<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42219Resolves#42224
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced Windows MDM profile validation: uploads that are non-XML,
empty, or lack required SyncML top-level elements are rejected; LocURI
values that are empty, start with `/`, contain `..` path traversal, or
are otherwise malformed are now rejected (whitespace-trimmed),
preventing later device deployment failures.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46029?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Following the pattern we have for Clay updating historical events with
the campaign name, this updates the historical event to include the
campaign name for website events.
After the contact is created/updated, we now include the campaign name
as a parameter for the historical event to update/populate the existing
field on the sfdc historical event object.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Historical events for signups, newsletter subscriptions, contact/quote
requests, whitepaper downloads, workshop requests, and page views now
include campaign association to improve marketing analytics.
* **Bug Fixes / Reliability**
* Webhooks now fall back to the most recent campaign when none is
provided.
* **Chores**
* Backend responses now expose a mostRecentCampaign field to support
campaign attribution.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45750?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
Not seeing referrer data in SFDC, making this code consistent to
troubleshoot
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Standardized referrer attribution so referrer URLs are consistently
captured from attribution data and applied for both new and existing
contacts in the Salesforce integration, improving accuracy of marketing
attribution and recent referrer tracking.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46096?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
## Summary
- Adds 16px gap between the "AUTONOMOUS ENDPOINT MANAGEMENT" kicker (h4)
and the headline (h1) to increase whitespace between them
- Adds negative margin-bottom on the hero section to reduce the
excessive whitespace below the subtitle paragraph ("Humans approve every
change.") at all responsive breakpoints
Fixes spacing issues visible on mobile where there was too little space
after the kicker title and too much empty space below the hero text.
## Changes
-
`website/assets/styles/pages/landing-pages/autonomous-endpoint-management.less`
- Added `display: flex; flex-direction: column; gap: 16px;` to
`[purpose='page-hero-headings']`
- Added `margin-bottom: -80px` to `[purpose='landing-page-hero']`
(desktop)
- Added `margin-bottom: -40px` at 991px and 768px breakpoints
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1779395766217859?thread_ts=1779227314.466229&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
Closes: https://github.com/fleetdm/fleet/issues/45689
Changes:
- Updated the layout and content of the Linux management page to match
the latest wireframes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added comprehensive FAQ accordion (10 items) and a “Couldn’t find an
answer?” prompt.
* New content sections: distro checklist, feature rows (visibility,
control, IaC, lightweight deployment), testimonial/brand logos, and an
AI workflow.
* Updated hero copy and reinforced primary/secondary CTAs (contact and
workshop).
* **Style**
* Redesigned page layout with improved spacing, left-aligned hero, and
updated typography.
* Reworked responsive behavior across breakpoints; adjusted CTA/button
sizing and mobile spacing.
* Refined logo grid, quote layouts, and bottom call-to-action
presentation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46090?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Fixes#46079.
Migration `20260518194422_AddEncodingTypeToHostSCDData` was
cherry-picked into the 4.85.1 patch release. Customers upgrading from
4.85.1 → 4.86.0 then saw `WARNING: Your Fleet database is missing
required migrations` for 11 migrations that landed on `main` with
earlier timestamps but never shipped in 4.85.1.
This PR renumbers those 11 migrations to run after `20260518194422` and
regenerates `schema.sql`:
| Old timestamp | New timestamp | Name |
|---|---|---|
| 20260427134220 | 20260522195224 |
AddPreserveHostActivitiesOnReenrollmentToAppConfig |
| 20260428125634 | 20260522195225 |
AddManagedLocalAccountRotationColumns |
| 20260429180725 | 20260522195226 | CreateTableAppConfigurations |
| 20260430103635 | 20260522195227 | AddRequireAllToPolicyAndQueryLabels
|
| 20260506132626 | 20260522195229 | AddVPPCountryCode |
| 20260506171058 | 20260522195230 |
AddSubjectAlternativeNameToCertificateTemplates |
| 20260512143542 | 20260522195231 | AddOrbitDebugUntilToHosts |
| 20260512173249 | 20260522195232 | CreateTableVPPClientUsers |
| 20260512173250 | 20260522195233 | AddManagedAppleIDToHostMDM |
| 20260518124441 | 20260522195234 |
AllowNullTypeOnHostMDMManagedCertificates |
| 20260518150028 | 20260522195235 | AddOriginToHostCertificates |
This will be cherry-picked into `rc-minor-fleet-v4.86.0` once merged.
## Test plan
- [x] `go build ./...` passes
- [x] All 11 migrations run cleanly in order during `make
dump-test-schema`
- [x] No references to the old timestamps remain in the repo
- [ ] Spin up 4.85.1, run migrations, then run the 4.86.0 binary built
from this branch and confirm no `missing required migrations` warning
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Reorganized database migration sequencing to ensure consistent schema
updates during deployment.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46097?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Fixed an error in the build-static-content script that was preventing
a validation error related to article images stored outside the website
folder from being logged.
- Moved an image used in the enroll hosts guide to the
website/assets/images/articles folder, and updated the name to match
website conventions.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the overall stability and reliability of the article markdown
build process with enhanced error handling for image link processing.
The build system now gracefully manages edge cases when processing
various image link patterns and formats, preventing unexpected build
failures that could previously occur during content compilation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46093?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
Adds a missing `is_active=1` check to get the actual active installer
for the software automation's installer.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- I tested by pinning the version of the app to the older one, then
unpinning and back and checked that the policy is associated to the
correct installer with the query below.
- I did not manually test updating to a new FMA version. It's possible
to do that easily by creating a new branch with a newer version and
referring FLEET_DEV_MAINTAINED_APPS_BASE_URL to it.
```
SELECT
si.id,
si.team_id,
si.title_id,
si.filename,
si.version,
si.storage_id,
si.uploaded_at,
si.updated_at,
si.url,
si.fleet_maintained_app_id,
si.install_during_setup,
si.is_active,
si.patch_query,
si.http_etag,
p.patch_software_title_id,
p.software_installer_id,
p.query
FROM software_installers si
LEFT JOIN policies p on si.id = p.software_installer_id
WHERE filename LIKE "%<app name>%" AND platform = "darwin" AND
global_or_team_id = <team id>;
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Patch policies using software install automations now correctly
prioritize active installers, ensuring deployment uses the latest
appropriate version rather than inactive or outdated alternatives.
* **Tests**
* Added test scenarios to validate policy installer version selection
and active status during automation evaluation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46087?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45862
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- Already added in the previous PR.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved detection and reporting of enrollment errors sent by the
server, ensuring error messages surface reliably.
* Prevented streaming leaks by stopping background work when a client
disconnects.
* **Documentation / Protocol**
* Made server-to-client streaming more spec-compliant (framing,
heartbeats) for more robust Android Enterprise enrollment communication.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45988?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Drops `nano_view_queue` from the Apple branch of the unscoped commands
list and joins the underlying `nano_*` tables directly. The view's
definition bakes in `ORDER BY q.priority DESC, q.created_at`, which
MySQL re-materializes on every query — the outer `LIMIT` can't push past
it, so each unscoped list call pays the full sort cost over the
post-join row set regardless of page size.
This is the same join shape the host-scoped path already uses (see
`listMDMCommandsByHostIdentifier`), so I followed that pattern. Column
output is identical to what the view was producing, which is why no test
updates were needed — all the existing `TestListMDMCommands*` cases pass
without modification.
Scope of this PR is just the hot caller. The view itself isn't touched.
The issue notes other call sites (`vpp.go`, `apple_mdm.go`) still go
through it, and that dropping the `ORDER BY` from the view's definition
would be the durable fix. Both feel like separate PRs — the audit work
for other call sites is non-trivial, and modifying the view risks
silently breaking any consumer that relied on its implicit ordering.
Happy to follow up on either.
Refs #44509.
# Checklist for submitter
- [x] Input is properly validated (no new user input paths; same
parameterized query shape)
- Tests: existing `TestListMDMCommands*` coverage exercises this path
and passes unchanged. No new tests added — see rationale above.
- Changes file: not applicable, internal query refactor with no
user-visible behavior change.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
* Updated Mobile Device Management command status reporting to ensure
accurate status and timestamp information.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45674?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Switch the Homebrew input token from "libreoffice" to
"libreoffice-still" and update the darwin output to version 25.8.7.
Adjust the existence/patch queries, installer URL, and SHA256 to match
25.8.7; install/uninstall script refs and categories remain unchanged.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves
#https://github.com/fleetdm/fleet/issues/45781
Update fleet-desktop from 1.2.1 to 1.3.0 across Homebrew cask, API
input, and darwin output. Changes include version and SHA256 updates,
updated release URLs and packaged filename (fleet_desktop-v1.3.0.pkg),
refreshed ruby_source_checksum, and updated installer script reference
(install_script_ref) and embedded installer invocation in the darwin
install script to use the new package name. Also adjust the darwin
patched query to compare against 1.3.0.
A small bug in our attribution logic. R
Replace exact equality checks with startsWith() (via Array.some).
The classification uses Array.includes(), which requires an **exact
string match**.
The lists contain bare root domains: for example
> 'https://www.linkedin.com/'
> 'https://www.reddit.com/'
> 'https://x.com/'
The stored referrer is always the full URL of the specific page the
visitor came from, including path.
So - if an Organic Social URL was https://www.linkedin.com/feed/
It does not equal https://www.linkedin.com/
and
The match fails, and the visit falls through to Web Referral. (this
would be incorrect)
Also - Expand search engine list (generalized Google domain, added
Startpage, Brave, Kagi, Yandex entries) and significantly extend social
referrer list (LinkedIn variants, lnkd.in, Hacker News, X/Twitter
variants, Facebook mobile/l.facebook, Instagram, Threads, Bsky, Mastodon
instances, YouTube, Reddit variants, Pinterest, Quora, etc.).
These changes make Organic search/social detection more accurate across
country TLDs, subdomains and shortened links.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Salesforce traffic attribution by expanding organic referrer
allowlists and enhancing matching to better detect organic search and
social sources.
* Normalized referrer values when absent or malformed to prevent
misclassification, yielding more accurate traffic categorization and
attribution reporting.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45803?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Set Salesforce contact referrer fields from
marketingAttributionCookie.referrer. Adds Source_referrer_url__c and
Most_recent_referrer_url__c assignments in the initial attribution block
and an additional Most_recent_referrer_url__c assignment in the later
block so referrer data is persisted when creating/updating contacts.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced Salesforce integration with improved contact attribution
tracking. Referrer information is now automatically captured and stored
in designated attribution fields for both newly created and updated
contact records, enabling more comprehensive tracking of customer
acquisition sources and marketing engagement paths throughout the user
journey.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45807?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Ashish Kuthiala
