Closes#42522
## Changes
When `labels:` appears in a no-team/unassigned GitOps file, log a
warning and skip label parsing. This matches the existing pattern used
by `agent_options` and `reports` in no-team files.
A warning (not an error) is used intentionally to avoid breaking
existing customer GitOps pipelines that may already have `labels:` in
their no-team file.
**After fix:**
```
[!] 'labels' is not supported in unassigned.yml. This key will be ignored.
```
## Testing
### Manual testing
Built `fleetctl` from the fixed branch against a local Fleet server
(premium license).
| Scenario | Result |
|---|---|
| `unassigned.yml` dry-run | Warning printed, succeeds |
| `unassigned.yml` real run | Warning printed, succeeds |
| `no-team.yml` dry-run | Warning printed, succeeds |
| `no-team.yml` real run | Warning printed, succeeds |
| `unassigned.yml` without labels | No warning, succeeds (no regression)
|
### Unit tests
- **`TestLabelsIgnoredInNoTeamFile`**: Sub-tests for both `no-team.yml`
and `unassigned.yml` assert: (1) no error, (2) `LabelsPresent` is true,
(3) no labels parsed, (4) warning logged.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Adds a linter to ensure we don't add new instances of `team` or `query`
in API params. This will be used incrementally, but this PR also adds
`nolint` directives to places that still have these terms, both to avoid
false-positives later and to help with full migration away from these
terms in in Fleet 5.
Example:
```
server/fleet/campaigns.go:51:16: json tag "team_id": uses deprecated "team"/"teams" — use "fleet"/"fleets" instead (apiparamcheck)
Team *uint `json:"team_id,omitempty"`
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new static analyzer (apiparamcheck) to flag deprecated API
parameter names ("team/teams") and improper usages of "query/queries".
* **Chores**
* Integrated the new check into CI tooling and configuration.
* Added analyzer tests and plugin registration.
* Applied targeted lint-suppression annotations across code and tests
where legacy parameter names must remain.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
- Also add /learn-more link so we can update the link w/o a Fleet
release
Hosts online:
<img width="494" height="171" alt="Screenshot 2026-05-08 at 5 11 23 PM"
src="https://github.com/user-attachments/assets/98e355d0-2253-426b-851b-494f40ed6e31"
/>
Vulnerability exposure:
<img width="569" height="191" alt="Screenshot 2026-05-08 at 5 11 18 PM"
src="https://github.com/user-attachments/assets/c4d4a026-e365-4321-b79c-6e83581857cc"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new learning resource link for vulnerability exposure (CVE)
dataset information.
* **Style**
* Updated tooltip link formatting and styling for improved presentation.
* Minor formatting adjustments to dataset descriptions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves
https://github.com/fleetdm/fleet/issues/44949.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [X] Confirmed that the fix is not expected to adversely impact load
test results.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Policy retrieval now correctly enforces team authorization, preventing
unauthorized cross-team access and ensuring team policies are returned
properly.
* **New Features**
* UI uses a unified policy access path for viewing/editing policies,
improving consistency for inherited/team-scoped policies,
back-navigation, and fleet-name display (All fleets / No team).
* **Tests**
* Added unit and integration tests covering cross-team access rules and
that policy automation fields are populated when policies are returned.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Replace "See Fleet in action" video buttons (with play icon and "3
mins" label) on `/device-management` and `/linux-management` with "Join
a workshop" `<animated-arrow-button>` linking to `/gitops-workshop`
- Matches the homepage hero secondary CTA style established in #45122
for `/replace-jamf`
## Changes
- `website/views/pages/device-management.ejs` — replaced video-button
CTA with animated-arrow-button
- `website/views/pages/landing-pages/linux-management.ejs` — replaced
video-button CTA with animated-arrow-button
## Notes
Searched the entire website codebase for all instances. Only
`/device-management` and `/linux-management` had the matching "See Fleet
in action" video modal CTA pattern. Other uses of `clickOpenVideoModal`
(transparency page's "Why is Fleet on my computer?", calendar banner,
customer testimonials) are different CTAs and were left unchanged.
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1778477147893939?thread_ts=1778225078.313209&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Replace the "See Fleet in action" video button (with "3 mins" duration
label) on the `/replace-jamf` hero section with an
`<animated-arrow-button>` linking to `/gitops-workshop` with the text
"Join a workshop"
- This matches the homepage hero's secondary CTA styling, text, and link
## Changes
**`website/views/pages/landing-pages/replace-jamf.ejs`**
Before:
```html
<a purpose="video-button" @click="clickOpenVideoModal('fleet-in-three-minutes')">
<img alt="Play" class="d-inline" src="/images/icon-play-video-32x32@2x.png">
See Fleet in action <span>3 mins</span>
</a>
```
After:
```html
<animated-arrow-button href="/gitops-workshop">Join a workshop</animated-arrow-button>
```
This aligns the `/replace-jamf` page CTA with the homepage hero's
secondary CTA pattern.
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1778476868031439?thread_ts=1778225078.313209&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Renames the "Resources / blog" navigation item in the website header
to "Releases / news"
- Changes the link destination from `/articles` to `/releases`
- Updates both desktop and mobile nav occurrences in
`website/views/layouts/layout.ejs`
## Changes
In `website/views/layouts/layout.ejs`:
- Updated `data-dropdown-option` attribute from "Resources / blog" to
"Releases / news"
- Updated `href` from "/articles" to "/releases"
- Updated `alt` text on the icon image
- Updated the visible label text
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1778476577694689?thread_ts=1778225078.313209&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Cursor for macOS and Windows to version 3.3.30 with new
installer URLs and verification checksums.
* Updated Draw.io Desktop for macOS to version 30.0.0.
* Updated OrbStack for macOS to version 2.1.3.
* Refreshed package metadata and installation queries for all updated
applications.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45120)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44286
Unset `patch_software_title_id` rather than deleting the policy in
`BatchSetSoftwareInstallers`, so the orphaned policy gets picked up by
the `policiesToDelete` loop in `server/service/client.go:3121`. As a
result, the `deleted_policy` activity is now created properly, and
gitops dry/real runs also report the deletion:
```
dry run:
[-] would've deleted policy macOS - 010 Editor up to date
[-] would've deleted 1 policy
real run:
[-] deleting policy macOS - 010 Editor up to date
[-] deleting 1 policy
[-] deleted 1 policy
```
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed missing deletion activity logs when patch policies are removed
via GitOps so policy deletion events are now recorded.
* **Behavior Changes**
* Batch-updating installers now retains obsolete patch policies but
clears their patch installer reference instead of deleting the policy.
* **Tests**
* Added integration coverage to verify deletion activities are emitted
and installer batch behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adding a new webpage on-premise and the menu navigation button using
Claude
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Introduced "On-premise" landing page with deployment details, feature
highlights, comparison tables, and customer testimonials
* Added "On-premise" option to Solutions navigation menu
* **Style**
* Updated homepage content and layout
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
Co-authored-by: johnjeremiah <jjeremiah@gmail.com>
Changes:
- updated logged errors in the website's build static content script
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved error reporting for GitHub API issues during build process,
providing clearer diagnostic messages.
* Optimized validation error detection order for pricing table features.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Added an embedded YT feature video for each highlighted feature from the
release. Also added anchor points so can jump down from the list at the
top.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed script references for deprecated features including payment
processing, account overview, and specific event-related pages from the
application layout.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Inkscape to version 1.4.4
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #NA
Found this while just browsing the codebase and testing some gitops
stuff.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed GitOps controls detection to correctly identify when controls
are set with specific configurations, including BitLocker PIN
requirements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Updated Cisco Jabber Windows to version 15.2.2.60904
* Updated ClickUp Desktop macOS to version 3.5.208
* Updated Raycast macOS to version 1.104.16
* Updated Thunderbird on macOS to version 150.0.2
* Updated Thunderbird on Windows to version 150.0.2
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Turns out his experience was for when he was at a customer that needs us
to get permissions to post. Taking down for now.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed a testimonial section from a landing page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#38437
The list activities endpoint applied an implicit `created_at <= now` cap
only when `start_created_at` was set, leaving the upper bound unbounded
in every other case, this was changed so that we now apply that cap
unconditionally and override only when the caller passes an explicit
`end_created_at` (as peer the REST docs).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44826
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Windows MSI builds now correctly exclude placeholder secret values
during installation, preventing unnecessary dummy configuration files
from being created.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Changes:
- Added a new Github workflow that runs on branches that change the
website's dependencies (website/package-lock.json or
website/package.json), and fails for 72 hours after a change to those
files have been made. After 72 hours, if the workflow has not run again
on a pull request, the workflow can be rerun to give a PR a passing
status.
- Updated the website handbook page to document this process.
@lukeheath After this is merged, I will need help setting up a branch
protection rule to require a passing status from this workflow to merge
pull requests that change the website's dependencies
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added an automated workflow to enforce a wait period before website
dependency updates can proceed, preventing premature merges.
* Added scheduled and manual re-triggering for recent failed workflow
runs to ensure dependency checks are retried without manual
intervention.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Prevents `terraform destroy` from running against load test
infrastructure, for a given workspace, if an identical osquery perf
workspace exists.
- Adds a check to the osquery perf workflow, to fail fast, if the
specified load test infrastructure workspace is not detected.
- Adds ability for users to configure the osquery perf (increment -
`input.loadtest_containers_increment`) batch size that get deployed to
an environment during every loop. Default: 4.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a configurable load-test container increment input (default: 4)
to control scaling increments.
* **Improvements**
* Prevented destructive runs when an existing infra workspace matches
the requested name.
* Tightened workspace-existence checks to require exact name matching.
* **Chores**
* Default load-test increment reduced from 8 to 4 and input validated as
a positive integer.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Updated image of Oscar Taracena to one he sent me (instead of one I got
off the internet).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the testimonial author image asset on the Linux management
landing page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45042
# Details
On Dogfood, we have v4.85.0 server running but we run our GitOps with
the currently published fleetctl (4.84). This mismatch caused us to
disable (and therefore wipe out data for) both of our historical chart
datasets. This PR patches the "update app config" code so that when in
"overwrite mode" (i.e. GitOps), it checks for empty `historical_data`
keys in the incoming JSON and replaces them with the default values
(currently `true`, i.e. "collect the data"). Tested manually (see
testing below).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
## Testing
- [X] Added/updated automated tests
- [X] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [X] QA'd all new/changed functionality manually
- [X] reproduced issue on both current fleet v4.85 and main branch
servers, using fleetctl v4.84
- [X] on this branch, ran fleetctl v4.84 w/out `historical_data` in
gitops and verified that charts were enabled.
- [X] on branch applied to 4.85, ran fleetctl v4.84 w/out
`historical_data` in gitops and verified that charts were enabled.
- [X] disabled one chart in the UI, and verified that updating unrelated
app config in the UI did not affect that config (PATCH still works)
For unreleased bug fixes in a release candidate, one of:
- [X] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Fixed GitOps configuration handling for historical data settings to
properly apply default values when fields are omitted by clients. This
ensures that previous configuration settings are preserved correctly in
overwrite mode, preventing incorrect defaults from being inadvertently
persisted when managing configurations with older clients.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#44818
## Summary
- Show tier-specific description on the Variables page: Premium users
see "Manage custom variables that will be available in scripts and
profiles across all fleets." while Free users see "Manage custom
variables that will be available in scripts and profiles."
- Uses existing `isPremiumTier` from `AppContext`, consistent with the
rest of the ManageControlsPage components.
## Changes
- `frontend/pages/ManageControlsPage/Variables/Variables.tsx`: Added
`isPremiumTier` to the `AppContext` destructuring and conditionally
render the description text based on tier.
---
Built for [Rachael
Shaw](https://fleetdm.slack.com/archives/D0AFC5BRFHD/p1778192832326539?thread_ts=1777406096.224979&cid=D0AFC5BRFHD)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Added an optional HTTP-level pre-auth middleware (enabled using the
FLEET_OSQUERY_ALLOW_BODY_AUTH_FALLBACK server config) that validates
incoming osquery requests based on `Authorization: NodeKey <node_key>`
header.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the macOS application manifest with a new version entry and
updated installer configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Postman Windows installer metadata to version 12.9.7 with new
installation package details
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Nico
