Updated the published date from July 7 to July 16, 2026.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
**Related issue:** Resolves#44428
Unreleased bug from #48452 caught during testing
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved handling of resource-conflict responses when wording varies,
including singular and plural message formats.
* Prevented authentication failures and unrelated bad requests from
being incorrectly classified as conflicts.
* **Tests**
* Added coverage for HTTP conflict responses, recognized conflict types,
message variations, and non-conflict errors.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixing broken CI check after some updates on curl's mk bundle script:
https://github.com/fleetdm/fleet/actions/runs/29560837606/job/87822721779
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the certificate bundle header comment with clearer
configuration wording.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#47699.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Microsoft Entra Conditional Access is now supported for self-hosted
Fleet Premium instances.
* Conditional Access is available only on the Fleet Premium license
tier.
* **Changes**
* Removed the Microsoft Compliance Partner API key configuration and
updated the proxy behavior accordingly.
* Removed the managed-cloud indicator from license/config responses and
adjusted related UI rendering and gating.
* **Tests / Maintenance**
* Updated fixtures and automated tests to reflect the new licensing
gates and API/proxy behavior (including updated failure codes).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A (new article)
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`. — N/A, article only (no
changes file needed for articles)
## Testing
- [ ] QA'd all new/changed functionality manually (verify article
renders correctly on fleetdm.com preview, all links resolve, meta tags
valid)
## Article details
- New `articles`-category piece: "Intune isn't free: what the Microsoft
365 bundle really costs in 2026"
- Covers the July 1, 2026 Microsoft 365 price increases, the new E7
tier, bundle utilization data, and rightsizing device management with
Fleet
- All pricing sourced from Microsoft's published list prices (linked);
analyst commentary attributed to Gartner, Directions on Microsoft, and
Forrester
- Follows Fleet article house format (key takeaways, CTA, sentence case,
style guide compliance)
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated managed app versions and detection metadata for Antigravity,
AWS CLI, ChatGPT, Figma, Google Chrome, Kiro CLI, Microsoft Edge, Miro,
Rocket.Chat, Spotify, and Warp.
- Refreshed download links and package checksums where applicable.
- Ensured installation status checks recognize the latest releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an improved Tower uninstall script for winget on Windows that
targets all related MSI products and handles success/reboot scenarios
reliably.
* **Bug Fixes**
* Improved upgrade/patch detection and refreshed version gating for
multiple maintained apps on both macOS and Windows.
* Updated version-specific uninstall cleanup for several JetBrains apps
(and Tower) to remove the correct release-named data.
* **Chores**
* Refreshed installer download URLs and checksums for the latest Arc,
AWS CLI, Brave, Claude, Cursor, Datagrip, Devolutions, Discord, and
others.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43667
# Summary
Documents `setup_experience_platforms` on software packages in the
GitOps yaml reference. Field selects a `.sh` script-only package for the
macOS setup experience without disturbing its native Linux behavior.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Docs updated in `docs/Configuration/yaml-files.md` — field
description, semantics, and an example under `software.packages`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the Apple MDM documentation for the “Rotate FileVault key”
command to provide the correct description (replacing an inaccurate
reference).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #38986
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Confirmed the documentation diff contains only the Fleet version
update.
Adds Smallstep Agent (com.smallstep.Agent) as a maintained macOS app
including:
- Homebrew input config and darwin output with install/uninstall scripts
- Entry in apps.json catalog
- Frontend icon component and icon map registration
- App icon asset for the website
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49151
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Smallstep Agent for macOS software management.
* Added version detection and upgrade support for Smallstep Agent.
* Added installation, uninstallation, and app relaunch handling.
* Added Smallstep Agent metadata, Security categorization, and software
icon.
* **Bug Fixes**
* Ensured Smallstep Agent versions consistently use the expected `v`
prefix.
* **Tests**
* Added coverage for missing, prefixed, and unprefixed version formats.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Reasons to delete:
- We are not using this docker image.
- It's polluting the `docker compose up` logs with errors, e.g.:
```
cadvisor-1 | E0716 17:14:28.835089 1 manager.go:1116] Failed to create existing container: /docker/9ac0ef6fad63613bf90dbfb80e4fcf7affc4a378bbf1c2680f9fa0a587db783f: failed to identify the read-write layer ID for container "9ac0ef6fad63613bf90dbfb80e4fcf7affc4a378bbf1c2680f9fa0a587db783f". - open /var/lib/docker/image/overlayfs/layerdb/mounts/9ac0ef6fad63613bf90dbfb80e4fcf7affc4a378bbf1c2680f9fa0a587db783f/mount-id: no such file or directory
cadvisor-1 | E0716 17:14:28.839077 1 manager.go:1116] Failed to create existing container: /docker/891666c60086c1a695860bf5ea4a1eaf4ada94d902ee7392ddfab1bfd7ed5876: failed to identify the read-write layer ID for container "891666c60086c1a695860bf5ea4a1eaf4ada94d902ee7392ddfab1bfd7ed5876". - open /var/lib/docker/image/overlayfs/layerdb/mounts/891666c60086c1a695860bf5ea4a1eaf4ada94d902ee7392ddfab1bfd7ed5876/mount-id: no such file or directory
cadvisor-1 | E0716 17:14:28.841743 1 manager.go:1116] Failed to create existing container: /docker/bbfd8df39c02cec5d4ad665f4bb23faa5fc374efd7cb1ae0ff4864474c8a1b63: failed to identify the read-write layer ID for container "bbfd8df39c02cec5d4ad665f4bb23faa5fc374efd7cb1ae0ff4864474c8a1b63". - open /var/lib/docker/image/overlayfs/layerdb/mounts/bbfd8df39c02cec5d4ad665f4bb23faa5fc374efd7cb1ae0ff4864474c8a1b63/mount-id: no such file or directory
cadvisor-1 | E0716 17:14:28.844137 1 manager.go:1116] Failed to create existing container: /docker/62cad7aa07068e9ad14319a170622c4658008fd394347aa60e84f79727a03d29: failed to identify the read-write layer ID for container "62cad7aa07068e9ad14319a170622c4658008fd394347aa60e84f79727a03d29". - open /var/lib/docker/image/overlayfs/layerdb/mounts/62cad7aa07068e9ad14319a170622c4658008fd394347aa60e84f79727a03d29/mount-id: no such file or directory
cadvisor-1 | E0716 17:14:28.846207 1 manager.go:1116] Failed to create existing container: /docker/6fc30f822f6ccf81a192b5d385b30f5ed02f162df1c9823774405e0517be3cfe: failed to identify the read-write layer ID for container "6fc30f822f6ccf81a192b5d385b30f5ed02f162df1c9823774405e0517be3cfe". - open /var/lib/docker/image/overlayfs/layerdb/mounts/6fc30f822f6ccf81a192b5d385b30f5ed02f162df1c9823774405e0517be3cfe/mount-id: no such file or directory
cadvisor-1 | E0716 17:14:28.849253 1 manager.go:1116] Failed to create existing container: /docker/a7cec691d2ba6dc8cb8b034729957e6d9bc6dca06813953288d4430cf8d82d28: failed to identify the read-write layer ID for container "a7cec691d2ba6dc8cb8b034729957e6d9bc6dca06813953288d4430cf8d82d28". - open /var/lib/docker/image/overlayfs/layerdb/mounts/a7cec691d2ba6dc8cb8b034729957e6d9bc6dca06813953288d4430cf8d82d28/mount-id: no such file or directory
cadvisor-1 | E0716 17:14:28.851095 1 manager.go:1116] Failed to create existing container: /docker/160d97ff57081d3439843b5e2fd6bea00ef3ee744de51d01be1f6c0c90dec97d: failed to identify the read-write layer ID for container "160d97ff57081d3439843b5e2fd6bea00ef3ee744de51d01be1f6c0c90dec97d". - open /var/lib/docker/image/overlayfs/layerdb/mounts/160d97ff57081d3439843b5e2fd6bea00ef3ee744de51d01be1f6c0c90dec97d/mount-id: no such file or directory
cadvisor-1 | E0716 17:14:28.853019 1 manager.go:1116] Failed to create existing container: /docker/9f5f2f98be4da013911de372e808e33ae93b8f5cb2219adb681f31ee3c1497ed: failed to identify the read-write layer ID for container "9f5f2f98be4da013911de372e808e33ae93b8f5cb2219adb681f31ee3c1497ed". - open /var/lib/docker/image/overlayfs/layerdb/mounts/9f5f2f98be4da013911de372e808e33ae93b8f5cb2219adb681f31ee3c1497ed/mount-id: no such file or directory
cadvisor-1 | E0716 17:14:28.854765 1 manager.go:1116] Failed to create existing container: /docker/c637f0bf6708caeec3fe3b9b610204e84b8b4529cf770c09d6ca2e82f5b681e3: failed to identify the read-write layer ID for container "c637f0bf6708caeec3fe3b9b610204e84b8b4529cf770c09d6ca2e82f5b681e3". - open /var/lib/docker/image/overlayfs/layerdb/mounts/c637f0bf6708caeec3fe3b9b610204e84b8b4529cf770c09d6ca2e82f5b681e3/mount-id: no such file or directory
cadvisor-1 | E0716 17:14:28.856713 1 manager.go:1116] Failed to create existing container: /docker/74953fdfba3c534515113bedef7f17ce01a7feef27ec22000d52ff4f98a538e9: failed to identify the read-write layer ID for container "74953fdfba3c534515113bedef7f17ce01a7feef27ec22000d52ff4f98a538e9". - open /var/lib/docker/image/overlayfs/layerdb/mounts/74953fdfba3c534515113bedef7f17ce01a7feef27ec22000d52ff4f98a538e9/mount-id: no such file or directory
cadvisor-1 | E0716 17:14:28.858256 1 manager.go:1116] Failed to create existing container: /docker/96e468826a675094cf686619e9560a5ed0e089bbca8f3c9c41a5d432d7e7e235: failed to identify the read-write layer ID for container "96e468826a675094cf686619e9560a5ed0e089bbca8f3c9c41a5d432d7e7e235". - open /var/lib/docker/image/overlayfs/layerdb/mounts/96e468826a675094cf686619e9560a5ed0e089bbca8f3c9c41a5d432d7e7e235/mount-id: no such file or directory
cadvisor-1 | E0716 17:14:28.859877 1 manager.go:1116] Failed to create existing container: /docker/785d4800c3249c155f6b921ef554f49851920e5d6a295e1d2ef12fb85a327935: failed to identify the read-write layer ID for container "785d4800c3249c155f6b921ef554f49851920e5d6a295e1d2ef12fb85a327935". - open /var/lib/docker/image/overlayfs/layerdb/mounts/785d4800c3249c155f6b921ef554f49851920e5d6a295e1d2ef12fb85a327935/mount-id: no such file or directory
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed the cAdvisor monitoring service from the Docker Compose
configuration.
* The application no longer starts cAdvisor or exposes its monitoring
endpoint by default.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the available Claude Windows app version to 1.21459.3.
* Updated the available Cursor Windows app version to 3.11.19.
* Refreshed installer download links and verification checksums for both
applications.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Add comprehensive documentation of secure configuration baselines for
Fleet's AWS cloud infrastructure, including organization-level controls,
identity and access management, customer environment baseline
(encryption, networking, database, compute), and known deviations.
Covers infrastructure-as-code approach via Terraform with alignment to
AWS FSBP, CIS AWS Foundations Benchmark, and NIST 800-53 standards.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
Cherry-pick of #48451 ("Adding changes for Fleet v4.89.0") from
`rc-minor-fleet-v4.89.0` into `main`.
This brings the v4.89.0 CHANGELOG entry and the corresponding `changes/`
cleanup into main. The CHANGELOG conflict was resolved by placing the
4.89.0 section above the existing 4.88.1 section (keeping main's 4.88.1
date of Jul 10, 2026).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added vulnerability filtering by CVSS score and exploitability in
Fleet Desktop.
* Added default enrollment behavior for fleet-owned Apple devices.
* Added additional filtering options to the Vulnerability Exposure
chart.
* Improved certificate template variables, including IdP values and host
platform.
* **Bug Fixes**
* Fixed policy selection pagination, stale policy/report details, and
missing-host reporting.
* Corrected SSO and email links when Fleet is hosted under a URL
subpath.
* Improved Windows profile validation and MDM command labeling.
* Fixed several display and accessibility issues, including host counts,
checkbox wording, and dark-mode badges.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Changes
Adds a policy statement to the "Generate a quote" section of the GTM
operations handbook page:
> **Policy: Any quote with custom terms must be reviewed by the CFO in
addition to other approvers.**
This is placed immediately after the existing custom terms guidance
(added in #49315), making it clearly visible as a requirement before the
approval submission step.
---
Built for [Sam
Pfluger](https://fleetdm.slack.com/archives/C08BTMFTUCR/p1784221707835089?thread_ts=1784057153.990589&cid=C08BTMFTUCR)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
**Related issue:** Resolves#41470
Adds support for uploading Python (`.py`) script-only software packages
— accepted as script-only (the file contents become the install script;
advanced options and automatic install follow `.sh`/`.ps1`), assigned
the new `py_packages` source, and installable on macOS and Linux hosts
across the UI, REST API, and GitOps.
Feature branch combining the backend (#48942) and frontend (#48946)
sub-PRs.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for Python (`.py`) script-only software packages across
UI uploads, API/self-service installs, and GitOps parsing.
* Python installers now derive metadata correctly and render the proper
Python icon, with install eligibility for macOS & Linux.
* **Bug Fixes**
* Improved installer-script validation and “supported file types” error
messages to include `.py` (and consistent handling of related script
fields/options).
* **Tests**
* Expanded unit, integration, and GitOps tests to cover Python package
parsing, metadata derivation, platform/host eligibility, and UI
rendering.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48811
This adds a "Use custom host vitals in scripts and configuration
profiles" guide and cross-links it from the built-in variables and
custom variables (secrets) guides.
## Testing
- [ ] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49376
Fixes an issue where, on Fleet Free, Controls > OS settings and Controls
> Scripts rendered an infinite loading spinner.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
### Before
https://github.com/user-attachments/assets/96ad3406-101d-4310-83e2-430331e0f854
### After
https://github.com/user-attachments/assets/6a83adf3-1110-49b1-bb65-401cb8df3c61
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved how Controls sub-pages receive the selected team for
free-tier accounts by normalizing unresolved values to a dedicated “no
team” ID.
* Avoided triggering “no team” lookups during initial config loading
when the tier is still unknown.
* Kept premium-tier forwarding behavior unchanged so unresolved team IDs
continue to wait as before.
* **Tests**
* Added coverage to verify the forwarded team ID behavior across free,
premium, and unknown-tier scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38214
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Updated delayed host vitals notifications to indicate that loading is
taking longer than expected, rather than suggesting the request failed.
- Applied the clearer message across host details, My device, and the
dashboard welcome card.
- Preserved loading and timeout behavior while improving the accuracy of
the user-facing notification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated macOS Burp Suite to version 2026.6.
- Updated macOS Dot to version 2.3.2.
- Updated Windows Evernote to version 11.25.6.
- Updated macOS GDevelop to version 5.6.274.
- Updated macOS Kiro to version 1.0.138.
- Updated Windows Postman to version 12.19.5.
- Updated Power Automate for desktop to version 2.70.00187.26189.
- Updated macOS Spokenly to version 2.25.1.
- Updated macOS VPN Tracker 365 to version 26.6.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated maintained app metadata for the latest releases of 3DF Zephyr,
ChatGPT, Claude, Cursor, Discord, Evernote, Fastmail, Fing, JetBrains
Toolbox, Kiro CLI, Miro, Notepad.exe, Opera, Portfolio Performance,
Rocket.Chat, Signal, Slicer, Tailscale, Tower, Visual Studio Code,
Vivaldi, WebCatalog, and Zen Browser.
* Refreshed installer download links, version detection thresholds, and
integrity checks to match the new releases.
* Updated Fing’s installer format to use ZIP artifacts.
* Corrected Mimestream’s uninstall configuration to point to the right
script reference.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Relates to #38806
Extend host name templates beyond the three host-identity variables to
also accept the IdP end-user variables, and re-enqueue the rename when a
referenced variable's value changes.
Re-enqueue on value change:
- An IdP data change (SCIM user/group create/update/delete) re-queues
only the affected hosts whose template uses the changed IdP variable —
IdP values are per host, so the scope is the specific hosts mapped to
that user/group.
- A custom (secret) value change re-queues every eligible host in each
team / "No team" whose template references the changed secret — secret
values are global, so the scope is the whole team/No-team.
Built-in variables intentionally NOT supported:
- Certificate/CA variables — $FLEET_VAR_NDES_SCEP_CHALLENGE,
_NDES_SCEP_PROXY_URL, _CUSTOM_SCEP_CHALLENGE_*,
_CUSTOM_SCEP_PROXY_URL_*, _SMALLSTEP_SCEP_CHALLENGE_*,
_SMALLSTEP_SCEP_PROXY_URL_*, _DIGICERT_DATA_*, _DIGICERT_PASSWORD_*,
_SCEP_WINDOWS_CERTIFICATE_ID, _CERTIFICATE_RENEWAL_ID (and legacy
_SCEP_RENEWAL_ID), _PSSO_DEVICE_REGISTRATION_TOKEN. These resolve to
one-time SCEP challenges, proxy URLs, base64 PKCS12 cert data, or
Fleet-minted tokens — meaningless as a device name, and resolving them
has side effects (issuing certificates, consuming one-time challenges)
and would leak secrets into a name that's broadcast on-device, in
osquery, and in the UI.
- Legacy $FLEET_VAR_HOST_END_USER_EMAIL_IDP — deprecated ("avoid in new
replacements") and not a documented built-in variable, so it's excluded
in favor of the supported IDP_USERNAME variables.
**Related issue:** N/A
## Summary
Adds a reusable Claude Code skill (`/aikido-tickets`) that automates
creating GitHub issues from Aikido pen test PDF reports. The skill:
- Reads findings from an Aikido detailed auditor report PDF
- Creates properly formatted issues in the confidential repo with attack
path, fix recommendations, and full Aikido details in a collapsible
section
- Assigns to the correct team project board and sets status to Ready
- Supports all Fleet engineering teams (Orchestration, S&C, MDM,
Software, First Impressions)
- Handles batch creation using parallel agents for efficiency
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] QA'd all new/changed functionality manually
Resolves#34311.
It's not urgent because:
- Orbit uses a fallback mechanism to fetch the device UUID (using
SMBIOS):
https://github.com/fleetdm/fleet/blob/d3092bbc640ebd8e92c13476f0ca8772b98d425e/orbit/pkg/platform/platform_windows.go#L354-L359
- Only used by the `mdm_bridge` table implementation. Which is only used
by CIS policies (not for critical MDM functionality).
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] QA'd all new/changed functionality manually
Tested on both a Windows 11 VM with 25H2 and real Windows 11 device with
23H2. The extracted UUID matches the UUID reported by osquery.
## fleetd/orbit/Fleet Desktop
- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [X] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [X] Verified that fleetd runs on macOS, Linux and Windows
- [X] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Updated Windows device identification to obtain the system UUID using
COM-based WMI querying instead of relying on the deprecated WMIC
utility.
- Removed the WMIC dependency from the MDM bridge table implementation.
- Improved cross-platform UUID handling by removing unused non-Windows
UUID placeholder logic and related constants.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#35075
- Added vulnerability (CVE) reporting for Android OS versions.
- Folded the Android security patch level into the host's OS version.
---------
Co-authored-by: Konstantin Sykulev <konst@sykulev.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46077
Newly created or updated reports (formerly "queries") did not appear in
the host details page's "Live report" modal, or in the standalone
reports list, until a hard refresh. This happened because the
reports-list query cache was never invalidated after a create/update,
and the host details modal additionally disabled refetch-on-mount, so it
kept serving stale cached data even when reopened.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
Premium license:
https://github.com/user-attachments/assets/b045b8da-b7d6-4ba6-b18d-b944208c75d2
Free license:
https://github.com/user-attachments/assets/974106e5-e620-4c46-b3ec-a74c955fe26d
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Newly created or updated reports now appear immediately in the host
details “Live report” modal and reports list without requiring a hard
refresh.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
We missed a space under Controls > Setup experience > Users > End user
authentication.
Before:
<img width="846" height="207" alt="Screenshot 2026-07-09 at 14 56 09"
src="https://github.com/user-attachments/assets/ef0e0022-aba4-4087-84ad-6657af77ec93"
/>
After:
<img width="861" height="205" alt="Screenshot 2026-07-09 at 14 56 04"
src="https://github.com/user-attachments/assets/8eeff380-4616-4621-b06c-88fc748329d0"
/>
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the spacing in the “Lock end user info” help text so the
highlighted field names now display more clearly in the UI.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#37972
This also fixes the sort order of fleets for flee-level users.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the user menu to show the correct settings sections based on
account type and access level, with clearer separation between sections.
* **Bug Fixes**
* Fixed fleet sorting for fleet-level users.
* Corrected top navigation behavior so the menu only shows
role/tier-appropriate items.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45729
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Self-service software table on My device page now shows both installed
and available version columns for each app, making it easier to see
current and updateable versions at a glance.
* **Tests**
* Added/updated tests covering installed and available version display
scenarios, including cases with missing installed versions and when both
versions are present to ensure correct UI rendering.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated Windows installer metadata (versions, download URLs, and
checksums) for AWS CLI, Fellow, Google Drive, Logi Options+, MongoDB
Compass, Ollama, Signal, TablePlus, TextExpander, and Zed to match the
latest releases.
* **Bug Fixes**
* Improved Google Drive uninstall handling by treating common
success/reboot exit codes as successful outcomes, ensuring non-zero
codes don’t get recorded incorrectly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Refreshed Windows and macOS app packages to their latest available
versions, including browsers, developer tools, productivity apps,
security software, and utilities.
* Updated installer download locations and integrity checks to match the
refreshed releases.
* Improved installation and removal support for select applications with
updated package handling.
* Updated version detection so available upgrades are accurately
identified across supported platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49260
This fix is based on direct discussion with Apple and consultation of
the Apple docs. We are not currently sure if this is actually issue the
customer is running into but we have identified it as an issue with our
enrollment process.
As far as testing my iPad running 18.7 gets prompted to update every
time now when I enroll it with updates turned on. If I back up and don't
take the upgrade and try to enroll again I get an error but I believe
this is an Apple bug which we've been told was fixed in 26+
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue during Android Device Enrollment where devices assigned
a mandatory software update could incorrectly show a failure status.
* Resolved cases where the required software update was not displayed
correctly.
* Improved Apple device enrollment update details by reporting the
operating system version consistently.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49329
## What & why
Fresh **Windows 11 25H2** (build 10.0.26200) devices failed Microsoft
Entra / Autopilot MDM auto-enrollment during OOBE with error
**80180006**. The device advertises an MS-MDE2 discovery
`RequestVersion` of `"9.0"`, and Fleet's `IsValidDiscoveryMsg()`
rejected it via an exact-match allow-list (`{"4.0","5.0","6.0","7.0"}`)
that could only be changed by rebuilding the server.
The discovery **response** already pins the protocol to
`EnrollmentVersionV4` (`"4.0"`) and the client negotiates down, so the
exact-match check was the only blocker. This PR implements the issue's
preferred fix: **accept any `RequestVersion >= 4.0`**, which is
forward-compatible with future Windows version bumps.
- `server/mdm/microsoft/syncml/syncml.go`: replaced the
`SupportedEnrollmentVersions` allow-list var with a
`MinSupportedEnrollmentVersion` constant.
- `server/fleet/microsoft_mdm.go`: added `enrollmentVersionAtLeast`
(numeric component-wise compare, so `"10.0" > "9.0"`) and changed
discovery validation to accept any version at or above the minimum.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed MDM enrollment failures on fresh Windows 11 25H2 and other
recent builds.
* Discovery requests now accept supported MDE2 `RequestVersion` values
at or above the minimum supported version (instead of requiring an exact
match).
* Invalid or outdated discovery versions now return more specific
validation errors.
* **Tests**
* Added unit test coverage for minimum, equal, newer, and invalid
enrollment version comparisons.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Allen Houchins