<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
# Checklist for submitter
- [x] Docs-only change (new guide article); no code, tests, migrations,
settings, or fleetd/orbit changes.
## Summary
Adds a new guide, `articles/manage-fleet-during-a-gitops-outage.md`,
covering the business continuity workflow for making urgent changes in
the Fleet UI when a CI provider (e.g. GitHub Actions) is down, and how
to reconcile the GitOps repo afterward so the next automated run doesn't
revert the fix.
Resolves#45414
- Added Adobe plugins to software inventory: Fleet now detects Adobe Creative Cloud plugins (CEP and UXP extensions) on macOS and Windows hosts and lists them on the Software page and host details with the software type "Plugin (Adobe)", including version and host count.
- Adobe plugins are excluded from vulnerability scanning, so no vulnerabilities are reported for them. No vulnerability data source maps an Adobe CEP or UXP extension to a CVE; Adobe files CVEs against the host application (Photoshop, Acrobat, and so on), which Fleet already scans.
Fixed unreleased bug where admin password was still shown on a wiped
host after re-enrollment.
Add a `deleted` column and soft-delete the row on re-enrollment,
mirroring host_recovery_key_passwords.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43488
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added support for safely retiring managed local account passwords
during device re-enrollment.
* Retired credentials are excluded from retrieval, status updates,
command operations, and automatic rotation.
* Successfully escrowing a password can restore a previously retired
record.
* **Bug Fixes**
* Re-enrollment cleanup now clears stale password rotation state.
* Cleanup failures stop reset or re-enrollment processing to prevent
incomplete credential changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48222
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a redirect from the DDM activations information page to the
relevant section of the Custom OS Settings article.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
The Fleet UI now displays a policy's targeted platform, so repeating it
in the policy name is redundant. This strips the leading `macOS - ` /
`Windows - ` / `Linux - ` from all 84 prefixed policies in
`it-and-security`.
## Collisions
GitOps rejects duplicate policy names within a fleet
([`pkg/spec/gitops.go`](https://github.com/fleetdm/fleet/blob/main/pkg/spec/gitops.go#L2020)),
and the Workstations fleet includes macOS, Windows, and Linux policies
together. 14 stripped names would collide, so for those the platform
moves to a trailing suffix instead of being dropped:
| Before | After |
|---|---|
| `macOS - Gatekeeper enabled` | `Gatekeeper enabled` |
| `Windows - Secure Boot enabled` | `Secure Boot enabled` |
| `Linux - Removable storage is read-only` | `Removable storage is
read-only` |
| `macOS - Disk encryption enabled` | `Disk encryption enabled (macOS)`
|
| `Windows - Disk encryption enabled` | `Disk encryption enabled
(Windows)` |
| `Linux - Disk encryption enabled` | `Disk encryption enabled (Linux)`
|
49 policies lose the platform entirely; 35 keep it as a suffix. The 14
suffixed names are: Disk encryption enabled, Sufficient disk space
available, User .npmrc min-release-age at least 0.5 days, 1Password
installed, Battery healthy, and the 9 patch policies that exist for both
macOS and Windows (1Password, Google Chrome, Firefox, Slack, Zoom,
Visual Studio Code, Okta Verify, Claude, Adobe Acrobat Reader).
Also updates the descriptions of `macos-screen-lock-exclusions` and
`windows-screen-lock-exclusions`, which quote policy names.
## Notes for the reviewer
- **This is destructive on apply.** GitOps matches policies by name, so
applying this deletes the 84 existing policies and creates new ones.
Policy pass/fail history and host results reset. Automations defined in
the policy YAML (calendar events, install/script triggers) carry over,
but anything referencing these names outside the repo — saved filters,
dashboards, Slack workflows — needs updating separately.
- `tools/fleet-slackbot/system-prompt.js:338` still documents the
`<Platform> - <Description>` convention, and the `fleetctl new` macOS
template still ships a prefixed name. Both left alone intentionally —
out of scope for dogfood config.
- Four policy files appear unused by any fleet and were renamed only for
consistency: `lib/{macos,windows}/policies/update-claude.yml` and
`update-slack.yml`. Their names duplicate entries already in
`patch-fleet-maintained-apps.yml` for the same platform. Worth deleting
in a follow-up.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
N/A — dogfood GitOps config only, no product code changes.
## Testing
- [x] QA'd all new/changed functionality manually
Verified locally:
- No `macOS - ` / `Windows - ` / `Linux - ` strings remain anywhere
under `it-and-security/`.
- Every fleet passes the same uniqueness rule GitOps enforces —
Workstations resolves to 78 policies with 0 duplicate names; all other
fleets unchanged.
- All 73 touched/related YAML files parse.
- The diff touches only `- name:` lines plus the two label descriptions.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves
https://github.com/fleetdm/fleet/issues/50548
Fleet's calendar integration was scheduling maintenance events over
users' **Focus Time** and **Out of Office** blocks, even when those were
marked Busy.
The root cause is the event query in `ListEvents`
(ee/server/calendar/google_calendar.go), which only requested
`"default"` event types — so `focusTime` and `outOfOffice` events were
never returned and never considered during conflict detection.
## Change
Added the blocking event types to the query:
```go
EventTypes("default", "focusTime", "outOfOffice").
```
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Restricted access to manual MDM enrollment profiles to global or team
administrators and maintainers.
* Prevented unauthenticated, roleless, observer, and GitOps users from
viewing enrollment profile data.
* Updated authorization documentation to reflect the required
permissions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes to Step 2 in both Options 1 & 2.
The current documentation Click the *Endpoint Management* Tab and the
proposed change is Click the *Device Access* Tab
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49972
Adds custom DDM activations to the GitOps workflow. A profile entry can
point at an activation file with a new `activation` key, the batch
endpoint validates and stores it through the same code as the
single-profile upload, and `fleetctl generate-gitops` exports it back
out.
```yaml
controls:
macos_settings:
custom_settings:
- path: ./lib/profiles/passcode.json
activation: ./lib/activations/passcode.json
```
`activation` is only valid on a declaration (`.json`) profile, and can't
be combined with `paths:` because an activation names exactly one
declaration. Removing the key removes the stored activation.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Verified on an ADE-enrolled Mac: exported an existing declaration and
its custom activation with `generate-gitops`, removed everything by
applying a config with no profiles, then re-applied the exported files.
All three declarations came back with the correct scopes, the activation
attached to only its own declaration, and the predicate was reported
correctly on the host.
## New Fleet configuration settings
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
**Related issue:** Resolves#49971
Serves the custom activations stored by #49970 to devices. Stacked on
#50280.
- The manifest advertises a custom activation's own identifier; the
fetch serves its stored JSON with the predicate intact. Secrets and host
variables are expanded at delivery, like configurations.
- `activation_updated_at` folds into the token, so editing only a
predicate re-syncs the host even though the declaration's content didn't
change.
- Management declarations are served under the manifest's `Management`
section, have their own endpoint, and report status.
- Predicate outcomes map per the Figma dev note: `Info.Predicate` →
verified with an explanation, `Error.ActivationFailed` → failed.
### Three things to look at
**Generated activations are renamed to `<declaration
uuid>.activation`.** Removes the collision between an admin-chosen
identifier and one Fleet generates, and collapses the fetch into a
single lookup rather than match-then-trim. Note this differs from the
CoS wording of "byte-for-byte identical to today".
Existing hosts will see their activations renamed once. The sync token
doesn't move for the rename alone — activation identifiers aren't part
of it, confirmed in `MDMAppleDDMDeclarationsToken` — so it happens
lazily on the next real DDM change rather than all at once.
**`activation_updated_at` is not the `max()` the issue describes.** The
issue asks for `max(activation uploaded_at, latest variable change)`.
Variable changes stay on `variables_updated_at`; this is
`GREATEST(uploaded_at, secrets_updated_at)`. Same outcome, since
`EffectiveDDMToken` hashes all the timestamps together, but each signal
stays independently comparable, which is what keeps the reconciler
idempotent.
**The token is computed in three places, not two.** SQL in
`MDMAppleDDMDeclarationsToken`, Go in `EffectiveDDMToken`, and a third
independent copy building the manifest-level token in
`handleDeclarationItems`. All three now carry the new term in the same
order. `ActivationUpdatedAtFoldsIntoToken` asserts the SQL and Go agree
with it populated — they only agreed for the nil case before.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Tested on an ADE-enrolled Mac (macOS 26.5.1) against a local server: the
custom activation is advertised and fetched by its own identifier, an
activation-only edit re-syncs the device even though the declaration is
unchanged, a true predicate enforces the policy on the host, and a false
one comes back verified with the explanation.
That turned up two bugs, both fixed here and both invisible to the test
suite:
- `MDMAppleStoreDDMStatusReport` computed the matching token with
`activation_updated_at` but never selected the column, so it was always
nil. Every status report was silently dropped and profiles sat in
verifying forever.
- Apple splits a predicate outcome across two arrays — the activation
reports `Info.Predicate`, the configuration it gates reports
`Error.ActivationFailed`. Reading only the configuration made a host the
predicate excluded look failed. Now correlated via the activation
identifier in the failure details.
The test payloads for the second one are the real reports the Mac sent,
not hand-written.
Note for anyone testing in the UI: the OS settings tooltip for a
verified profile is hardcoded to "The host applied the setting. Fleet
verified." and doesn't read `detail` yet, so a predicate-excluded
profile reads wrong there. Backend stores the right message; rendering
it is #49973.
New cases in `apple_mdm_ddm_test.go`: the token agreement above; a
custom activation advertised and served with its predicate, with the
generated name no longer resolving for it; a declaration without one
still getting the synthesized activation; management routing plus the
endpoint type guard; the three predicate status outcomes; and a host
outside a declaration's scope getting an empty manifest and an error
fetching the activation by name.
13 existing assertions moved from `<identifier>.activation` to
`<uuid>.activation`.
The `GeneratedActivationStillServedWhenNoCustomOne` case caught a real
bug on its first run: the `LEFT JOIN` returns NULL for declarations
without a custom activation, which `json.RawMessage` can't scan, so
every non-custom activation fetch would have 500'd. That's the
no-regression path.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Apple DDM management declarations and custom activation
delivery.
* Added host-scoped activation resolution, activation identifiers, and
activation update timestamps.
* Added support for activation variables, secrets, assets, and separate
management and configuration endpoints.
* **Bug Fixes**
* Declarations are now redelivered when activation predicates change or
are removed.
* Improved status reporting for predicate exclusions, activation
failures, and management declarations.
* Improved synchronization token updates when variables, assets, or
activations change.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Removed outdated sections from the REST API documentation. We're not
consistently adding new ones like "Vulnerabilities" and I don't think
the website uses these.
Co-authored-by: Rachael Shaw <r@rachael.wtf>
**Related issue:** N/A
## Summary
Fleet's "Host vitals" label type already supports matching on a custom
host vital's exact value (in addition to the existing IdP-based
criteria), but this wasn't documented anywhere outside the custom host
vitals guide (see companion PR #50660). Adds that coverage across the
remaining references:
- `articles/managing-labels-in-fleet.md`: the "Host vitals" label type
bullet only listed the two IdP criteria; now also mentions custom host
vitals, and notes the type is exact-match only.
- `docs/Configuration/yaml-files.md`:
- Adds a `custom_host_vital` example to the labels GitOps reference,
alongside the existing IdP example.
- Adds a new `## custom_host_vitals` section documenting the top-level
GitOps key used to define vitals in the first place (referenced by the
labels criteria above), which had no reference-doc coverage at all.
Calls out that, unlike `labels`, omitting the key entirely deletes every
existing custom host vital rather than leaving them intact.
- `docs/REST API/rest-api.md`:
- The `criteria` parameter table was missing `custom_host_vital` as a
valid `vital` value and missing `custom_host_vital_id` entirely — added
both.
- None of the 6 registered custom host vitals endpoints (list, create,
update, delete, set a host's value, and the spec/replace-all endpoint
GitOps uses) had reference entries at all. Adds a full "Custom host
vitals" section following the existing "Custom variables" section's
format, including the same destructive replace-all behavior called out
in the YAML reference above.
# Checklist for submitter
- [ ] QA'd all new/changed functionality manually
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
**Related issue:** #50001
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a redirect from the Android manual sync learn-more page to the
updated setup guide.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#50551
Two published pages still describe pre-4.84 behavior, telling users that
GitOps mode doesn't restrict label editing in the UI. Since 4.84 that's
only true when the labels exception is enabled. This PR corrects both
pages and documents the exceptions framework.
**`docs/Configuration/yaml-files.md`**
- `labels` section: rewrote the note around the two exception states.
Beyond the sentence the issue flagged, the premise it rested on was also
stale: the note said omitting the `labels` key leaves existing labels
intact. Since #42191, `computeLabelChanges`
(`cmd/fleetctl/fleetctl/gitops.go:947`) branches on
`len(specifiedLabels) == 0`, so omitting the key deletes every custom
label in that scope unless the labels exception is enabled. Its own
tests name this behavior ("labels omitted removes all regular labels
when not excepted"). The note now spells out both states and fixes a
`label` / `labels` typo.
- `gitops` section: added a note that exceptions can't be set in YAML.
`Client.DoGitOps` strips the `exceptions` key defensively
(`server/service/client.go:726`), so this was worth stating explicitly.
**`articles/gitops-mode.md`**
- Added an "Exceptions" section covering the three exception types, what
an exception does to both the UI and `fleetctl gitops`, and the enroll
secrets default. Upgrade behavior is left to the release notes. It notes
that exceptions affect `fleetctl gitops` whether or not GitOps mode is
on, since neither the apply-path check nor `computeLabelChanges` reads
`gitops_mode_enabled`.
- "Still available" no longer lists "Add and edit labels"
unconditionally. It now points at the exceptions section for labels,
software, and enroll secrets.
Behavior the docs now match:
- UI gating is `GitOpsModeTooltipWrapper` with `entityType="labels"`
(`frontend/pages/labels/components/LabelForm/LabelForm.tsx:172`,
`NewLabelPage.tsx:676`, `HostsFilterBlock.tsx:223`). `useGitOpsMode`
treats an enabled exception as GitOps mode being off for that entity.
- Apply-path enforcement is in `server/service/client.go:2219-2242`
(premium only).
- Defaults: `server/fleet/app.go:1216` for new installs, migration
`20260323144117_AddGitOpsExceptionsToAppConfig.go` for upgrades.
The backend is unchanged and was already correct. `ModifyLabel` applies
no GitOps check, and the per-host label endpoints stay available
regardless of GitOps mode or exception state, so this PR is docs-only.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
Not applicable: documentation-only change, no product behavior change.
## Testing
- [x] QA'd all new/changed functionality manually
Verified the described behavior against the UI gating, the `fleetctl
gitops` apply path, and the exception defaults in code (references
above).
**Related issue:** Resolves#39896
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an option to skip local S3 configuration defaults when running
the server in development mode.
* Development startup can now avoid creating test S3 buckets when the
option is enabled.
* **Bug Fixes**
* Preserved existing development S3 setup behavior when the option is
not enabled.
* **Tests**
* Added coverage for skipped S3 setup and default development S3
configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Carlo <1778532+cdcme@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#50282
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. (Part of a bigger story)
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added support for tracking and reporting management declarations
alongside other device management statuses.
- Added success and error metrics for management declaration processing.
- Included management declarations in synchronization, caching, and
status reporting across device and user channels.
- **Improvements**
- Updated performance output with clearer, structured sections for host,
MDM, DDM, Android, and PSSO metrics.
- Added consolidated reporting for management declaration activity.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes from @melpike's feedback.
Keep the Windows tab visible when Windows MDM is off rather than hiding
it, and disable Create hidden admin with a tooltip pointing at Windows
MDM, matching how the macOS tab already behaves.
- Extracted `TurnOnMdmTooltipWrapper` to reduce code duplication
Reword the password-policy error fleetd reports so it reads as
sentences. The whole string is generated by Fleet, not by Windows, and
it is now shown to admins verbatim in the Show managed account tooltip.
Left-align that tooltip.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43488
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Windows account setup remains visible when Windows MDM is unavailable.
* Added guidance for enabling Apple or Windows MDM when required.
* Managed-account error tooltips now show detailed failure information
when available.
* **Bug Fixes**
* Prevented unavailable managed-account options from being selected.
* Improved Windows account error messages and password-policy wording.
* Improved visual feedback for disabled actions in dropdown menus.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Removed comment about CLI capabilities in Info.plist
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed an internal explanatory comment from the macOS application
configuration.
* No user-visible functionality or capability settings were changed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#50683
The policy details page's Automation runs table showed the correct run
count but rendered only one row when a single automation run covered
multiple hosts (e.g. a failing-policies webhook batch): rows are
(activity, host) pairs, so batch rows share an activity id, and the
table's default row.id keying collapsed the duplicates.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
#### Before
<img width="810" height="274" alt="Screenshot 2026-08-06 at 11 36 27 AM"
src="https://github.com/user-attachments/assets/c55a54c0-5d9b-4945-b712-c2449f3a4a8c"
/>
#### After
<img width="1467" height="510" alt="Screenshot 2026-08-06 at 11 23
41 AM"
src="https://github.com/user-attachments/assets/d0e560a3-0270-49aa-989d-0812fd156813"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed policy automation activity tables so activities with the same ID
are displayed as separate rows for each host.
* Corrected total run counts shown for host-specific activity rows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#49483
## What & why
The `/os_versions` API endpoint returned misleading success responses
for three invalid inputs. This PR makes each return a proper error:
1. **Invalid `platform` filter** (e.g. `?platform=notrealplatform`)
previously returned `count: 0` with `200 OK`, indistinguishable from "no
matching OS versions." It now returns a `422` validation error listing
the supported platforms (`darwin`, `windows`, `linux`, `chrome`, `ios`,
`ipados`, `android` — matching the documented filter values).
2. **Unknown OS version id** (e.g. `/os_versions/99999`) previously
returned `200 OK` with a null/zero-filled `os_version` object. It now
returns a not-found (`404`) error.
3. **Negative `max_vulnerabilities`** (e.g. `?max_vulnerabilities=-5`)
returned a message reading `must be >= 0` — Go's JSON encoder
HTML-escapes `>`. The message is reworded to `max_vulnerabilities cannot
be negative`, which is clearer and avoids the escaped character.
### ⚠️ Note for reviewer (fix#2)
The single-version handler previously swallowed the datastore's
not-found error and returned an empty result on purpose, with the
comment: *"It is possible the os version exists, but the aggregation job
has not run yet."* This PR removes that swallow so a missing id returns
`404`. If you'd prefer to preserve the empty-result behavior for the
"not yet aggregated" case, I'm happy to adjust — flagging so the change
is intentional and visible.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented.
## Testing
- [x] Added/updated automated tests (`TestOSVersionsErrorHandling` in
`server/service/hosts_test.go`, covering all three cases).
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Unsupported OS platform filters now return a clear validation error
instead of an empty-like result.
* Unknown OS version IDs now return HTTP **404 Not Found** rather than a
success response with null/zero fields.
* `max_vulnerabilities` validation now rejects negative values with an
accurate, readable message and consistent HTTP **422** responses.
* Error responses for OS versions endpoints now reflect the correct
status codes.
* **Tests**
* Updated and added coverage to assert the new error-handling and HTTP
status expectations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA — follow-up to #49910
## What changed
Regenerates `api/fleet-desktop.json` and
`outputs/fleet-desktop/darwin.json` for Fleet Desktop v1.4.0. No cask
changes.
## Why
#49910 bumped `Casks/fleet-desktop.rb` to 1.4.0 but never ran
`regenerate.sh` or the ingester, so the generated manifests — the files
Fleet actually serves — were still on 1.3.4 and still pointed at the old
`allenhouchins/fleet-desktop` GitHub release URL. That release feed is
stale (it stops at v1.3.4); 1.4.0 is hosted at `download.fleetdm.com`.
The `.rb` bump had no effect in production, and nothing in CI catches
this kind of drift.
This was found during a routine custom-tap maintenance pass. All four
casks (druva-insync, fleet-desktop, xcreds, zoom-rooms) are at their
latest upstream versions, so this is the only change needed:
| Cask | Version | Upstream | |
|---|---|---|---|
| druva-insync | 8.1.3,110967 | `inSync-8.1.3r110967` | current |
| fleet-desktop | 1.4.0 | 1.4.0 (1.4.1 → 404) | **manifests were stale**
|
| xcreds | 5.9,9148 | `tag-5.9(9148)` | current |
| zoom-rooms | 7.1.5.13403 | `cdn.zoom.us/prod/7.1.5.13403/` | current |
## Notes for reviewers
Verified the 1.4.0 installer against the cask stanzas before
regenerating:
- sha256 of the downloaded pkg matches the cask's `c920b983…`
- receipt id `com.fleetdm.fleet-desktop` (from `PackageInfo`) matches
both the `pkgutil:` and `quit:` stanzas
- `CFBundleShortVersionString` is `1.4.0`, matching the cask version —
so the `patched` query won't produce a perpetual false "Update
available"
- the `pkg` stanza filename `fleet_desktop-v1.4.0.pkg` matches the
downloaded filename
`regenerate.sh` rebuilds all four api JSONs; only fleet-desktop changed,
so there was no brew schema drift to absorb on the others. The
`install_script_ref` changes (`5d021f75` → `0341b271`) only because the
pkg filename inside the script changed; `uninstall_script_ref` is
unchanged.
Unrelated, not addressed here: brew emits a deprecation warning on three
casks for `depends_on macos: ">= :ventura"` (string comparison) vs
`depends_on macos: :ventura`. It doesn't affect the generated JSON.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
This is a macOS-only FMA manifest regeneration — no Go code, no schema,
no fleetd/orbit runtime changes. The remaining template sections
(changes file, SQL/input validation, timeouts, automated tests,
migrations, config settings, fleetd compatibility/auto-update) don't
apply; prior custom-tap bumps (#49563, #50651) likewise carry no changes
file.
Software title details now return installer scripts and managed app
configuration only to users who can read the installer. Uninstalling
software from the My device page now applies the same self-service and
label scope rules as installing.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security & Permissions**
* Restricted installer scripts, managed-app settings, and related
configuration to authorized viewers.
* Preserved package metadata while hiding sensitive installation details
from unauthorized roles.
* Improved access handling for requests without an assigned team or
involving inaccessible fleets.
* **Bug Fixes**
* Updated device-initiated software removal to honor self-service
eligibility and label scope.
* Added clearer errors when software is unavailable for self-service or
outside the device’s scope.
* Prevented software titles from inaccessible fleets from appearing in
results.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds an **Export control** blockquote in the `### Trust` section of
`handbook/company/communications.md`, immediately after the existing
Compliance blockquote.
Fleet conforms to the export-control restrictions applicable to ECCN
5D992.c classification. This blockquote documents the countries and
regions where Fleet does not currently do business.
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Resolves#48886.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [X] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [X] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [X] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for nested groups in Entra IDP vitals.
* SCIM groups can now include child groups and resolve membership across
multiple levels.
* Host filters and group-based access now account for inherited group
memberships.
* Added validation and duplicate prevention for nested group membership
updates.
* **Bug Fixes**
* Corrected membership updates and removals to keep nested group
relationships synchronized.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47715
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automatic Apple OS update synchronization and reconciliation.
* Apple devices can receive targeted minimum OS versions and enforcement
deadlines.
* Host details now display applicable Apple OS update requirements.
* Updates are selected based on device compatibility, platform, and team
configuration.
* Cached update information is refreshed and stale entries are removed.
* Pending targets are retried, with declarations resent when resolved.
* **Bug Fixes**
* Improved handling of unavailable targets and unsupported devices.
* Prevented unresolved update declarations from being incorrectly marked
as failed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48654
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a redirect from the Linux disk encryption information page to
the relevant enforcement guide section.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47865
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved MDM profile and declaration reconciliation for Android,
Apple, and Windows devices when dynamic label membership is temporarily
unknown.
- Existing installations are preserved while awaiting authoritative
label results.
- New installations are withheld until label membership is confirmed.
- Confirmed label changes continue to trigger the appropriate
installation or removal actions.
- Improved handling of combined include and exclude label rules.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48722
Demo: https://www.youtube.com/watch?v=zm5WmJY-o4Y
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Windows support for creating and managing local administrator
accounts.
* Added a Windows-specific option in user setup when Windows MDM is
configured.
* Added managed-account actions and status visibility for Windows hosts.
* Added guidance noting that this feature requires `fleetd` 1.60.0 or
later.
* **Improvements**
* Updated local account descriptions, help text, and authentication
guidance.
* Improved managed-account status and password-rotation messaging.
* Added clearer feedback when account creation or password escrow is
pending.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds scripts for Windows and Ubuntu that checks the health of all fleetd
components and collects logs and recent events into a timestamped
archive for support and troubleshooting.
These have been used by multiple customers now, and has simplified the
collection of logs from multiple locations while including events that
can assist with troubleshooting. Adding to solutions for wider use.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45524
Release alongside v4.90.0 release. Don't release prior
FMA update of Fleet Desktop macOS to 1.4.0
https://github.com/fleetdm/fleet/actions/runs/30112916197
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the Fleet Desktop Homebrew cask to version 1.4.0.
* Downloads now use the official Fleet Desktop distribution URL.
* Updated the project homepage reference.
* **Maintenance**
* Adjusted automatic update detection to use manual, release-based
versioning.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added the latest available releases for a broad range of macOS and
Windows applications, including Signal, AWS VPN Client, WebStorm, Zed,
Filebeat, Loom, Ollama, and others.
* Updated installer details and verification checks to support reliable
installation of current versions.
* **Bug Fixes**
* Improved removal behavior for selected applications, including cleanup
of background services, cached data, recent documents, and related
components.
* Updated uninstall handling for applications with changed installer
identifiers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A — internal developer tooling (`tools/hangar`).
## Summary
Fleet Hangar is the local dev-environment control panel (`tools/hangar`,
Go + Wails). This PR expands it into a broader **local dev-services**
toolkit for contributors/QA:
- **Multi-server support** — run up to 3 independent local Fleet servers
in parallel, each on its own git worktree, offset ports, and docker
compose project (server switcher + server-scoped
Server/Logs/Database/Git tabs).
- **SCEP tab** — run local SCEP CA servers using the in-repo
`server/mdm/scep/cmd/scepserver` (built once to a cached binary).
Per-depot profiles, `ca -init`, concurrent start/stop with live logs,
and one-click copy for the SCEP URL / challenge / thumbprint (parsed
from `ca.pem`).
- **MDM assets tab** — run `tools/mdm/assets export` from saved configs;
results list each written file with copy-contents/path + size +
timestamp, plus the `FLEET_MDM_APPLE_*` env block.
- **TUF tab** — drive `tools/tuf/test/main.sh` from platform checkboxes.
Hangar runs the file-server itself (`SKIP_SERVER=1`) so `fleetctl
package` can reach the TUF URL during packaging; streams live build
output; shows ngrok tunnel + TUF-server prerequisites; and offers
kill-server + delete-assets.
- **Supporting work** — DB backups in app-data + cross-server restore;
ngrok live public-URL links + stale-tunnel heal; per-server
open-in-browser; Settings → Troubleshoot cards to reap stray
`scepserver`/TUF-server processes and delete `test_tuf`.
Opening as a **draft for transparency**. All changes are confined to
`tools/hangar/`; nothing touches the Fleet server, agent, or any shipped
code.
**Architecture:** each tab is an `internal/<feature>` package (pure,
unit-tested logic) behind a thin `services/<feature>_service.go` Wails
adapter, reached from the UI as `api.*`. Long-running processes go
through the shared process engine; everything builds from / runs against
the primary repo (Server 1).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes — N/A: `tools/hangar`
is a developer tool and is not part of a Fleet release.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented, JS inline code is prevented, and untrusted data
interpolated into shell scripts/commands is validated against shell
metacharacters.
- External commands (`scepserver`, `go run ./tools/mdm/assets`, `bash
main.sh`, the backup/restore `docker` invocation) are spawned with
discrete argv slices via the process engine — no shell string
interpolation — so user-supplied values (challenge, enroll secret,
depot/dir paths) can't inject. Backup names are validated to
`[A-Za-z0-9._-]`; server-id path segments are sanitized to
`[A-Za-z0-9_-]` (no traversal); TUF asset deletion is scoped to
`<repo>/test_tuf`.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- Binary builds / one-shot commands run under bounded
`context.WithTimeout`; the TUF-server readiness and ngrok local-API
fetches use short HTTP timeouts; no unbounded loops or retries were
added.
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI — N/A: no Fleet server API
changes.
## Testing
- [x] Added/updated automated tests
- Go unit tests across the new packages: `settings` (SCEP profiles, TUF
config, `migrate` incl. the empty-`servers` case), `scep` (depot/CA
parsing, arg builders), `mdmassets` (export args, `wrote … in …`
parsing, config persistence), `tuf` (env building, file-server args,
asset delete), and `troubleshoot` (live-PID filtering) — plus the
existing backups logic.
- `tsc --noEmit` clean and `task build` green.
- [ ] Where appropriate, automated tests simulate multiple hosts and
test for host isolation — N/A.
- [x] QA'd all new/changed functionality manually (ongoing local testing
of all three tabs).
## Database migrations
N/A — no database migrations.
## New Fleet configuration settings
N/A — no Fleet server configuration settings (Hangar stores its own
settings in app-data).
## fleetd/orbit/Fleet Desktop
N/A — no fleetd/orbit/Fleet Desktop changes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Multi-server support (up to three) with server switcher, server-scoped
health/logs, and server-scoped Docker Compose controls.
* New **Servers** settings section plus per-server configuration
(including ports/compose project) and server-aware start/stop/quit
flows.
* New **SCEP**, **MDM Assets**, and **TUF** tabs for managing
profiles/assets and discovering ngrok URLs.
* Git worktree listing/creation/removal.
* Centralized, server-scoped database backup management.
* **Bug Fixes**
* Improved process discovery to skip dead or racing entries and avoid
duplicate docker-compose-up display.
* Self-healing pruning of stale ngrok tunnel selections.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves nothing, just something I found.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. (None, as editing profiles is only just released)
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
TO test upload a DDM profile referencing an asset, then try to edit that
profile with identical DDM contents and see mysql error, this PR fixes
that.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Apple device management declaration updates to preserve the
existing declaration identity.
* Correctly synchronizes linked asset references when declarations are
updated, including removing outdated references and clearing all
references when none remain.
* **Tests**
* Added coverage for creating, preserving, updating, removing, and
clearing declaration asset references.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Closes#49286
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- ~Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.~ N/A (handbook-only
change)
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- ~Added/updated automated tests~ N/A (handbook-only change)
- ~Where appropriate, automated tests simulate multiple hosts and test
for host isolation~ N/A
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- ~Confirmed that the fix is not expected to adversely impact load test
results~ N/A
- ~Alerted the release DRI if additional load testing is needed~ N/A
## Summary
Adds a "Code review coverage during time off" section to the Product
groups handbook page. When a small product group (2-3 engineers) has
someone on vacation, this documents the process: start with AI review,
then have the EM find a temporary human reviewer from another group,
preferably one the EM also manages.
## What / why
Follow-up to [#49134](https://github.com/fleetdm/fleet/issues/49134)
(Windows Autopilot ESP intermittently hanging on "Account setup" due to
a user-scope ESP node race). Adjusts the release QA template so this
failure mode is caught going forward.
## Changes
Builds out the **Power to PC → Setup experience** row into a dedicated
**Windows Autopilot / Entra OOBE enrollment** test, mirroring the
**Apple at Work → Setup experience** row:
- **Full configuration** run — specifies exactly what to configure so
the enrollment exercises every setup-related item (end user auth, config
profile, OS updates, disk encryption, software), enroll a real Autopilot
host, and verify the ESP completes and all items apply.
- **Blank enrollment** run — enroll into "No team" with **nothing
configured**, repeated **2-3 times**. Because the original bug was an
intermittent race, a single pass doesn't prove correctness. The ESP must
complete and reach the desktop every time (no "Account setup" hang).
The basic Autopilot enroll remains in "MDM enrollment flow" (mirrors
Apple keeping basic ADE enroll there).
Docs-only change to `.github/ISSUE_TEMPLATE/release-qa.md`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Joe Grant <thisisjoegrant@gmail.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42735
- Exposes max_software_package_size in the `GET /api/v1/fleet/config`
endpoint
- Add frontend logic to use it to deny files that are too big before
they get uploaded
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- Tested on Chrome, Safari, and Firefox on macOS
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a configurable maximum software package size to application
settings.
* Software uploads exceeding the limit are rejected with a clear,
size-specific error message.
* Packages at or below the configured limit are accepted.
* Added user-friendly file-size formatting across common units.
* Upload validation accounts for the complete request size, including
scripts and settings.
* **Tests**
* Added coverage for upload validation, boundary conditions, size
formatting, and configuration responses.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
kitzy