution behavior, and JSON escaping.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#47343
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for providing an identity provider (IdP) UUID in
enrollment-token requests via an `idp_uuid` query parameter, affecting
both fully-managed and non-fully-managed flows.
* Enrollment OTA now carries the IdP UUID into the enrollment flow and
token request, with server-rendered pages exposing the selected IdP when
applicable.
* **Bug Fixes**
* For fully-managed enrollments, the IdP/SSO cookie is cleared after
successful authentication to avoid stale IdP selection.
* **Tests**
* Extended coverage for `idp_uuid` precedence over the IdP cookie and
for cookie-clearing behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44645
# Summary
On the My device > Self-service page, apps that just finished updating
briefly flashed the "Update" button again during the inventory refetch.
The "recently updated" flag was only set by the pending-poll, so other
refetch paths could surface a completed-but-stale app before it was
flagged. Now a `selfServiceData`-keyed effect flags completed user
actions on every data change, so the card holds "Updated" through the
refetch instead of reverting.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or
`ee/fleetd-chrome/changes`. See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
https://github.com/user-attachments/assets/c9a6ee13-c1f9-4ba0-a704-a578552a5dcd
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Resolved an issue on the **My device > Self-service** page where the
**“Update”** button could briefly reappear after app updates, even
though the card should remain in the **“Updated”** state until the
software inventory refresh completes.
* **Tests**
* Added coverage to ensure the **“Updated”** UI state persists while
inventory refetch is pending, and that the **“Update”** button does not
render during that window.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Overview
`dibble` is a one-stop CLI for seeding a Fleet server with test data —
users, teams, policies, reports, labels, scripts, MDM profiles,
software, secrets, CAs, and vulns — replacing ~8 ad-hoc seeding tools
with a single binary.
It makes it easy to:
- **Spin up a populated dev/test server in one command** — `dibble all`
plants everything with sensible, idempotent defaults.
- **Skip the flag-memorization** — running `dibble` with no args
launches an interactive wizard that prompts for Fleet URL, API token,
theme, and which entities to seed, and offers to save the config to
`~/.dibble.yaml`.
- **Seed individual entity types** — `dibble users`, `dibble teams`,
`dibble policies`, etc., when you only need one slice.
- **Get themed, recognizable test data** — pick a theme (hitchhikers,
tng, lotr, ghibli, parksrec, …) so seeded names are easy to eyeball in
the UI.
Hosts are intentionally out of scope — `cmd/osquery-perf` still owns
that. `dibble hosts` is a thin convenience wrapper that picks a fleet,
fetches its enroll secret, and prints/runs the osquery-perf invocation
for you.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Dibble: a CLI tool to seed realistic test data, including an
interactive wizard and subcommands for
teams/users/software/policies/scripts/reports/profiles/labels/activities/enroll-secrets/hosts/vulns,
plus theme-driven “cas” and “ping”.
* Theme system: multiple curated themes to generate consistent seeded
identities, policies, software, labels, and scripts.
* **Chores**
* Ignored the built dibble binary and added a Makefile build target to
compile the dibble tool.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45601
Responsiveness:
https://github.com/user-attachments/assets/d7ea6297-8677-4093-b343-b76c64121f53
Removed border from Action header:
<img width="1450" height="134" alt="image"
src="https://github.com/user-attachments/assets/1dad670c-9f11-4911-862f-2d77a2e5c1cf"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. In another PR
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added client-side search by organization name in the Apple Business
Manager table.
* Enabled **BYOD fleet** selection in Apple Business Manager fleet
editing and saving.
* **Bug Fixes**
* Standardized enrollment status text to consistently show **“On
(BYOD)”** for BYOD/personal cases.
* **Improvements**
* Enhanced ABM table sorting and responsive column visibility.
* Updated Apple Business Manager modal layout, wording, and success
messaging.
* Prevented renew-date tooltips from relying on missing configuration.
* **Tests**
* Updated MDM/BYOD status and fleet modal tests for the new labels and
BYOD handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46243
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed incorrect reporting of iOS, iPadOS, and Android hosts as missing
(including MIA and missing-over-30-days counts).
* Host status filtering and dashboard cards now correctly fall back to
Apple MDM activity when OSQuery “last seen” data is unavailable,
preventing recently active devices from being flagged.
* **Tests**
* Added coverage to verify iOS/iPadOS hosts aren’t treated as missing
when Apple MDM “last seen” is recent, and are flagged once it becomes
stale.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47677
Updating code so that it matches the docs (all label inclusions and
exclusions for policies should be premium-only):
- https://github.com/fleetdm/fleet/pull/47643
- https://github.com/fleetdm/fleet/pull/46353
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
* Global and team policy label scoping now consistently enforces premium
licensing for `labels_include_any` and `labels_exclude_any` (in addition
to existing `any/all` restrictions).
* Non-premium requests that include these label filter fields are
rejected earlier with the appropriate license error.
* GitOps policy export/validation now omits or disallows
`labels_include_any`/`labels_exclude_any` on non-premium instances.
## Tests
* Expanded coverage to verify premium gating behavior across global
policy create/modify and spec-based policy application, including GitOps
validation paths.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45600
I could see the contributor endpoint was not updated, so I just included
it in this PR, and since it's a contributor one I think we are fine
updating ahead of release.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. (Part of previous PR)
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added support for Apple Business Manager BYOD team assignments,
including saving/loading BYOD default team selections and exposing BYOD
team details via the API for personal mobile devices.
* **Refactor**
* Updated GitOps key handling for BYOD assignments to use `byod_fleet`,
with migration/aliasing from the older `byod_team` key.
* **Tests**
* Expanded GitOps and ABM token tests/fixtures to cover BYOD team
behavior, including defaults, clearing/reset behavior, and
error/validation scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Extracts the cron schedule registration out of `runServeCmd` and into a
new `cmd/fleet/cron_registration.go`. Same pattern as the prior
extractions on this issue (#44929, #45343, #45583, #46166, #46421,
#46517, #46742, #46830, #46893, #47151). This is the largest slice so
far — `runServeCmd` drops from ~1300 to ~1000 lines, and `serve.go` from
1776 to 1472.
The 33 `StartCronSchedule` registrations move into one
`startCronSchedules` entry point backed by a `cronSchedulesDeps` struct
(the dependencies the closures previously captured from `runServeCmd`).
Registration is grouped by domain:
- `registerCleanupAndMaintenanceCrons` — chart data collection, the
`cron_stats` cleanup goroutine, software migrations, frequent cleanups,
cleanups-then-aggregation, query results cleanup, upcoming activities,
usage statistics, batch activities.
- `registerVulnerabilityCrons` — the vulnerabilities schedule, or the
remote-trigger proxy when processing is disabled on this instance.
- `registerWorkerCrons` — automations and worker integrations.
- `registerMDMCrons` — Apple MDM worker, DEP profile assigner, service
discovery, the Apple/Windows/Android profile managers, the Android
device reconciler, the Android policy migrations, and the APNs pusher.
- `registerPremiumCrons` — iPhone/iPad refetcher and reviver, maintained
apps, VPP app version refresh (and the one-shot VPP country backfill),
recovery lock passwords, managed local account rotation, activities
streaming, and the calendar schedule.
- `registerMiscCrons` — host vitals label membership and the batch
activity completion checker.
Behavior is preserved — the schedules register in the same order with
the same arguments, the same conditionals gate them (premium, audit log,
env vars, software store presence), and the `config` is threaded as a
pointer so the `&config` and `config.Calendar` mutations inside the
calendar closure keep their original semantics. `cmd/fleet/cron.go` (the
schedule definitions) is intentionally untouched; only the wiring moved.
One unit test added: `TestVulnerabilityProcessingDisabled` covers the
vuln enable/disable predicate extracted into
`vulnerabilityProcessingDisabled`, including the legacy
`current_instance_checks` `"0"` value. The rest of the file is
dependency-wiring relocation with no further decision logic to unit-test
— those paths construct real schedules, so they stay covered by the
existing suite and integration tests. The full `cmd/fleet` suite passes
against MySQL + Redis, and a local server boot confirms the same 30 cron
schedules start as before (verified against the "started cron schedules"
log line).
**Related issue:** Refs #33370
# Checklist for submitter
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually (verified via local
server boot — same 30 cron schedules start)
- Changes file: not applicable — internal refactor with no user-visible
behavior change
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Centralized background cron schedule startup and standardized job
initialization sequencing for maintenance, vulnerability handling,
integrations, MDM workflows, and premium tasks.
* **New Features / Behavior**
* Added config- and license-controlled enablement for vulnerability
processing (local vs remote triggering), MDM automation (including APNs
delivery and device reconciliation), and premium-only refresh/recovery
behaviors.
* Made chart data collection and optional activity streaming
configurable, with safe fallbacks for scheduling periodicity.
* **Tests**
* Added coverage for vulnerability-schedule enable/disable decision
logic.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#44109
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Updated the Vulnerabilities column on the Software > OS page: "Not
supported" cells now include a tooltip relocated to the unsupported
indicator that explains which platforms support vulnerability detection,
and a "Learn more" link to Fleet documentation. Copy clarified to make
platform support and next steps more visible to users.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Introduce a query that lists local user accounts with a secure token,
which is necessary for FileVault access on macOS. This enhancement
provides visibility into user accounts that meet the criteria.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new inventory query for macOS users to identify those with
secure token protection enabled.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fix the Fleet-maintained apps list being cut off by adding server-side
pagination and applying platform / "hide added apps" filters across the
full library. Introduces MaintainedAppListOptions (with Platform and
AvailableOnly) and changes the ListAvailableFleetMaintainedApps /
ListFleetMaintainedApps signatures. Datastore now paginates and counts
by distinct app name, fetches all platform rows for apps on a page, and
returns a count and pagination metadata; default client page size set to
500. Frontend no longer performs client-side filtering or local
status/platform state; it relies on the API and uses data.count for
totals. Docs, tests, mocks, and various call sites updated (including a
new test that verifies pagination, platform and availability filters).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fleet-maintained apps listing now paginates server-side (100 per page)
so entries near the end of the alphabet are reachable.
* Platform and “Hide added apps” filters are applied across the entire
library, not just the currently loaded subset.
* The displayed count now matches results by counting macOS and Windows
versions separately.
* **New Features**
* Listing now supports URL-driven platform and “available” filtering,
and the UI consistently reflects the active filter state.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#40502
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed "select all matching hosts" to display the actual total count
instead of showing an estimate like "50+" in table headers and delete
confirmation dialogs.
* **Tests**
* Updated test cases to reflect accurate host count display behavior
when selecting all matching hosts.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46334?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Resolved an issue where team-scoped host vitals labels (from IdP
attributes) failed to populate associated hosts correctly.
* **Chores**
* Updated Fleet/Helm chart versions and container image/CLI package tags
from v4.86.1 to v4.86.2 across the deployment chart, values,
infrastructure defaults, and tooling manifest, with no other
configuration changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Updated the get-enriched helper to not use deleted locations returned
from Coresignal when including information about a company's
headquarters.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44272
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
Pages tested:
```
https://<fleet_url>/hosts/<host_id>/reports/<id>
https://<fleet_url>/reports/<id>?fleet_id=<fleet_id>
https://<fleet_url>/reports/<id>/live?fleet_id=<fleet_id>
https://<fleet_url>/policies/<id>/live?fleet_id=<fleet_id>
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed unnecessary horizontal scrollbars appearing in report and policy
results tables. Scrollbars now display only when content requires
horizontal scrolling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Windows Granola to version 7.324.2 with the latest installer
package and corresponding security verification checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Add Sonos to maintained apps across platforms. Introduces
SonosVersionTransformer (converts Homebrew "90.0-77070" -> "90.0.77070")
and registers it for the sonos/darwin slug so osquery version_compare
and patch detection work. Add special patched query in the Homebrew
ingester to compare bundle_version for Sonos. Add inputs for Homebrew
and Winget (including a Win32 install PowerShell script and Winget
manifest), outputs for darwin and windows with version metadata,
installer URLs, sha256s, and install/uninstall script refs; include the
actual install/uninstall script refs. Add a React SVG icon and map it in
the icons index, and update the Sonos app image asset and apps.json
entries. Also includes a couple punctuation cleanups in apps.json.
**Related issue:** Resolves#38928
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* After saving report edits, the UI now redirects users back to the
report details page.
* URL context (host_id and fleet_id) is preserved during this
navigation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves ##39323
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated checkbox labels and tooltips across settings to use positive
language (describing enabled outcomes like “Store data” and “Bypass for
non-critical policies”).
* Adjusted checkbox behavior to match the new checked-state semantics
for data retention, feature toggles, and conditional access bypass
(including revised default/tooltip copy).
* **Tests**
* Updated assertions to reflect the new checkbox/help text wording and
checked/unchecked expectations in advanced settings and discard-data
options.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Mike Thomas
