<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42721
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated iOS/iPadOS enrollment labeling to clarify the fully managed
company-owned option.
* Added enrollment guidance explaining that users must download the
profile in their browser and install it to enroll in Fleet.
* **Tests**
* Expanded coverage to verify the updated enrollment option and
instructions on iOS/iPadOS and Android.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#38806
Add an IT-admin naming convention for macOS/iOS/iPadOS hosts. An admin
sets a name template (e.g. "iPad $FLEET_VAR_HOST_HARDWARE_SERIAL") under
Controls > OS settings > Host names for a fleet or for "No team"; Fleet
resolves it per host, delivers it via an Apple `Settings`/`DeviceName`
MDM command, renames its own record on ACK, then verifies the name via
osquery (macOS) or a DeviceInformation refetch (iOS/iPadOS). Clearing
the template stops enforcement without renaming any host. Fleet Premium
only, mirroring disk encryption.
**Related issue:** Closes#48943
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Summary
Adds unit test coverage for external library upgrades that had no
automated tests:
- **DOMPurify** (`ClickableUrls_xss.tests.tsx`): 5 XSS sanitization
tests (script injection, javascript: in href, event handlers, iframe,
URL preservation)
- **react-markdown + remark-gfm** (`FleetMarkdown.tests.tsx`): 9
rendering tests (plain text, bold/italic, links, lists, GFM tables,
strikethrough, code blocks, inline code)
- **sonner** (`ToastNotification.tests.tsx`): 9 notify API tests
(success/error creation, empty-message fallback, custom id, dismiss,
batch, HTTP status label, axios response unwrap)
These gaps were identified through a comprehensive audit of all ~353
direct dependencies across Go and frontend. The Go backend has excellent
coverage (669+ test files). The frontend now has 333+ test files
covering all runtime libraries except 2 that are untestable at unit
level (systray GUI, sockjs WebSocket).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added coverage confirming potentially unsafe HTML and links are
sanitized before rendering, including protection against script,
`javascript:` URLs, and injected content.
* Added tests validating Markdown rendering for plain text, links,
fenced code blocks, and inline code.
* Added coverage for toast notifications, including success/error flows,
batching, dismissal, fallback messaging, ID handling, and mapping
response details.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35328
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved link hover and `:focus-visible` underline/outline behavior
for more consistent accessibility across tables, buttons, and modals.
* Fixed script name hover underline clipping in the run script modal.
* **Style**
* Refreshed `CustomLink` styling with an emphasized variant and improved
underline behavior, plus updated related link/table/button styling for a
unified look.
* Updated “Connect Fleet” info-banner messaging and CTAs for calendar
and conditional access automations; refreshed “No scripts available”
empty state.
* **Tests**
* Updated modal tests to match revised link text and accessible names.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#46959
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Apple account provisioning configuration UI in integrations
settings with token URL, client ID, and client secret fields.
* Added activity tracking for Apple account provisioning changes.
* **Documentation**
* Renamed integration settings labels for clarity: "Ticketing",
"Calendar events", "Certificate enrollment", "User mapping",
"Authentication (SSO)", and "Host status alerts".
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48571
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
No changes file as this is a subtask
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a Premium-only **Assets** tab to Configuration Profiles, with
JSON asset list, upload, download, copy, and delete (delete limited for
technician views).
* Added a Premium-only **Assets** entry to the command palette
configuration controls.
* Introduced a new **file-json** graphic type and enhanced user-scoped
profile indicators (with iOS/iPad-specific behavior).
* **Bug Fixes**
* Updated navigation so the **Assets** view opens consistently from
settings and the command palette.
* Improved visual alignment of tooltip/icon elements in asset and scope
displays.
* **Tests**
* Added coverage for Assets, upload/download/delete behaviors, and
related UI components.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47943
It no longer calls `ab_tokens` and `vpp_tokens` on fleet free
<img width="1317" height="561" alt="image"
src="https://github.com/user-attachments/assets/6556f91e-a7e4-487c-9961-3a22104329d3"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue where Fleet Free accounts could trigger premium MDM
calls.
* Restricted premium token retrieval to eligible premium-tier accounts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#43379
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated Windows MDM enrollment option labels from “Automatic/Manual”
to “Fleet agent-driven/End user-driven” and refreshed the related
on-page description/help text.
* Adjusted radio help-text spacing and added styling for label
formatting on the Windows MDM settings page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46965
Relative "time ago" timestamps switched to months at ~30 days, so a
timestamp 45 days ago read "about 2 months ago" (even 89 days showed "3
months ago"). This centralizes the day/month cutoff in a new `timeAgo`
helper and routes existing call sites through it, so anything under 90
days is shown in days.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Relative “time ago” timestamps now keep values in **days** for items
under **90 days**, switching to **months** later for more accurate
wording.
* Improved consistency of relative time labels across status modals,
activity feeds, host details, and management screens (including “last
updated,” “uploaded,” and “added” text).
* **Tests**
* Added/updated coverage for the shared relative-time cutoff and
formatting behavior to prevent regressions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#48641
## Description
Deleting the only policy on a paginated page (e.g., 21 policies, with 1
on page 2) left the user stranded on a now-empty page showing the "No
policies" empty state. The policies list now steps back to the previous
page when a delete empties the current page.
**Before:** delete last policy on page 2 → empty state.
**After:** delete last policy on page 2 → list returns to page 1.
### Screen recording demonstrating the fix
https://github.com/user-attachments/assets/ae106a50-7f9b-4080-a19c-53e0c60fff48
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Server-side paginated tables now recover from empty states after
deleting the last row on a page by redirecting to the last page that
still has data.
* Improved empty-state pagination handling for out-of-range pages,
loading states, and cases where the total row count is known (including
zero), avoiding unnecessary or repeated navigation.
* Simplified the empty-state pagination UI to render only the empty
component.
* **Tests**
* Expanded regression test coverage for server-side pagination edge
cases and page-correction behavior to prevent future regressions.
* **Style**
* Removed unused empty/previous-button styling rules in the table
container.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#38874
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added macOS enrollment details in the “Add hosts” flow, including a
clearer choice between **Personal (BYOD)** and **Company-owned**
devices.
* Shows a copyable macOS enrollment URL when MDM is configured, updating
the URL based on the selected device type.
* Keeps the macOS setup experience aligned with the enrollment method,
including packaging guidance when MDM isn’t enabled.
* **Tests**
* Added coverage for macOS enrollment URL rendering and device-type
switching in the “Add hosts” modal.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#48528
This keys the count, pagination, and the frontend row-combining on the
app's slug token (the prefix before `/`, shared across an app's platform
entries but distinct across apps). The count now equals the rows shown
in every view (macOS, Windows, All), and name-colliding apps stay as
separate rows.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Software listings now group platform-specific installers into a single
app row based on the app identifier, improving how macOS and Windows
entries appear together.
* **Bug Fixes**
* Apps with the same display name but different identifiers now stay
separate instead of being merged incorrectly.
* List counts and pagination now match the combined app view more
accurately across the software pages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#25574
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
---
## Summary
- Adds a new `splunk` log plugin that sends osquery logs directly to
Splunk's HTTP Event Collector (HEC) endpoint
- Eliminates the need for middleware like AWS Firehose when using Splunk
as a log destination
- Follows the same pattern as existing log destinations (Firehose, Kafka
REST, NATS, etc.)
- Includes `insecure_skip_verify` option for environments with
self-signed TLS certs
## UI changes
Follows the same pattern as the NATS log destination PR (#36527) --
adding "Splunk" to the display name, tooltip, and TypeScript type union.
No new components, pages, or styles.
### Manage automations modal -- "Log destination: Splunk"
<img width="822" height="527" alt="image"
src="https://github.com/user-attachments/assets/2533207f-fa95-4364-8ee0-3c39cd3e8e4d"
/>
### Query details page -- "Log destination: Splunk"
<img width="1905" height="662" alt="image"
src="https://github.com/user-attachments/assets/069a5005-f95c-4562-a819-fd8bdcc349f7"
/>
### Tooltip on hover
<img width="639" height="348" alt="image"
src="https://github.com/user-attachments/assets/809a47a6-b82a-4f45-b731-77b2d2c87947"
/>
### Edit query form -- "sent to your log destination: Splunk"
<img width="451" height="814" alt="image"
src="https://github.com/user-attachments/assets/b78b9a57-1f0c-4413-8b7c-654de1fd40a2"
/>
### Save new query modal -- "sent to your log destination: Splunk"
<img width="536" height="698" alt="image"
src="https://github.com/user-attachments/assets/d0a0ab01-66fe-4d63-9190-9c5e840e456d"
/>
---
### How it works
The Splunk writer (`server/logging/splunk.go`) implements the
`fleet.JSONLogger` interface. On startup it performs a health check
against the HEC `/services/collector/health` endpoint. On each `Write()`
call, it wraps each log entry in Splunk's HEC event format (adding
`time`, `index`, `source`, `sourcetype`), batches them up to 1 MB, and
POSTs to `/services/collector/event` with the `Authorization: Splunk
<token>` header. If a batch exceeds 1 MB it flushes and starts a new
one. Events over 1 MB are dropped with a log warning. Transient errors
(HTTP 503) are retried with exponential backoff (up to 8 retries).
### Configuration
```yaml
osquery:
status_log_plugin: splunk
result_log_plugin: splunk
splunk:
url: https://splunk.example.com:8088
token: <HEC token>
index: main
source: fleet
source_type: fleet:json
insecure_skip_verify: false # set true for self-signed certs
```
Or via environment variables:
```
FLEET_OSQUERY_STATUS_LOG_PLUGIN=splunk
FLEET_OSQUERY_RESULT_LOG_PLUGIN=splunk
FLEET_SPLUNK_URL=https://splunk.example.com:8088
FLEET_SPLUNK_TOKEN=<HEC token>
FLEET_SPLUNK_INDEX=main
FLEET_SPLUNK_SOURCE=fleet
FLEET_SPLUNK_SOURCE_TYPE=fleet:json
```
### Files changed
- `server/logging/splunk.go` -- Splunk HEC log writer with batching,
retry, and health check
- `server/logging/splunk_test.go` -- 9 unit tests
- `server/logging/splunk_integration_test.go` -- 3 integration tests
against real Splunk (gated by env var)
- `server/logging/logging.go` -- Added `SplunkConfig` and `case
"splunk"` to factory
- `server/config/config.go` -- Added `SplunkConfig` struct and config
flags
- `cmd/fleet/logging.go` -- Wired Splunk config into logging builder
- `server/fleet/app.go` -- Added `SplunkConfig` type for API responses
(excludes token)
- `server/service/service_appconfig.go` -- Added `case "splunk"` to
logging plugin validation
- `frontend/interfaces/config.ts` -- Added `"splunk"` to LogDestination
type
-
`frontend/components/LogDestinationIndicator/LogDestinationIndicator.tsx`
-- Added Splunk display name and tooltip
- `docs/Configuration/fleet-server-configuration.md` -- Splunk config
documentation
- `docs/Get started/FAQ.md` -- Updated plugin list
- `articles/log-destinations.md` -- Updated Splunk section with native
HEC docs
- `changes/25574-splunk-log-destination` -- Change file
## Test plan
### Unit tests (9 tests)
- [x] `TestSplunkWrite` -- sends 3 events, verifies HEC format, auth
header, index/source/sourcetype
- [x] `TestSplunkWriteEmpty` -- empty logs don't trigger HTTP request
- [x] `TestSplunkServerError` -- HEC 403 propagates as error
- [x] `TestSplunkHealthCheckFailure` -- constructor fails on bad health
- [x] `TestSplunkRecordTooBig` -- oversized events (>1MB) are dropped,
normal events still sent
- [x] `TestSplunkSplitBatchBySize` -- logs exceeding 1MB batch limit are
split into multiple requests
- [x] `TestSplunkRetryOnServiceUnavailable` -- 503 retried with backoff,
succeeds on 3rd attempt
- [x] `TestSplunkRetryExhausted` -- after 9 attempts (1 + 8 retries)
returns error
- [x] `TestSplunkMissingConfig` -- empty URL/token returns descriptive
error
### Integration tests (3 tests, gated by `SPLUNK_INTEGRATION_TEST=1`)
- [x] `TestSplunkIntegration` -- 3 events sent via writer, queried back
from Splunk REST API
- [x] `TestSplunkIntegrationBatch` -- 100 events in one Write(), all
confirmed indexed
- [x] `TestSplunkIntegrationBadToken` -- bad token Write() returns 403
### End-to-end test (macOS ARM64, real osquery agent)
1. Started Splunk Enterprise, MySQL, Redis via Docker
2. Built Fleet server from this branch with
`--osquery_status_log_plugin=splunk`
3. Set up Fleet, enrolled a real osquery 5.23.0 agent on this MacBook
4. **83 real osquery status log events indexed in Splunk** with correct
source/sourcetype/index
5. Each event contained full osquery data (`hostIdentifier`,
`host_uuid`, `calendarTime`, `severity`, `message`, `decorations`)
### Splunk showing real osquery events from Fleet
<img width="1910" height="861" alt="image"
src="https://github.com/user-attachments/assets/192490bf-d594-4424-a3e3-a18306892873"
/>
Generated with [Claude Code](https://claude.ai/code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added native Splunk HEC logging destination for status, result, and
audit logs.
* Updated the log destination UI to display **Splunk** with a dedicated
tooltip.
* Added Splunk HEC configuration (URL/token/index/source/source type)
including TLS verification control.
* **Bug Fixes**
* Improved log delivery with batching, retries for temporary HTTP
failures, and safeguards for oversized events.
* **Tests**
* Added unit tests and optional integration tests covering routing,
batching, retries, and error scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
**Related issue:** Resolves#48177
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Standardized action wording across the UI from “Create” to “Add” for
fleets, packs, users, and reports.
* Updated related labels in command palette items, empty states,
buttons, links, and modal titles to match the new terminology.
* **Tests**
* Updated UI tests to assert the revised button and link text in
affected fleet, host, and report flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42473
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
With image URL set:
<img width="598" height="476" alt="Screenshot 2026-06-29 at 1 48 45 PM"
src="https://github.com/user-attachments/assets/9e10c92d-57ce-448e-94c8-01cf852550a9"
/>
Without image:
<img width="598" height="507" alt="Screenshot 2026-06-29 at 1 49 13 PM"
src="https://github.com/user-attachments/assets/782324e9-ffd3-459f-85ea-6bece16b8ce5"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Prevented SSO sign-in button text from overflowing by standardizing
the visible label to **“Sign in with SSO”**.
* Show the configured identity provider name in a **hover tooltip**,
instead of altering the button label.
* Improved SSO button/tooltip layout and spacing, including refined icon
spacing and better button sizing within the tooltip.
* **Tests**
* Updated LoginForm focus assertions to match the revised SSO button
labeling and accessibility name.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#38504
**Constituent PRs (merged into this feature branch):**
- #47682 — Fleet UI: APRF Software title details page Library/Inventory
layout
- #47808 — Extend update software installer API to support FMA version
pinning
- #47944 — Fleet UI: APRF library item accordion component
- #48081 — Versions modal, multi-row Library, pinned state
- #48098 — Add `pinned_version` to `edited_software` activity
- #48123 — Auto-update FMA cron
- #48144 — Download a newly-published FMA version when pinned to it
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or
`ee/fleetd-chrome/changes`. See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates
to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Fleet-maintained app version pinning (Latest, exact, and major)
via a new Versions modal.
* Introduced premium auto-updates for maintained apps with pin-aware
promotion and rollback-safe caching.
* Added expandable library version rows and a Policies modal.
* **Bug Fixes**
* Improved pin handling, cache/manifest hydration, and safer update
behavior on per-app failures and deduplication.
* **UI/UX**
* Refreshed the Software title details experience with new
accordion/list patterns, redesigned details widget/tooltips, and updated
installer presentation.
* **Documentation**
* Expanded Storybook component/page coverage and adjusted Storybook
canvas padding.
* **Tests**
* Added/updated unit and integration tests for pinning, auto-update
flows, and new modal/UI behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44325 (follow-up to #47861 and #48009)
## Summary
Follow-up to #47861 and #48009 (both merged) for #44325. Those left
several GitOps-mode "Manage in YAML" tooltips still misaligned. This
makes the wrapper hug its content so the tooltip centers on the disabled
control instead of drifting to the full form width.
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<img width="1280" height="860" alt="1_bootstrap_advanced"
src="https://github.com/user-attachments/assets/403cabb4-3d24-4ece-91f5-4887efd0da05"
/>
<img width="1280" height="860" alt="2_install_software"
src="https://github.com/user-attachments/assets/2f9b2130-0fd6-4744-9603-1a31aebd773e"
/>
<img width="1280" height="860" alt="3_fleet_action_rename"
src="https://github.com/user-attachments/assets/180f3e8d-1dee-404c-b13d-14124bc3509b"
/>
<img width="1280" height="860" alt="4_fleet_action_enroll"
src="https://github.com/user-attachments/assets/9378b6fb-5b1e-45e0-80e5-61d4996b49e0"
/>
<img width="1280" height="860" alt="5_fleet_checkbox"
src="https://github.com/user-attachments/assets/dcec8992-5407-452a-8b4c-5d4e8dc27d10"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved tooltip positioning and width behavior in setup forms so
tooltips align more consistently with the visible control.
* Input and dropdown fields now keep their full-width behavior, while
other controls are centered more naturally.
* Updated the macOS and Windows software requirement options to show
tooltips beside the control for better readability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45641
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. In other subtask.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added support for tracking and displaying “ran custom MDM command”
activities across dashboard and host activity feeds.
* Added custom MDM command detail modals with status-aware messaging,
actor attribution, target host, and relative “time ago” updates.
* Improved command name rendering by shortening long request types for
cleaner display.
* **Bug Fixes**
* Enhanced command status handling for additional Apple and Windows
status formats so icons and verbs display correctly.
* **Tests**
* Added coverage for custom MDM command rendering and command-status
helper behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Redesigned in-app notifications with a new toast-based UI style.
* Error messages are now dismissible and expandable to reveal detailed
server response information.
* Success and error notifications now appear consistently across the
application with improved visibility.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
This is a follow-up to #47861, the previous PR for #44325.
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Improved GitOps mode tooltip arrow positioning by adapting the default
offset based on whether it’s associated with a single form field row.
* **Style**
* Refined the tooltip wrapper layout so non-form-field content “hugs”
its contents instead of stretching to full form width, improving
alignment and centering.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<img width="1728" height="1045" alt="Screenshot 2026-06-22 at 10 46 46"
src="https://github.com/user-attachments/assets/53f96b70-59ec-422c-8750-324aea21b184"
/>
**Related issue:** Resolves#44325
## Summary
In GitOps mode, disabled settings fields show a "Manage in YAML (GitOps
mode)" tooltip via `GitOpsModeTooltipWrapper`. The wrapper passed the
entire field (label + input + help text) to the shared `TooltipWrapper`,
so react-tooltip anchored to the whole field's bounding box. For
`position="left"`/`"right"` fields this centered the tooltip vertically
across the field, landing the arrow between the input and the help text
instead of at the label.
This change anchors the tooltip to the field's label/control row (via
react-tooltip-5 `anchorSelect` scoped to a unique wrapper id), so the
arrow points at the label regardless of input, help-text, or
tooltip-content length. The change is contained to
`GitOpsModeTooltipWrapper`, leaving `TooltipWrapper` untouched.
Non-field usages (buttons, icon rows) fall back to the previous
whole-element anchoring.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Verified manually with Playwright against a live instance in GitOps
mode: the tooltip arrow points at the checkbox/control row (incl. fields
with help text) and at the label for `isInputField` inputs; button
usages are unchanged.
<img width="1726" height="1041" alt="Screenshot 2026-06-18 at 15 31 08"
src="https://github.com/user-attachments/assets/58229743-58d4-4b26-b69d-c78ca2e6b3b1"
/>
<img width="1721" height="1040" alt="Screenshot 2026-06-18 at 15 30 58"
src="https://github.com/user-attachments/assets/253db973-2a57-4f62-9d6f-2d18f0c2a7ca"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected GitOps mode tooltip positioning for disabled settings
fields. Tooltips now properly target field labels instead of the
combined label/input/help element area, improving visual alignment and
clarity.
* **Tests**
* Enhanced test coverage for GitOps mode tooltip anchoring with tests
for single form fields and grouped field controls to ensure correct
positioning behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45601
Responsiveness:
https://github.com/user-attachments/assets/d7ea6297-8677-4093-b343-b76c64121f53
Removed border from Action header:
<img width="1450" height="134" alt="image"
src="https://github.com/user-attachments/assets/1dad670c-9f11-4911-862f-2d77a2e5c1cf"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. In another PR
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added client-side search by organization name in the Apple Business
Manager table.
* Enabled **BYOD fleet** selection in Apple Business Manager fleet
editing and saving.
* **Bug Fixes**
* Standardized enrollment status text to consistently show **“On
(BYOD)”** for BYOD/personal cases.
* **Improvements**
* Enhanced ABM table sorting and responsive column visibility.
* Updated Apple Business Manager modal layout, wording, and success
messaging.
* Prevented renew-date tooltips from relying on missing configuration.
* **Tests**
* Updated MDM/BYOD status and fleet modal tests for the new labels and
BYOD handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#40502
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed "select all matching hosts" to display the actual total count
instead of showing an estimate like "50+" in table headers and delete
confirmation dialogs.
* **Tests**
* Updated test cases to reflect accurate host count display behavior
when selecting all matching hosts.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46334?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44617
Screenshot:
<img width="1318" height="528" alt="image"
src="https://github.com/user-attachments/assets/4ec4bd85-8efb-4729-86ad-ea3059439b60"
/>
Note that the uninstall details modal is viewable without any errors on
Fleet Free, so maybe we should address that at some point.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* When accessing software install details without a Fleet Premium
license, the activity modal now displays a Fleet Premium upsell message
with a "Learn more" link instead of a generic error, providing clearer
guidance to upgrade.
* **Tests**
* Added test coverage for the Fleet Premium license requirement scenario
in the install details modal.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Noah Talerman
