## Changes
Removes the duplicate `labels_include_any` mapping key from the
`claude/windows` fleet-maintained app entry in
`fleets/workstations.yml`.
This duplicate key causes a YAML validation error ("duplicated mapping
key") because the same key appears twice on the same mapping. The fix
keeps the first occurrence (before `categories`) and removes the second.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** None
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Summary
- Adds a new weekly ritual **"Review CTRs of recently boosted posts"**
to the marketing handbook rituals
(`handbook/marketing/marketing.rituals.yml`).
- DRI: `irenareedy` (Irena)
- Includes a note that the CEO will attend the first few sessions, then
Irena and the CMO will continue running it going forward.
## Changes
- `handbook/marketing/marketing.rituals.yml`: Added new ritual entry at
the end of the file, following the existing format.
Built for
[mikermcneil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1773784076321939)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Irena Reedy <irena@fleetdm.com>
Resolves#36312
- Validate and trim fleet names in NewTeam, ModifyTeam, and
ApplyTeamSpecs
- Trim fleet names in gitops YAML parsing (parseName)
- Disable submit button in CreateTeamModal and RenameTeamModal when name
is whitespace-only
This pull request updates the environment variable configuration for
Okta metadata URLs in the `dogfood-gitops` GitHub Actions workflow.
Instead of using a single metadata URL, the workflow now distinguishes
between admin and end user metadata URLs.
Workflow configuration changes:
* Split the `DOGFOOD_OKTA_METADATA_URL` environment variable into two
separate variables: `DOGFOOD_OKTA_METADATA_URL_ADMINS` and
`DOGFOOD_OKTA_METADATA_URL_END_USERS` in the
`.github/workflows/dogfood-gitops.yml` workflow file.
Changes:
- Updated the GitOps workshop page's view action to omit events without
a venue set. (Note: this is a quick fix to resolve 500 errors on that
page, and I will create a follow up PR to display events without a venue
set)
Resolves#41534
Added GET /api/v1/fleet/hosts/{id}/reports endpoint (also accessible as
/hosts/{id}/queries) that lists the query reports associated with a
specific host.
Resolves#41863
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
Tests performed on the following OSs:
- Windows (arm64)
- macOS (Apple silicon)
- Linux (arm64)
- Linux (amd64)
Features tested on the OSs above:
- "My device".
- Restart fleetd.
- Kill fleet desktop, should re-start.
- Killing stale osqueryd processes on orbit startup.
- Checking if osquery is up and running, exit and start.
- Checking if Fleet Desktop is already running before launching it.
- orbit auto update
- Gracefully shutting down Fleet Desktop before restarting it
---
## fleetd/orbit/Fleet Desktop
- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41857
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- Tested 010 Editor on macOS
## Summary
- Adds `'Registered for a conference'` to the `intentSignal` `isIn`
array in three files:
- `website/api/helpers/salesforce/create-historical-event.js` — between
`'Signed up for Fleet event'` and `'Engaged with Fleetie at event'`
- `website/api/controllers/webhooks/receive-from-clay.js` — between
`'Signed up for Fleet event'` and `'Engaged with Fleetie at event'`
-
`website/api/helpers/salesforce/update-or-create-contact-and-account.js`
— added to the `isIn` array
- This replaces the incorrect approach in PR #41918, which added the
signal to the handbook markdown table instead of the code where intent
signals are validated.
---
Built for [Sam
Pfluger](https://fleetdm.slack.com/archives/D0AF8QFBVHB/p1773789580384389?thread_ts=1773788922.891409&cid=D0AF8QFBVHB)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
## Summary
- Adds the three pricing page card images (Free, Premium, Custom) to the
fleetdm.com/logos page
- Adds comic book style illustrations to the logos page, including both
base versions and captioned variants
- Images are displayed attractively in a grid with minimal text — no
stage labels or setup flow framing
### Changes
- `website/views/pages/press-kit.ejs`: Added two new sections ("Pricing
page cards" and "Comic book illustrations") following the existing page
layout pattern, with images only and minimal generic alt text
Built for
[mikermcneil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1773792420505909?thread_ts=1773792045.787089&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Add DOGFOOD_OKTA_METADATA_URL to the dogfood GitOps workflow environment
and update SSO configuration to use Okta. it-and-security/default.yml:
change end_user_authentication.entity_id to fleet-end-users and org SSO
entity_id to fleet-admins, set idp_name to Okta for both, remove inline
metadata values, and point metadata_url to $DOGFOOD_OKTA_METADATA_URL.
This centralizes IdP metadata retrieval via a secret URL.
## Summary
- Adds `sampfluger88` to `githubRepoMaintainersByPath` for
`website/api/controllers/webhooks/receive-from-clay.js`
- Adds `sampfluger88` to `githubRepoMaintainersByPath` for
`website/api/helpers/salesforce`
These are new entries in the maintainers mapping in
`website/config/custom.js`, ensuring that changes to the Clay webhook
controller and Salesforce helper files are auto-approved for
`sampfluger88`.
Built for [Sam
Pfluger](https://fleetdm.slack.com/archives/D0AF8QFBVHB/p1773792660524399)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
Updates the auto-tag-unreleased-bugs workflow to improve version
detection and handling.
## Changes Made
- **Orbit/Fleetd Version Detection**: Added support for detecting Orbit
and Fleetd versions in addition to Fleet server versions. The workflow
now checks `**Orbit version**:` and `**Fleetd version**:` fields (case
insensitive) and validates them against orbit-v* tags.
- **Optimized API Calls**: The workflow now only fetches the data it
needs:
- Fetches releases only when checking Fleet server versions
- Fetches tags only when checking Orbit/Fleetd versions
- This reduces unnecessary GitHub API calls and improves performance
- **Singular/Plural Field Support**: Updated regex patterns to match
both "version" and "versions" in issue templates (e.g., `**Fleet
version**:` and `**Fleet versions**:`). This handles variations in issue
template formatting where either singular or plural forms may be used.
- **Pagination Support**: Both `listReleases` and `listTags` API calls
now use `github.paginate()` to fetch all results instead of just the
first 100. This ensures older Orbit/Fleetd versions or Fleet versions
won't be misclassified as unreleased when they exist beyond the first
page of results.
- **Fixed 4.x Handling**: Corrected the logic for handling "4.x" version
strings (which represent all 4.x versions). The check now occurs before
the empty versions check, preventing issues reporting only "4.x" from
being incorrectly tagged as unreleased.
## Testing
- ✅ Verified regex patterns match both singular and plural forms for
Fleet, Orbit, and Fleetd version fields
- ✅ Confirmed the workflow correctly parses versions from various issue
formats
- ✅ Tested that API optimization only fetches releases or tags based on
which version types are present
- ✅ Verified pagination logic fetches all releases and tags, not just
first 100
- ✅ Tested 4.x handling logic correctly treats it as released
The changes maintain backward compatibility with existing issue formats
while adding support for Orbit/Fleetd version detection, handling
template variations, and ensuring comprehensive version checking through
pagination.
---------
Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com>
Co-authored-by: iansltx <472804+iansltx@users.noreply.github.com>
Co-authored-by: lukeheath <2495927+lukeheath@users.noreply.github.com>
## Summary
- Adds a `min-width: 500px` inline style to the "Quote" column header in
the Fleet Customer Testimonials table on the marketing-assets handbook
page.
- This makes the Quote column approximately twice as wide as it
currently renders by default, giving the longer testimonial quotes more
readable space.
- No other columns or content are changed.
Built for [Ashish
Kuthiala](https://fleetdm.slack.com/archives/D0AG9JQ53GA/p1773783685614189)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds a Windows Firefox update policy (`update-firefox.yml`) to detect
outdated Firefox installations vulnerable to CVE-2025-2857
- Adds Firefox as a Fleet-maintained app for Windows workstations
(`firefox/windows`) for self-service installation/update
- Registers both the policy and maintained app in `workstations.yml`
## CVE-2025-2857: Firefox Sandbox Escape on Windows
[CVE-2025-2857](https://nvd.nist.gov/vuln/detail/CVE-2025-2857) is a
**critical** sandbox escape vulnerability in Mozilla Firefox on Windows.
Following the Chrome sandbox escape (CVE-2025-2783), Firefox developers
identified a similar pattern in Firefox's IPC code where a compromised
child process could cause the parent process to return an
unintentionally powerful handle, leading to a sandbox escape.
**Affected versions:**
- Firefox < 136.0.4
- Firefox ESR < 128.8.1
- Firefox ESR < 115.21.1
**Only affects Firefox on Windows.** Other operating systems are
unaffected.
## What was changed and why
The Fleet-maintained Firefox app is already at version 148.0.2 (well
beyond the fix), and macOS workstations already had both an update
policy and software package configured. However, **Windows workstations
had no Firefox update policy or maintained app** — meaning there was no
mechanism to:
1. **Detect** Windows hosts running vulnerable Firefox versions
2. **Remediate** by offering an updated Firefox via self-service
This PR closes that gap by:
1. **`it-and-security/lib/windows/policies/update-firefox.yml`** — New
policy that queries the Windows `programs` table to flag any host with
Firefox < 148.0.2 (uses `LIKE 'Mozilla Firefox%'` and `NOT LIKE '%ESR%'`
to match standard Firefox installations, matching the pattern used in
other Windows update policies)
2. **`it-and-security/fleets/workstations.yml`** — Adds the policy
reference under Windows policies, and adds `firefox/windows` to
`fleet_maintained_apps` for self-service browser installation on x86
Windows hosts
---
Built for
[mikermcneil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1773774729891479)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: Kilo Code <kilo-bot@kilo.ai>
Changes:
- Commented out the section of the GitHub webhook that handles "release"
webhook events. The Zapier automation triggered by the webhook has been
turned off.
Added a section for Fleet customer testimonials with quotes from various
companies, highlighting their experiences and feedback on using Fleet.
This section aims to showcase the effectiveness and satisfaction of
Fleet's device management solutions.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves unreleased bug found in QA
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
