<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43887
Adds the password rotation state machine for macOS local admin accounts.
Changes file covered in prior PR
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Automatic macOS managed-local-account password rotation (5‑minute
scheduler) with queued SetAutoAdminPassword device commands
* Manual rotation API: POST /hosts/{id}/managed_local_account/rotate
(returns 204)
* API now reports auto-rotation timing and pending-rotation state
(auto_rotate_at, pending_rotation)
* Activity records for successful and failed rotations
* **Behavior Changes**
* Password availability is based on stored encrypted password (broader
than before)
* Rotate-while-in-flight is rejected to prevent duplicate rotations
* **Tests**
* New unit and integration tests for rotation flows, cron behavior, and
failure paths
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44082
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced GitOps script logging: reports how many scripts would be
applied in dry‑run mode or were actually applied, with per-team and
per-fleet breakdowns.
* **Tests**
* Added test coverage validating logging output for both dry‑run and
real execution, ensuring reported script counts and per-team/fleet
messages are accurate.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fix typo in the agent configuration documentation.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated application version information for ChatGPT (1.2026.118),
Docker Desktop (4.72.0), Inkscape (1.4.4), MongoDB Compass (1.49.6),
Proxyman (6.10.0), and Twingate (20.26.120.9484). Deployment manifests
have been refreshed with latest installer URLs and verification
checksums, ensuring accurate application tracking and proper
installation validation across macOS and Windows environments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com>
Replace the two fixed daily cron entries (0 14 * * * and 0 21 * * *)
with a single every-4-hours schedule (0 */4 * * *) for
.github/workflows/ingest-maintained-apps.yml. This consolidates and
increases the ingest job frequency to run hourly at 4-hour intervals.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the schedule for the maintained apps ingestion workflow to run
more frequently (every 4 hours instead of at fixed times).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** For #44077
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
## Testing
- [X] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
### Manual QA — Chart disabling (frontend)
Setup notes:
- Test as a global admin and (where indicated) a fleet admin
- Need a Premium deployment to test per-fleet behavior
- Have at least one fleet (e.g. "Engineering") for fleet-scoped checks
- Be able to flip
`appConfig.features.historical_data.{uptime,vulnerabilities}` and the
equivalent per-fleet keys (via API or settings UI)
#### Advanced settings page — `/settings/organization/advanced`
- [ ] "Activity & data retention" subheading appears on the page
- [ ] Section contains a "Disable hosts online" checkbox
- [ ] Section contains a "Disable vulnerabilities" checkbox
- [ ] Section is visible on Free tier
- [ ] Section is visible on Premium tier
- [ ] With `historical_data.uptime = true` in appConfig, "Disable hosts
online" loads **unchecked**
- [ ] With `historical_data.uptime = false` in appConfig, "Disable hosts
online" loads **checked**
- [ ] With `historical_data.vulnerabilities = false` in appConfig,
"Disable vulnerabilities" loads **checked**
- [ ] Saving with "Disable hosts online" checked sends
`features.historical_data.uptime = false` in the `PATCH
/api/v1/fleet/config` payload (verify in network tab)
- [ ] Saving with "Disable vulnerabilities" unchecked sends
`features.historical_data.vulnerabilities = true`
#### Per-fleet settings page (Premium only)
- [ ] Fleet settings page shows an "Activity & data retention" section
- [ ] Section contains "Disable hosts online" and "Disable
vulnerabilities" checkboxes scoped to the active fleet
- [ ] On **Free** tier, the per-fleet TeamSettings page is not reachable
(and therefore the section is not visible)
- [ ] On **Premium** tier, the section is visible to fleet admins
- [ ] Saving with "Disable vulnerabilities" checked sends
`features.historical_data.vulnerabilities = false` in `PATCH
/api/v1/fleet/teams/{id}` (verify in network tab)
#### Per-fleet checkbox locks when global is disabled
- [ ] With global `historical_data.uptime = false`, fleet's "Disable
hosts online" is **disabled / non-interactive**
- [ ] Hovering the locked fleet checkbox shows the tooltip "Disabled
globally"
- [ ] **Stored value preserved across lockout**:
- [ ] Set fleet `historical_data.uptime = false` (saved)
- [ ] Then set global to `false` — fleet checkbox renders **checked but
disabled**
- [ ] Flip global back to `true` — fleet checkbox renders **checked and
interactive** (fleet's `false` survived the round trip)
#### Confirmation modal on Save (both global and per-fleet)
- [ ] Loading with `uptime = true`, then checking "Disable hosts online"
and clicking Save → modal opens listing **"Hosts online"**
- [ ] No PATCH is issued until the user confirms
- [ ] No-op save (page loaded with `uptime = false`, no changes, click
Save) → modal does **not** open
- [ ] Re-enable (page loaded with `uptime = false`, uncheck "Disable
hosts online", Save) → modal does **not** open; PATCH is issued
- [ ] Disabling **both** datasets at once → modal lists **both** "Hosts
online" and "Vulnerabilities"
- [ ] Modal "Save and disable" button issues the PATCH and modal closes
once it resolves successfully
- [ ] Modal Cancel closes the modal, no PATCH is issued, checkboxes
remain checked (form state unchanged, ready to retry or revert)
#### Confirmation modal copy by scope
- [ ] Modal opened from Advanced page → body describes the change as
affecting the **entire Fleet deployment**
- [ ] Modal opened from fleet "Engineering" settings → body **references
"Engineering" by name** and describes the change as affecting **only
that fleet**
#### GitOps mode lockout
- [ ] With GitOps mode enabled, on `/settings/organization/advanced`:
- [ ] "Disable hosts online" is disabled with the GitOps tooltip
- [ ] "Disable vulnerabilities" is disabled with the GitOps tooltip
- [ ] With GitOps mode enabled, on a fleet's settings page:
- [ ] "Disable hosts online" is disabled with the GitOps tooltip
- [ ] "Disable vulnerabilities" is disabled with the GitOps tooltip
- [ ] When **both** GitOps mode and "Disabled globally" would apply, the
fleet checkbox shows the **GitOps tooltip** (GitOps wins)
#### Dashboard chart card — empty state
- [ ] With `appConfig.features.historical_data.uptime = false`, viewing
dashboard in "All teams" with the **uptime** dataset selected →
visualization area shows the **"Data collection disabled"** empty state
- [ ] Dataset selector, time range selector, and filter gear remain
visible **and functional** while the empty state is shown
- [ ] With global `vulnerabilities = true` but the active fleet's
`historical_data.vulnerabilities = false`, viewing the dashboard scoped
to that fleet with a vulnerabilities-driven dataset selected → empty
state shown
- [ ] With both global and fleet sub-keys `true` (or fleet sub-key
absent in All-teams scope) → visualization renders normally; empty state
does **not** appear
- [ ] Switching from a disabled dataset (A) to an enabled dataset (B)
replaces the empty state with B's visualization
- [ ] A dataset whose internal name has no `DATASET_CONFIG_KEY` mapping
renders normally (no empty state — implicitly enabled)
#### Empty-state content
- [ ] When the empty state is rendered for the "Hosts online" dataset,
"Hosts online" appears as the dataset name
- [ ] Link text describes re-enabling collection (e.g. "Manage data
collection in Advanced settings")
- [ ] Empty state includes a link to `/settings/organization/advanced`
when viewing All Fleets as a global admin
- [ ] Empty state includes a link to the correct Fleet settings page
when viewing a specific fleet as a global or team admin
- [ ] Empty state includes no link or call to action when viewed as a
non-admin
#### Activity feed rendering
- [ ] `enabled_historical_dataset` with `dataset = "uptime"`, `fleet_id
= null` → renders **"Enabled data collection for Hosts online."**
("Hosts online" bolded)
- [ ] `disabled_historical_dataset` with `dataset = "vulnerabilities"`,
`fleet_id = null` → renders **"Disabled data collection for
Vulnerabilities."**
- [ ] `enabled_historical_dataset` with `dataset = "uptime"`, `fleet_id
= 7`, `fleet_name = "Engineering"` → renders **"Enabled data collection
for Hosts online for the Engineering fleet."**
- [ ] `disabled_historical_dataset` with `dataset = "vulnerabilities"`,
`fleet_id = 7`, `fleet_name = "Engineering"` → renders **"Disabled data
collection for Vulnerabilities for the Engineering fleet."**
- [ ] `disabled_historical_dataset` with an **unknown** `dataset =
"policy_compliance"` → does **not** throw; renders **"Disabled data
collection for Policy compliance."** (raw key sentence-cased — `_` →
space, first letter capitalized)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Org- and team-level controls to enable/disable historical data
collection for "Hosts online" and "Vulnerabilities."
* Updated chart label: "Hosts active" → "Hosts online."
* Confirmation modal and a disabled-state UI when data collection is
turned off; per-team confirmation flow to prevent accidental data loss.
* Activity feed now records enable/disable actions for historical
dataset collection with readable dataset labels and scope.
* **Tests**
* Added comprehensive tests for controls, confirmation flows, disabled
states, chart headings, and activity items.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Updated validation error messages that log an object to use
util.inspect (These were being logged as `[object Object]`)
- Removed unused validation for `comingSoon` values in the pricing
features table YAML.
- Updated webinar video URL validation to use the same method we use for
validating testimonial video URLs
## Summary
- Adds a new "Field Event Follow-Up" section to the Sales handbook under
Responsibilities
- Documents the Solution Specialist post-event process for tradeshows,
GitOps & field events
- Includes the full follow-up workflow: immediate triage (pull from SF,
prioritize), outreach (email, CTA, LinkedIn, SFDC logging), and routing
(ICP, pipeline, partner, non-ICP)
## Changes
- `handbook/sales/README.md`: New `### Field Event Follow-Up` section
inserted before `## Rituals`
---
Built for [Chaz
Maclaughlin](https://fleetdm.slack.com/archives/D0AHH0ZEMLY/p1777907825885609?thread_ts=1777384598.397169&cid=D0AHH0ZEMLY)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
Resolves#44816.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Summary by CodeRabbit
* **Performance**
* Improved device authentication efficiency by optimizing token
resolution, reducing database load for both valid and invalid token
scenarios in Fleet Desktop.
* **Tests**
* Added comprehensive test coverage for device authentication fast-fail
scenarios, including handling of non-existent tokens, expired tokens,
and edge cases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
2/3rds of this PR is OpenSpec and tests. Use OpenSpec files as a
reference (if needed). They're there to help the review, and not to be a
review surface themselves.
- Backend implementation for `subject_alternative_name` in certificate
templates.
- Includes schema migration, variable expansion, GitOps support.
- Limits SAN types to `DNS`, `EMAIL`, `UPN`, `IP`, and `URI`.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41472
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
## New Fleet configuration settings
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Android certificate templates support Subject Alternative Name (SAN)
with validation (DNS, EMAIL, UPN, IP, URI), Fleet-variable substitution,
runtime expansion, and delivery; SAN use is gated by Premium license
* GitOps now validates and includes SAN in Android certificate flows
* **Chores**
* Database schema updated to store SAN on certificate templates
* Changelog entry added
* **Tests**
* Added unit and end-to-end tests covering SAN validation, variable
expansion, and GitOps behavior
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43859
This PR brings the Windows Autopilot setup experience to parity with
macOS DEP. Windows hosts that enroll
through Autopilot now coordinate with Fleet during the OOBE Enrollment
Status Page (ESP), so admin-defined
software installs run while the device is still waiting at the ESP
screen, before the user can sign in. Fleet
holds the device on the ESP until profiles and setup-experience software
all reach a terminal state, then
either releases the device to login or blocks it on a Reset PC failure
screen. A new team-level setting
controls the policy: when enabled, any critical software install failure
during ESP blocks the device with a
software-specific error message; when disabled, the device releases
regardless of install outcomes (best
effort). A pure 3-hour timeout also forces a finalize, with a
timeout-specific error message on the block
screen. The setting is premium-only and rejected when Windows MDM is not
configured.
Beyond the gating itself, the PR adds the supporting machinery:
orbit-driven setup-experience initialization
on Windows so installs are enqueued at the right moment,
defense-in-depth cancellation of pending software
installs (both queue rows and status rows) whenever the device is going
to block or time out, idempotent
re-enrollment cleanup so a device that resets and re-enrolls during ESP
starts from a clean state. Internally, finalize is structured so a
transient failure at any step (cancel, persist, or the state-machine
transition) leaves the device retriable on the next management session
rather than permanently stuck on "Working on it...". The behavior is
exercised by example-based tests, a property-based test that randomly
samples the wait/block/release decision matrix, and manual VM testing
across Autopilot edge cases.
<img width="1184" height="776" alt="image"
src="https://github.com/user-attachments/assets/5e48660d-235d-40bd-80b6-f8591c579279"
/>
# Checklist for submitter
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Re-enrollment now clears stale setup-experience results and pending
activities so devices aren’t blocked by old work.
* Insert operations tolerate missing enrollments and return clear
not-found behavior.
* **New Features**
* ESP finalization waits for software installation results and can block
or release based on configurable “require all” behavior; blocking
cancels pending steps and shows prioritized error text.
* Finalization persists batched final commands for consistent retries.
* Orbit config exposes setup-experience notification for pending/active
Windows hosts.
* **Tests**
* Expanded coverage for ESP flows, datastore awaiting-configuration,
Orbit config, and re-enrollment cascades.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Konstantin Sykulev <konst@sykulev.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Troubleshooting why ActiveCampaign does not see visits from emails.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Configuration**
* Default tracking in the ActiveCampaign integration is now enabled.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Set apple_require_hardware_attestation: true in
it-and-security/fleets/workstations.yml under controls to require
hardware-backed attestation for Apple devices. This strengthens security
for managed macOS workstations by enforcing hardware attestation checks.
Replace /bin/sh shebangs with /bin/bash across numerous Homebrew input
scripts to support bash-specific constructs (local, arrays, [[ ]],
etc.). Update darwin.json refs for multiple apps (notably 1password,
adobe-acrobat-pro, adobe-creative-cloud) to point to new
install/uninstall script refs and replace inline script bodies with bash
variants. Also remove ee/maintained-apps/outputs/docker/darwin.json.
Changes affect ee/maintained-apps/inputs/homebrew/scripts/* and
corresponding ee/maintained-apps/outputs/* darwin.json entries.
Closes#39739
## Local reproduction
Reproduced the bug locally by running `fleetctl gitops --dry-run`
against a local Fleet server with a GitOps config that references a
nonexistent label on a configuration profile.
**Setup:**
1. Started a local Fleet server (`fleet serve` against Docker
MySQL/Redis on `https://localhost:8080`, fresh database).
2. Created a minimal `.mobileconfig` profile
(`test-profile.mobileconfig`).
3. Created a `default.yml` that references it under
`controls.macos_settings.custom_settings` with `labels_include_all:
["this-label-does-not-exist"]`.
**Reproduction:**
```bash
fleetctl gitops -f /tmp/repro-39739/default.yml --dry-run
```
**Result (before fix):**
```
[!] Unknown label 'this-label-does-not-exist' is referenced by MDM Profile '/tmp/repro-39739/profiles/test-profile.mobileconfig'
Error: Please create the missing labels, or update your settings to not refer to these labels.
```
Two problems visible:
- Says "MDM Profile" — internal jargon, not the user-facing term
- Shows the full absolute path — noisy and unhelpful
---
## Code changes
**Summary:** Two lines changed in `cmd/fleetctl/fleetctl/gitops.go`
inside the `getLabelUsage()` function. Both fix how configuration
profile label errors are displayed to the user during `fleetctl gitops`
runs.
### `cmd/fleetctl/fleetctl/gitops.go`
**Line 851 — "multiple label keys" error message:**
Changed `"MDM profile"` → `"configuration profile"` and wrapped
`setting.Path` in `filepath.Base()` so the error shows just the filename
instead of the full absolute path.
```diff
- err := fmt.Errorf("MDM profile '%s' has multiple label keys; ...", setting.Path)
+ err := fmt.Errorf("configuration profile '%s' has multiple label keys; ...", filepath.Base(setting.Path))
```
**Line 869 — label usage tracking entry:**
Changed the type string from `"MDM Profile"` → `"configuration profile"`
and the identifier from the full `setting.Path` to
`filepath.Base(setting.Path)`. This feeds into the error message on line
458:
`[!] Unknown label '<name>' is referenced by <type> '<identifier>'`
```diff
- updateLabelUsage(labels, setting.Path, "MDM Profile", result)
+ updateLabelUsage(labels, filepath.Base(setting.Path), "configuration profile", result)
```
**After fix:**
```
[!] Unknown label 'this-label-does-not-exist' is referenced by configuration profile 'test-profile.mobileconfig'
```
---
## Testing
### Manual testing
1. Started a local Fleet server (fresh DB, `fleet serve` on
`https://localhost:8080`).
2. Created a minimal `.mobileconfig` profile and a `default.yml` GitOps
config that references it with `labels_include_all:
["this-label-does-not-exist"]`.
3. Built `fleetctl` from the **unfixed** code (`git stash`) and ran
`fleetctl gitops -f default.yml --dry-run`. Confirmed the old error
message:
```
[!] Unknown label 'this-label-does-not-exist' is referenced by MDM
Profile '/tmp/repro-39739/profiles/test-profile.mobileconfig'
```
4. Built `fleetctl` from the **fixed** code and ran the same command.
Confirmed the new error message:
```
[!] Unknown label 'this-label-does-not-exist' is referenced by
configuration profile 'test-profile.mobileconfig'
```
### Unit tests added
New file: `cmd/fleetctl/fleetctl/gitops_label_usage_test.go` — two tests
that exercise `getLabelUsage()` directly (no Redis/MySQL needed):
- **`TestGetLabelUsageProfilePathShortened`**: Creates a `GitOps` config
with a macOS profile using a full absolute path and a nonexistent label.
Asserts the label usage entry has the basename (not the full path) and
the type is `"configuration profile"` (not `"MDM Profile"`).
- **`TestGetLabelUsageMultipleLabelKeysError`**: Creates a config with
both `labels_include_all` and `labels_include_any` on the same profile.
Asserts the error contains `"configuration profile"` and the short
filename, and does **not** contain the directory path.
Both tests were verified to **fail on unfixed code** and **pass on the
fix** via a `git stash` round-trip.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced error messages for MDM configuration profile label validation
to display concise filenames instead of full file paths, improving user
experience.
* **Refactor**
* Updated internal label usage tracking to use configuration profile
base filenames for consistency and clarity.
* **Tests**
* Added test coverage for configuration profile path shortening and
error message validation in label key scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- @noahtalerman: For the following quick win:
- https://github.com/fleetdm/fleet/issues/44681
---
Remove the fleet-desktop conditional so the token/device identifier
rotation is started unconditionally. This keeps the device identifier
(e.g. /opt/orbit/identifier) up to date for refetch-host, device auth,
and Fleet Desktop, and defers stopping the rotation as before.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#31421
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Device token rotation is now enabled for all runs, ensuring consistent
behavior across all scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
I guess it's been like 2 years since we updated this
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Revised FAQ on the pricing page to clarify OS management focus.
* Added information about GitOps and infrastructure workshops.
* Updated Fleet history and platform references (Omnissa, Jamf/Intune)
and adjusted audience examples.
* Refined contributor messaging and phrasing throughout the FAQ.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Cursor Darwin application manifest with new version release,
including refreshed installation checksums and deployment files.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Summary
Switches the maintained-apps homebrew script generator from #!/bin/sh to
#!/bin/bash so the declared interpreter matches what the scripts
actually use.
Why
The generated install/uninstall scripts use bash-only constructs
throughout — [[ ... ]], (( ... )), local, eval, indexed/associative
arrays, ${var:1} substring expansion, $EUID, SECONDS — but declared
#!/bin/sh. They've worked in production because macOS's /bin/sh is bash
in POSIX mode, but the shebang was technically inaccurate.
These functions are direct ports of Homebrew's own implementation
(referenced in scripts.go), and Homebrew itself uses bash. Declaring
#!/bin/bash makes the generated scripts match the source they were
ported from and removes a portability lie.
This change is safe because:
- Fleet's shebang validator already accepts /bin/bash
(server/fleet/scripts.go:488)
- Orbit direct-executes scripts with recognized shebangs
(orbit/pkg/scripts/exec_nonwindows.go:31), so the kernel honors
#!/bin/bash
- These scripts only run on macOS, which always ships /bin/bash
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated installer script shell configuration to improve compatibility
and reliability across different system environments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
made this change with Isabell Reedy!
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated application catalog metadata to support newly available
versions for Claude, Google Chrome, Microsoft Office applications,
Visual Studio Code, Notion, Ollama, TeamViewer, Postman, GitKraken, Okta
Verify, Opera, TablePlus, Egnyte, and Datagrip across macOS and Windows
platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com>
- Add redirect for old /abm URL
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Apple Business Manager integration URL paths for consistency.
* Refined UI messaging and guide text in the Apple Business Manager
setup flow.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
**Related issue:** N/A — ad-hoc dark-mode polish (revives fixes from the
closed#43675)
## Summary
- **Error pages (403/404/500)**: replaced hardcoded `#333` body text
with `$core-fleet-black` so the copy adapts to dark mode.
- **Dropdown menu border**: added border to `ActionsDropdown` ONLY in
dark mode (light mode already has a box-shadow which in dark mode is
basically not visible so it's hard to distinguish what's in front and
what's behind when opening a dropdown).
- **Table bottom-right corner**: tables such as UsersTable have the
Actions dropdown in the last cell, and I think this made the
bottom-right corner to be cut because of a missing border-radius on the
inner cell that matches the table's border radius.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
| # | Before | After |
|---|--------|-------|
| Not found page | <img height="700" alt="Screenshot 2026-05-06 at 3 43
44 PM"
src="https://github.com/user-attachments/assets/c52b7bf8-6c5e-4e2e-8635-6f660c59ee90"
/> | <img height="700" alt="Screenshot 2026-05-06 at 3 35 03 PM"
src="https://github.com/user-attachments/assets/e92c324f-92a9-4e5e-a048-ab2b1d3c87a3"
/> |
| Access denied page | <img height="700" alt="Screenshot 2026-05-06 at 3
43 58 PM"
src="https://github.com/user-attachments/assets/9093f51a-e8ce-495b-9820-37ab5a7ff4cf"
/> | <img height="700" alt="Screenshot 2026-05-06 at 3 34 54 PM"
src="https://github.com/user-attachments/assets/3b9fe930-0ba1-4d48-824b-1b2cda713211"
/> |
| ActionsDropdown border + Table bottom corners (*) | <img height="700"
alt="Screenshot 2026-05-06 at 3 46 35 PM"
src="https://github.com/user-attachments/assets/c16b5a52-4746-4603-9f26-92be82f24225"
/> | <img height="700" alt="Screenshot 2026-05-06 at 3 31 33 PM"
src="https://github.com/user-attachments/assets/0a77cc95-40c4-43d2-9c6b-24c81782b275"
/> |
(*) Note that in the Users table, which has the Actions dropdown, the
right bottom corner is cut because the inner element doesn't respect the
table's border radius. Fixed this by adding the same border-radius to
that cell.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed a display issue where data table bottom-right corners were being
cut off, ensuring complete visibility of table content.
* Improved dark mode contrast and readability on error pages (403, 404,
and 500 errors).
* **New Features**
* Added visual borders to dropdown menus for improved clarity and user
interaction feedback.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Cavalry — motion design & animation app available for macOS
(installer/uninstaller supported)
* Added Cavalry app icon to the UI
* Added Canva — popular online graphic design tool available for macOS
* Full installation and uninstallation support provided for both
applications
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed a GitHub account from the maintainer allowlist, preventing it
from triggering automated webhook actions including Slack notifications
and repository management behaviors.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Follow-up to #44390 (BE/FE) and #44550 (GitOps).
Parent story #39016.
## Summary
Accepts `.svg` for organization logo uploads in addition to
PNG/JPEG/WebP, with strict server-side validation since SVGs can carry
scripts.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
https://github.com/user-attachments/assets/318d320e-ff78-41fe-ad3a-55d6dace8dc0
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Organization logos now accept SVG in addition to PNG, JPEG, and WebP.
* Stored SVG logos are re-validated when served.
* **Security**
* Server applies strict SVG sanitization to block scripts, unsafe
elements, event handlers, and unsafe URL schemes.
* SVG logo responses include headers to prevent content-type sniffing
and restrict execution.
* **Tests**
* Added tests covering SVG detection, validation, allowed/rejected
cases, and serving behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
https://github.com/osquery/osquery/releases/tag/5.23.0
PS: I see that the `yara` table was dropped in 5.23.0 in favor of
`yara_file` and `yara_process`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added three new osquery query tables: `process_open_handles`
(Windows), `secureboot_certificates` (Linux), and `yara_events` for
expanded system visibility.
* Added new columns across existing tables to enhance data collection
capabilities.
* **Updates**
* Upgraded osquery to version 5.23.0.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This eases the testing of fleetd updates (to `edge`) on Linux amd64
(from macOS).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Build process now accepts optional CLI configuration parameters
(--update-url, --orbit-channel, --desktop-channel, --osqueryd-channel)
to customize package generation during builds.
* Containerized fleetd services now use a restart policy that keeps
services running unless explicitly stopped, improving reliability and
reducing downtime.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43945
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Configurable option to preserve past host activity history during
Apple Business Manager re-enrollment.
* Re-enrollment can perform a targeted reset of host MDM state and
upcoming activities when preservation is disabled.
* Token-update flow now conditionally triggers the reenrollment reset
based on device/migration state and the preserve flag.
* **Bug Fixes**
* Host vitals and host-scoped data are cleared on ABM re-enrollment when
preservation is disabled.
* Reset is skipped during specific migration scenarios to avoid
disruption.
* **Tests**
* Added tests and mocks validating reset behavior, the preservation
flag, and migration-based skip logic.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds a new "Fleeties to Solution Specialist Slack engagement process
for Leads" section to the sales playbook (`handbook/sales/README.md`)
- Documents the full workflow: acknowledge (≤ 1 hour), respond (by
committed time), and close the loop
- Includes lead documentation requirements and SLA table with timing
expectations for each step
## Changes
This adds a new `##` section to the sales handbook between the existing
Responsibilities processes and the Rituals section. The process covers:
- Scope of applicable Fleetie requests (lead creation, LinkedIn
outreach, target accounts, messaging/outbound strategy)
- Three response paths: Execute, Clarify, or Challenge
- Lead logging requirements in the CEO request lead tracking sheet
(same-day logging)
- SLA table with timing requirements for each step
---
Built for [Chaz
Maclaughlin](https://fleetdm.slack.com/archives/D0AHH0ZEMLY/p1777398826464779?thread_ts=1777384598.397169&cid=D0AHH0ZEMLY)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved error handling for Windows registry enumeration to prevent
failures from malformed entries.
* **Chores**
* Removed debugging symbols from Orbit and Fleet Desktop executables for
optimized builds.
* Updated macadmins/osquery-extension dependency to v1.4.1, adding
network_quality table support.
* Updated Go runtime to version 1.26.2.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Jordan Montgomery