<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43721
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
Added a Google Calendar integration to gitops .yml with `client_email`
missing from the `api_json_key`.
- [X] on main, got error:
```
Error: applying fleet config: PATCH /api/latest/fleet/config received status 422 Validation Failed: client_email is required (API time: 13ms)
```
- [X] on this branch, got:
```
Error: applying fleet config: Validation Failed: client_email is required (API time: 134ms)
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Cleaner CLI error messages: removed extraneous HTTP path/status-code
details from GitOps-related errors, making output easier to read.
* **Tests**
* Added tests to verify the improved error message handling and
nil/non-wrapped error behavior.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44555)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42886
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] gitops run with extra keys (besides `client_email` and
`private_key` in `api_key_json` fails on main, passes on this branch
- [X] gitops run with missing `client_email` or `private_key` in
`api_key_json` still fails gitops (including dry run)
- [X] gitops run with extra keys sibling to api_key_json still fails as
expected
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected GitOps validation so Google Calendar API key JSON no longer
rejects valid nested keys; required-field validation for the integration
still enforced.
* **Tests**
* Added test coverage to ensure nested unknown keys are accepted while
sibling-level unknown fields are reported as validation errors.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44556)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Tim Lee <timlee@fleetdm.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43646
<img width="809" height="149" alt="image"
src="https://github.com/user-attachments/assets/cf7b55ae-4d79-4686-a9e5-e9e68e4b2e65"
/>
<img width="851" height="190" alt="image"
src="https://github.com/user-attachments/assets/0c70a2b6-091c-4222-b9a9-c4d46f9b0f5b"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed alignment inconsistency for premium feature messages in Fleet
settings. Premium notifications across Disk Encryption and Passwords
controls now display with proper alignment on Fleet Free tier.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45125)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Relocate the Safari extensions report to a macOS-specific directory and
update the fleet manifest to reference the new path. Also clean up
report descriptions by removing embedded compliance/mapping lines from
multiple reports (Chromium, Firefox, listening ports, local user
accounts, USB devices, and Safari) — queries and report logic unchanged.
Closes: https://github.com/fleetdm/fleet/issues/45155
Changes:
- Added auto-patching to the "What will you be using Fleet for?"
question on the contact page
- Included an auto-generated layout.ejs change
Updated the URL for the PSSO local account guide to include the platform
SSO section.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#30674
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved navigation shortlink to direct users to a more specific
section on the setup guide page.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45143)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes#42522
## Changes
When `labels:` appears in a no-team/unassigned GitOps file, log a
warning and skip label parsing. This matches the existing pattern used
by `agent_options` and `reports` in no-team files.
A warning (not an error) is used intentionally to avoid breaking
existing customer GitOps pipelines that may already have `labels:` in
their no-team file.
**After fix:**
```
[!] 'labels' is not supported in unassigned.yml. This key will be ignored.
```
## Testing
### Manual testing
Built `fleetctl` from the fixed branch against a local Fleet server
(premium license).
| Scenario | Result |
|---|---|
| `unassigned.yml` dry-run | Warning printed, succeeds |
| `unassigned.yml` real run | Warning printed, succeeds |
| `no-team.yml` dry-run | Warning printed, succeeds |
| `no-team.yml` real run | Warning printed, succeeds |
| `unassigned.yml` without labels | No warning, succeeds (no regression)
|
### Unit tests
- **`TestLabelsIgnoredInNoTeamFile`**: Sub-tests for both `no-team.yml`
and `unassigned.yml` assert: (1) no error, (2) `LabelsPresent` is true,
(3) no labels parsed, (4) warning logged.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Adds a linter to ensure we don't add new instances of `team` or `query`
in API params. This will be used incrementally, but this PR also adds
`nolint` directives to places that still have these terms, both to avoid
false-positives later and to help with full migration away from these
terms in in Fleet 5.
Example:
```
server/fleet/campaigns.go:51:16: json tag "team_id": uses deprecated "team"/"teams" — use "fleet"/"fleets" instead (apiparamcheck)
Team *uint `json:"team_id,omitempty"`
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new static analyzer (apiparamcheck) to flag deprecated API
parameter names ("team/teams") and improper usages of "query/queries".
* **Chores**
* Integrated the new check into CI tooling and configuration.
* Added analyzer tests and plugin registration.
* Applied targeted lint-suppression annotations across code and tests
where legacy parameter names must remain.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
- Also add /learn-more link so we can update the link w/o a Fleet
release
Hosts online:
<img width="494" height="171" alt="Screenshot 2026-05-08 at 5 11 23 PM"
src="https://github.com/user-attachments/assets/98e355d0-2253-426b-851b-494f40ed6e31"
/>
Vulnerability exposure:
<img width="569" height="191" alt="Screenshot 2026-05-08 at 5 11 18 PM"
src="https://github.com/user-attachments/assets/c4d4a026-e365-4321-b79c-6e83581857cc"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new learning resource link for vulnerability exposure (CVE)
dataset information.
* **Style**
* Updated tooltip link formatting and styling for improved presentation.
* Minor formatting adjustments to dataset descriptions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves
https://github.com/fleetdm/fleet/issues/44949.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [X] Confirmed that the fix is not expected to adversely impact load
test results.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Policy retrieval now correctly enforces team authorization, preventing
unauthorized cross-team access and ensuring team policies are returned
properly.
* **New Features**
* UI uses a unified policy access path for viewing/editing policies,
improving consistency for inherited/team-scoped policies,
back-navigation, and fleet-name display (All fleets / No team).
* **Tests**
* Added unit and integration tests covering cross-team access rules and
that policy automation fields are populated when policies are returned.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Replace "See Fleet in action" video buttons (with play icon and "3
mins" label) on `/device-management` and `/linux-management` with "Join
a workshop" `<animated-arrow-button>` linking to `/gitops-workshop`
- Matches the homepage hero secondary CTA style established in #45122
for `/replace-jamf`
## Changes
- `website/views/pages/device-management.ejs` — replaced video-button
CTA with animated-arrow-button
- `website/views/pages/landing-pages/linux-management.ejs` — replaced
video-button CTA with animated-arrow-button
## Notes
Searched the entire website codebase for all instances. Only
`/device-management` and `/linux-management` had the matching "See Fleet
in action" video modal CTA pattern. Other uses of `clickOpenVideoModal`
(transparency page's "Why is Fleet on my computer?", calendar banner,
customer testimonials) are different CTAs and were left unchanged.
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1778477147893939?thread_ts=1778225078.313209&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Replace the "See Fleet in action" video button (with "3 mins" duration
label) on the `/replace-jamf` hero section with an
`<animated-arrow-button>` linking to `/gitops-workshop` with the text
"Join a workshop"
- This matches the homepage hero's secondary CTA styling, text, and link
## Changes
**`website/views/pages/landing-pages/replace-jamf.ejs`**
Before:
```html
<a purpose="video-button" @click="clickOpenVideoModal('fleet-in-three-minutes')">
<img alt="Play" class="d-inline" src="/images/icon-play-video-32x32@2x.png">
See Fleet in action <span>3 mins</span>
</a>
```
After:
```html
<animated-arrow-button href="/gitops-workshop">Join a workshop</animated-arrow-button>
```
This aligns the `/replace-jamf` page CTA with the homepage hero's
secondary CTA pattern.
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1778476868031439?thread_ts=1778225078.313209&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Renames the "Resources / blog" navigation item in the website header
to "Releases / news"
- Changes the link destination from `/articles` to `/releases`
- Updates both desktop and mobile nav occurrences in
`website/views/layouts/layout.ejs`
## Changes
In `website/views/layouts/layout.ejs`:
- Updated `data-dropdown-option` attribute from "Resources / blog" to
"Releases / news"
- Updated `href` from "/articles" to "/releases"
- Updated `alt` text on the icon image
- Updated the visible label text
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1778476577694689?thread_ts=1778225078.313209&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Cursor for macOS and Windows to version 3.3.30 with new
installer URLs and verification checksums.
* Updated Draw.io Desktop for macOS to version 30.0.0.
* Updated OrbStack for macOS to version 2.1.3.
* Refreshed package metadata and installation queries for all updated
applications.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45120)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44286
Unset `patch_software_title_id` rather than deleting the policy in
`BatchSetSoftwareInstallers`, so the orphaned policy gets picked up by
the `policiesToDelete` loop in `server/service/client.go:3121`. As a
result, the `deleted_policy` activity is now created properly, and
gitops dry/real runs also report the deletion:
```
dry run:
[-] would've deleted policy macOS - 010 Editor up to date
[-] would've deleted 1 policy
real run:
[-] deleting policy macOS - 010 Editor up to date
[-] deleting 1 policy
[-] deleted 1 policy
```
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed missing deletion activity logs when patch policies are removed
via GitOps so policy deletion events are now recorded.
* **Behavior Changes**
* Batch-updating installers now retains obsolete patch policies but
clears their patch installer reference instead of deleting the policy.
* **Tests**
* Added integration coverage to verify deletion activities are emitted
and installer batch behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adding a new webpage on-premise and the menu navigation button using
Claude
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Introduced "On-premise" landing page with deployment details, feature
highlights, comparison tables, and customer testimonials
* Added "On-premise" option to Solutions navigation menu
* **Style**
* Updated homepage content and layout
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
Co-authored-by: johnjeremiah <jjeremiah@gmail.com>
Changes:
- updated logged errors in the website's build static content script
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved error reporting for GitHub API issues during build process,
providing clearer diagnostic messages.
* Optimized validation error detection order for pricing table features.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Added an embedded YT feature video for each highlighted feature from the
release. Also added anchor points so can jump down from the list at the
top.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed script references for deprecated features including payment
processing, account overview, and specific event-related pages from the
application layout.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Inkscape to version 1.4.4
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #NA
Found this while just browsing the codebase and testing some gitops
stuff.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed GitOps controls detection to correctly identify when controls
are set with specific configurations, including BitLocker PIN
requirements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Updated Cisco Jabber Windows to version 15.2.2.60904
* Updated ClickUp Desktop macOS to version 3.5.208
* Updated Raycast macOS to version 1.104.16
* Updated Thunderbird on macOS to version 150.0.2
* Updated Thunderbird on Windows to version 150.0.2
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Turns out his experience was for when he was at a customer that needs us
to get permissions to post. Taking down for now.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed a testimonial section from a landing page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Scott Gress
