This article explains how to block and monitor EDR Freeze on macOS using
Santa 2026.3 and Fleet. It covers the functionality of EDR Freeze, the
implementation of AntiSuspendSigningIDs, and how to utilize Fleet's
Santa osquery tables for monitoring.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
**Related issue:** Resolves#42797
Adds support for pre-install query, post-install script, and uninstall
script on script-only packages (`.sh` and `.ps1`) across the API, UI,
and GitOps; previously these were silently stripped. The install script
remains the uploaded file's contents (file-driven) and is shown
read-only. Automatic install stays unsupported for script-only packages.
- **API** (`POST`/`PATCH /software/package`): stop stripping the fields;
validate post-install and uninstall scripts for script packages
- **GitOps**: allow
`uninstall_script`/`post_install_script`/`pre_install_query` paths
inline in the team YAML for script-only packages
- **UI**: show advanced options for `.sh`/`.ps1`; install script shown
read-only
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Script-only packages (`.sh`/`.ps1`) now expose advanced
options—pre-install query, post-install script, and uninstall
script—consistently across the UI, REST API, and GitOps.
* Script-only packages display advanced options in the UI, and the
“Install script” editor can be made read-only where appropriate.
* **Bug Fixes**
* Preserved advanced option values for script-only packages during
upload, edits, and synchronization (including replace-file scenarios).
* Improved YAML generation and validation so supported fields are
included while unsupported ones are correctly rejected/omitted.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
### 🥞 Stack (review/merge bottom-up)
1. #48164 — Activity types (FE+BE)
2. #48165 — Backend (cron + directory sync)
3. **#48166 — Usage statistics ⬅ this PR**
4. #48167 — fleetctl generate-gitops
5. #48168 — Settings UI
📄 Documentation is tracked separately in #48169 (targets
`docs-v4.89.0`).
---
## Summary
**PR 3 of 6.** **Usage statistics**: report whether a Google Workspace
IdP integration is configured via the new `googleWorkspaceConfigured`
field (`server/fleet/statistics.go`,
`server/datastore/mysql/statistics.go`).
> 🥞 **Stacked PR.** Base: `42915-gw-idp-vitals-2-backend` (PR 2).
**Related issue:** Resolves#42915
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Usage statistics now include whether Google Workspace is configured,
improving reporting accuracy.
* **Bug Fixes**
* Fixed statistics submissions so the Google Workspace configuration
status is included consistently in outgoing requests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
### 🥞 Stack (review/merge bottom-up)
1. #48164 — Activity types (FE+BE)
2. **#48165 — Backend (cron + directory sync) ⬅ this PR**
3. #48166 — Usage statistics
4. #48167 — fleetctl generate-gitops
5. #48168 — Settings UI
📄 Documentation is tracked separately in #48169 (targets
`docs-v4.89.0`).
---
## Summary
**PR 2 of 6.** Core **backend** for the Google Workspace IdP
integration:
- Directory sync client (`ee/server/googleworkspace/`) and cron job
(`server/cron/google_workspace_cron.go`) reusing the `scim_*` tables
(Google Workspace and SCIM are mutually exclusive).
- Config types + validation (`server/fleet/google_workspace.go`,
`app.go`, `integrations.go`), appconfig handling + activity emission
(`server/service/appconfig.go`), cron registration and schedule.
- SCIM is ignored while Google Workspace is configured
(`ee/server/scim/scim.go`).
> 🥞 **Stacked PR.** Base: `42915-gw-idp-vitals-1-activities` (PR 1) —
review/merge that first.
**Related issue:** Resolves#42915
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Google Workspace integration support for syncing users, groups,
and host-related identity data.
* Added a scheduled sync that keeps directory data up to date
automatically.
* Added support for configuring Google Workspace in app settings, with
validation and masking of sensitive credentials.
* **Bug Fixes**
* Prevented SCIM provisioning from overwriting data when Google
Workspace sync is configured.
* Preserved existing Google Workspace credentials when an update omits
masked API key values.
* Added handling for deleted users and group membership changes during
sync.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Document the scenarios for load testing Windows MDM at scale.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44188
**Related issue:** N/A (security hardening)
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Summary
Added network-level validation for outbound HTTP requests made by Fleet
integrations (webhooks, SSO, Jira, Zendesk, certificate authorities,
etc.) to prevent requests to unintended destinations. Includes a
configuration option for environments that require connectivity to
private network addresses.
Also fixes a pre-existing nil pointer panic in Jira retry logic and
ensures all HTTP clients use the validated transport.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Unit and integration tests cover validation logic, boundary conditions,
and multiple configuration modes.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
### 🥞 Stack (review/merge bottom-up)
1. **#48164 — Activity types (FE+BE) ⬅ this PR**
2. #48165 — Backend (cron + directory sync)
3. #48166 — Usage statistics
4. #48167 — fleetctl generate-gitops
5. #48168 — Settings UI
📄 Documentation is tracked separately in #48169 (targets
`docs-v4.89.0`).
---
## Summary
**PR 1 of 6** — splits the Google Workspace IdP host-vitals feature into
a reviewable stack.
Adds the **activity types** for the Google Workspace integration,
frontend and backend:
- Backend: `added_google_workspace_integration`,
`edited_google_workspace_integration`,
`deleted_google_workspace_integration` (`server/fleet/activities.go`).
- Frontend: activity-feed rendering for those three types (`activity.ts`
enum + display names + `domain` detail; `GlobalActivityItem.tsx`
templates).
> 🥞 **Stacked PR.** Base: `main`.
**Related issue:** Resolves#42915
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for new Google Workspace integration activity entries:
added, edited, and deleted.
* Activity feeds now display the integration domain when available.
* New filter labels were added for these activity types.
* **Bug Fixes**
* Activity details now render Google Workspace integration events
correctly in the dashboard feed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
I have a Fleet-provided external HDD that I use to permanently store VMs
and OS installers for testing.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Expanded the list of Mac hosts allowed for external storage access
under the relevant label, enabling read-write use on an additional
machine.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Fixes#46643
BaseClient.URL() built request paths as `URLPrefix + path`, overwriting
any path already present in BaseURL. Orbit and Fleet Desktop parse the
full fleet URL (subpath included) into BaseURL and pass an empty
URLPrefix, so the subpath was discarded and every API call 404'd when
Fleet was deployed at https://host/subpath. Preserve BaseURL.Path as a
prefix on each request. fleetctl is unaffected since it carries the
subpath in URLPrefix with an empty BaseURL.Path, and non-subpath
deployments are unchanged.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed API request URL construction for deployments hosted under a
subpath, preventing broken requests and 404 errors.
* Preserved query parameters when generating request URLs.
* Improved resolution of request paths with and without a leading slash
when combined with a base URL subpath.
* **Documentation**
* Added clearer guidance on how base URL subpaths and additional path
prefixes are combined.
* **Tests**
* Expanded URL-generation coverage to verify correct behavior across
subpath and prefix combinations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the Reqable Windows package entry to version 3.2.0.
* Switched the download reference to the latest 3.2.0 release artifact.
* Refreshed the package checksum to match the new release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47947
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed GitOps generation for script-only packages added by path so it
no longer creates invalid output files.
* Script package entries now use cleaner comments, while regular
packages still show version details.
* Placeholder `script://` installer URLs are now cleared properly and
won’t remain stored after processing.
* **Tests**
* Added coverage for script package comment formatting and for clearing
placeholder installer URLs during GitOps workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#42441
Store queries that target at most
redis.live_query_small_target_threshold hosts (default 1000) in a
per-host reverse index instead instead of a per-query bitfield indexed
by host ID.
Setting the threshold to 0 disables the reverse index (no query has <= 0
targets), serving as the kill-switch.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A — internal release-QA issue template update
## Description
Updates the **Release QA** issue template
(`.github/ISSUE_TEMPLATE/release-qa.md`) to match the format already
used by the **Release QA - fleetd** template:
- Adds a **"How to check off"** note explaining that testers tick the
per-section **Progress** checkboxes (so GitHub shows the "X of Y tasks"
tracker), and record failures under **Notes**.
- Adds a **Progress** checkbox list before each section table
(Orchestration, MDM, Power to PC, Software, Security & Compliance, All
product groups).
- Drops the **pass/fail** column from every table (now 3 columns: Test
name / Step instructions / Expected result) and removes the `$Name`
placeholder example row.
- Splits the single **Load tests** entry into **Baseline loadtest** and
**Migration loadtest** rows (and matching checkboxes), and reworks both
around the `tools/loadtest/metrics/` tooling (see below).
No code or product behavior changes — issue template only.
## New load test flow
Both load tests now use the `tools/loadtest/metrics/` scripts —
[`collect-metrics.sh`](https://github.com/fleetdm/fleet/blob/main/tools/loadtest/metrics/collect-metrics.sh)
(pulls CloudWatch metrics into a `.json` data file + `.md` synopsis) and
[`compare-metrics.sh`](https://github.com/fleetdm/fleet/blob/main/tools/loadtest/metrics/compare-metrics.sh)
(diffs two runs and flags deltas `ok` / `WARN` / `ALERT`). Condition of
satisfaction for each: collect → compare → post the comparison as an
issue comment → open a PR with the run artifacts and record results in
the metrics spreadsheet.
**Baseline loadtest** (compared against the previous release, n-1):
1. Stand up a fresh RC environment (new instance, no data) and run it
~24h.
2. Collect metrics under the `baseline` category.
3. Compare against the previous release (n-1); post the comparison as an
issue comment — deltas should be `ok`.
4. Open a PR with the run artifacts (`.json` + `.md`) under
`runs/baseline/<workspace>/` and record metrics in the spreadsheet.
**Migration loadtest** (compared before vs. after the migration):
1. Run a load test on the previous minor release (n-1); right before
migrating, collect the last 2h.
2. Migrate the environment to the RC (n).
3. Wait ~2h, then collect the past 2h (symmetric window for an
apples-to-apples diff).
4. Compare post-migration vs. pre-migration; post the comparison as an
issue comment — deltas should be `ok`.
5. Open a PR with the run artifacts under `runs/migration/<workspace>/`
and record metrics in the spreadsheet.
Example result PRs this flow produces: fleetdm/fleet#47794 (baseline),
fleetdm/fleet#47803 (migration).
# Checklist for submitter
- [ ] QA'd all new/changed functionality manually
**Related issue:** Resolves#48368
# Before / After
- Before: "Old tooltip for Windows/Linux"
<img width="591" height="278" alt="image"
src="https://github.com/user-attachments/assets/c413c8a0-4c3b-489c-a046-c65d03452c44"
/>
- After: "Updated tooltip for Windows/Linux"
<img width="629" height="283" alt="image"
src="https://github.com/user-attachments/assets/b9e99430-5d63-470d-801e-2d4c060c112d"
/>
- for Mac and Apple-related OS stays unchanged.
<img width="583" height="273" alt="Screenshot 2026-06-28 at 5 52 50 PM"
src="https://github.com/user-attachments/assets/cac7990d-6212-4b69-9467-73d6a3f7d733"
/>
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the “installed during setup” tooltip to clarify installation
order rules.
* The tooltip now specifies ordering by software name (0–9, then A–Z).
* Added clearer policy sequencing: software without an install policy is
installed before software with a policy.
* Android setup messaging remains unchanged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a queryable `socket_path` field for containerd-related data,
with a safe default for existing setups.
* Improved resilience by automatically recovering when a startup binary
is found to be corrupt.
* **Bug Fixes**
* macOS detail queries now handle app bundles with missing executables
more gracefully.
* Reduced issues caused by repeated startup failures and improved
overall stability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Bumped several maintained app entries to newer releases, including
Cursor for macOS and Windows, Proxyman for macOS, and Stats for macOS.
* Refreshed associated download links and checksums so installs and
update checks point to the latest available versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Refreshed maintained app entries for several Windows and macOS apps to
their latest releases.
* Updated version checks, download links, and checksums so installs and
update detection reflect the newer builds.
* Included version bumps for Comet, Marked, Notepad, Only Switch, and
Spokenly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated macOS installer metadata for Antigravity, ChatGPT Desktop,
DevKnife, jamovi, Marked, Netron, OpenAudible, and Workflowy to newer
versions.
* Refreshed download links and checksums so installs and updates use the
latest available release files.
* Improved ChatGPT Desktop cleanup behavior during removal for a more
complete uninstall.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated installer metadata for multiple maintained apps on macOS and
Windows, including Claude, Clop, Codex, LookAway, Ocenaudio, Ollama,
Shotcut, Spyder, Teleport Connect, Teleport Suite, and Zen Browser.
* Added newer release versions for several apps, so package listings now
reflect the latest available downloads.
* **Bug Fixes**
* Refreshed download links and checksum values to match the updated
installer packages.
* Improved version checks so installed apps are compared against the
correct current release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Add targeted styling for `p a[purpose='cta-button']` in basic article
pages so markdown-authored CTA links render as branded Fleet buttons. It
reuses the existing `.cta-button()` mixin while overriding layout
details (inline-flex, fit-content width, padding, spacing, and hover
text decoration) so the button sizes to its label and fits article flow.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Improved the appearance of inline “Green Fleet” call-to-action links
in article content.
* Buttons now display inline, size more naturally with the text, and
have updated spacing for better readability.
* Hover behavior has been kept clean by preventing unwanted text
decoration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated maintained app definitions so installs and update checks
recognize the latest releases for Arc, Brave, Claude, Dockside, eM
Client, Fantastical, Figma, Funter, Gather, Microsoft Edge, Ocenaudio,
Ollama, P4V, Quip, R for Windows, Tuple, and Warp.
* Refreshed download links and package checksums to match the newest
installers, improving update reliability across macOS and Windows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Related to https://github.com/fleetdm/fleet/issues/48114
Related to https://github.com/fleetdm/fleet/issues/47386
Changes:
- Added a new exit to seven Android proxy endpoints `managementApiError`
that is used when the Android management API responds with a transient
5xx error (502, 503, and 504).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved handling of temporary Android Management API failures by
returning a dedicated, retry-friendly error outcome for transient 5xx
responses (502/503/504).
* Updated enrollment, web app creation, device deletion/modification,
command issuance, policy changes, and enterprise app policy updates to
surface clearer, more specific failure messages instead of generic
errors.
* Makes it easier to identify issues that may resolve on retry.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated installer metadata for Brave Browser on macOS, Granola on
Windows, Linear on Windows, and Remote Desktop Manager on Windows.
* Refreshed version checks, download links, and package checksums so the
latest releases are detected and installed correctly.
* Kept existing install/uninstall behavior unchanged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44188
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Windows MDM check-in response payloads are now stored gzip-compressed
in the database to reduce write pressure for large SyncML data.
* When fetching results, responses are automatically decompressed so the
original content is returned to clients.
* Empty payloads are preserved, and stored data is validated to ensure
only valid gzip content is accepted.
* **Database / Migration**
* Added a migration and backfill to move existing records from
uncompressed storage to the new compressed column format.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45931
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved device lock handling so only active pending lock commands are
treated as valid.
* Fixed stale lock state cases where an old lock reference no longer
blocks a new lock request.
* When a prior lock command is no longer deliverable, a new lock command
is now issued and tracked correctly.
* Updated coverage to verify lock status transitions and replacement
behavior in these edge cases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45947
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
We do not know how to repro the customer issue and I spent about 6 hours
across a couple of days throwing everything I could at it so testing was
limited to macos profile verification smoke testing and unit tests to
confirm the time we see from customer logs and queries is now supported
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue where macOS configuration profiles could get stuck in
“Verifying” when the reported install date uses a 12-hour time format.
* Improved parsing of locale-formatted install dates, including handling
of special spacing characters found on newer macOS versions.
* Enhanced validation so unsupported or empty install date formats
return clearer error messages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#38504
**Constituent PRs (merged into this feature branch):**
- #47682 — Fleet UI: APRF Software title details page Library/Inventory
layout
- #47808 — Extend update software installer API to support FMA version
pinning
- #47944 — Fleet UI: APRF library item accordion component
- #48081 — Versions modal, multi-row Library, pinned state
- #48098 — Add `pinned_version` to `edited_software` activity
- #48123 — Auto-update FMA cron
- #48144 — Download a newly-published FMA version when pinned to it
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or
`ee/fleetd-chrome/changes`. See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates
to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Fleet-maintained app version pinning (Latest, exact, and major)
via a new Versions modal.
* Introduced premium auto-updates for maintained apps with pin-aware
promotion and rollback-safe caching.
* Added expandable library version rows and a Policies modal.
* **Bug Fixes**
* Improved pin handling, cache/manifest hydration, and safer update
behavior on per-app failures and deduplication.
* **UI/UX**
* Refreshed the Software title details experience with new
accordion/list patterns, redesigned details widget/tooltips, and updated
installer presentation.
* **Documentation**
* Expanded Storybook component/page coverage and adjusted Storybook
canvas padding.
* **Tests**
* Added/updated unit and integration tests for pinning, auto-update
flows, and new modal/UI behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated macOS installer details for Vimcal to the latest available
release, including version info, download link, and checksum.
* Adjusted WhatsApp’s patched eligibility check to recognize the newer
app version.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Refreshed macOS package metadata for Linear, Memory Cleaner, and
NetNewsWire to their latest available versions.
* Updated installer links and checksum values so the correct app builds
are delivered.
* Adjusted version checks to match the newer releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#48301
When the auto-update cron downloads a new Fleet-maintained app version,
it now carries forward the previously-active install/uninstall scripts
when they were customized (e.g. via GitOps), instead of overwriting them
with the manifest defaults. Customization is detected per-script by
comparing the active scripts against the manifest (the uninstall script
is compared against the manifest template substituted with the active
version's package IDs, since it's version-specific). When the active
scripts match the manifest, the new version's manifest scripts are used
as before.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Changes:
- Updated the position of the homepage hero background to prevent issues
with text flowing outside of the clouds in the image on large screens
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Adjusted the homepage hero background alignment on desktop for a
better visual layout.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|@rm!n3