Changes:
- Removed a logo from the logo carousel and added missing logos to the
bottom row of logos on the /customers page, and increased the animation
duration.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Logo carousel updated with new partner logos and reconfigured
ordering: SandboxAQ, Webflow, Abridge, Coinbase, Smarter Technologies,
Treeline, and Grafana Labs.
* **Style**
* Carousel scrolling duration increased for a smoother, more leisurely
horizontal animation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42545
This rework does not significantly improve the worst case performance,
but it does improve some cases (like lower number of hosts with a lot of
profiles).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Performance Improvements**
* Improved batch deletion for Windows MDM configuration profiles to
handle very large-scale cleanup with fewer database updates.
* Replaced per-profile update loops with multi-profile batched updates
to reduce update overhead and improve determinism.
* **Tests**
* Added tests validating multi-profile batch delete behavior and
ensuring each queued delete command is correctly targeted.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42545
Tested in loadtest. `host_orbit_info` and `host_disks` are seeing the
massive skip wins
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Performance**
* Avoids unnecessary database writes when incoming host data already
match stored values, reducing steady-state update volume.
* **Tests**
* Added tests to validate skip-on-no-change behavior, including cases
with small numeric precision differences and idempotency checks.
* **Documentation**
* Added changelog entry describing the reduced-write behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44098
# Details
We set the "secrets" exception on for all new instances (and the label
exception for existing instances), but you can't turn them off in the
free tier. That means GitOps runs (including the one we use to
initialize new instances) would fail with the "you can't use this key
because the exception is on" error. This PR fixes the issue by not
enforcing that rule for free tier instances.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
## Testing
- [X] Added/updated automated tests
- [X] added test verifying that the free tier can run gitops using
excepted keys w/out error, and verified that it fails on main and passes
on this branch
- [X] QA'd all new/changed functionality manually
- [X] spun up a new free-tier server successfully
For unreleased bug fixes in a release candidate, one of:
- [X] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* GitOps exception enforcement no longer blocks free-tier users;
enforcement is applied only for premium licenses, allowing GitOps
applies on free tiers.
* **Tests**
* Added an integration test validating free-tier GitOps behavior to
prevent regressions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for the Zen Browser across the
application, including its metadata, installation scripts, and UI icon.
The changes ensure Zen Browser is now recognized as a maintained app,
can be installed/uninstalled via scripts, and displays its icon in the
frontend.
**Zen Browser Integration**
* Added Zen Browser metadata to the maintained apps input (`zen.json`)
and output (`apps.json`) files, making it available in the maintained
apps list.
[[1]](diffhunk://#diff-1227fd3d4a73fdd49df2d7e2977fc94f56c8fe606a444ae5d995916abbbccdb5R1-R8)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1957-R1963)
* Created a new versioned output file for Zen Browser
(`zen/darwin.json`), including installer and uninstaller scripts,
version information, and download details.
**Frontend/UI Updates**
* Added a new React SVG icon component for Zen Browser (`Zen.tsx`).
* Registered the Zen icon in the icon index and mapped the "zen"
software name to the new icon, enabling its display in the UI.
[[1]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR249)
[[2]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR514)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43228
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Account configuration commands for SSO and managed local admin setup
are no longer sent to iOS and iPadOS devices when end-user
authentication is enabled; these commands are restricted to macOS only.
* **Tests**
* Added an integration test ensuring AccountConfiguration is not
enqueued for iOS/iPadOS enrollments when end-user authentication is
enabled.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Corrected typographical errors in the README file regarding travel and
CEO shadow program instructions.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated version tracking for 24+ applications to enable proper
recognition of latest releases. Supported apps include 1Password, Brave,
Adobe Acrobat Reader, Arc, CLion, Clockify, GoLand, Granola, Microsoft
Office apps, Miro, OBS Studio, Ollama, Opera, PhpStorm, Postman,
ProtonVPN, RubyMine, RustRover, Spotify, WebStorm, and others. Updated
with latest installer URLs and verification checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com>
Add a new macOS report (lib/macos/reports/collect-default-browser.yml)
and enable it in the it-and-security/fleets/workstations.yml reports
list. The report gathers each local user's default web browser by
reading LaunchServices plist entries, runs weekly (interval 604800),
uses snapshot logging, and is observer-runnable. Automations are
disabled by default.
Add Slack logo asset and update Linux package manifests to use the new
release. Adds it-and-security/lib/all/icons/slack-logo.png and updates
slack-deb.yml and slack-rpm.yml to bump the Slack desktop version to
4.49.81 and include an icon.path reference.
- Add details on the Identity field, stating that it may not be
required, and that Fleet variables aren't supported yet.
- Clarify which cert to use for the X509 field.
---------
Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
Moved 'and' before 'recurring rituals' to correct typo
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Clarify the consequences of deleting a host from Fleet, emphasizing the
removal of labels and prevention of pending activity.
Story that will change this:
- https://github.com/fleetdm/fleet/issues/28933
I've included the developer options instructions here, because when I
started testing on Android I believe this was required. But while
testing on a device after a factory reset, I didn't need to enable
developer options.
…form SSO guide
Four fixes to the Deploying Platform SSO with Okta and Fleet guide:
1. Clarified that Fleet's automatic certificate renewal via
$FLEET_VAR_SCEP_RENEWAL_ID works for dynamic Okta SCEP (where Fleet acts
as a proxy) but not for static challenges, which require manual
redeployment before expiry.
2. Updated the Option 1 Important note to reflect that renewal is
automatic when $FLEET_VAR_SCEP_RENEWAL_ID is in the OU field.
3. Updated the Option 1 osquery policy threshold from 14 to 30 days to
align with Fleet's automatic renewal window, so failed renewals are
caught immediately rather than 16 days late.
4. Fixed Option 2 SQL code block where the Important text was
accidentally placed inside the opening ```sql fence, breaking the
article layout. Also updated the Certificate Expiration Notification in
Option 1 from 14 to 30 days for consistency.
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Resolves#43671.
Bumps the Alpine base image from 3.23.3 to 3.23.4 in the Dockerfiles
that produce published images, picking up patched openssl, musl, and
zlib packages. Follows the same pattern as #38977.
### CVEs resolved
- HIGH: CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31790,
CVE-2026-2673, CVE-2026-40200
- MEDIUM: CVE-2026-27171, CVE-2026-6042, CVE-2026-22184
### Test plan
- CI image build passes.
- Trivy/ECR scan on the resulting fleetdm/fleet image confirms the nine
listed CVEs are gone.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Docker base images to Alpine 3.23.4 across infrastructure and
deployment components for improved stability and security.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** For #43769
# Details
This PR adds "Hosts active" and "Hosts enrolled" charts to the
dashboard.
New components:
* **ChartCard.tsx**: encapsulates a visualization-agnostic chart, for
data provided by the new `/charts` endpoint created in
https://github.com/fleetdm/fleet/pull/43910
* **ChartFilterModal.tsx**: modal for setting filters on a chart.
Currently supports filtering by label, platform and individual host.
* **CheckerboardViz.tsx**: a checkerboard visualization for use in
ChartCard. Capable of charting 1, 7, 14 or 30 days at a time, although
only 30 day charts are used right now. Bespoke rendering using SVG,
since recharts scatterchart was harder to wrangle than it was worth.
* **LineChartViz.tsx**: a line-chart visualization using Recharts
* **HostsEnrolledCard.tsx**: a bar chart of enrolled hosts using
Recharts
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- With backend provided by https://github.com/fleetdm/fleet/pull/43910:
<img width="1426" height="428" alt="image"
src="https://github.com/user-attachments/assets/0f53b9d1-c87b-4225-a175-2d40af5afe41"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Dashboard now shows interactive "Hosts active" (line/heatmap) and
"Hosts enrolled" (bar) charts with metric selection, filter modal
(labels/platforms/hosts), legends, tooltips, and responsive layout.
* **Tests**
* Added comprehensive tests covering chart rendering, checkerboard
heatmap, and no-data states.
* **Chores**
* Added charting library dependency to support visualizations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/44086
Changes:
- Updated windows settings in the configuration builder page script to:
- fix duplicate tooltip and unique slug values
- fix incorrect settingTarget values
- fix incorrect values set for two settings
- Fixed two duplicate tooltip values of Android settings.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected Device Lock policy behavior for lock screen camera and
password complexity handling
* Fixed Windows Update behaviors for insider builds, feature-branch
readiness, pause quality updates, and active hours
* Updated device naming so only replacement-style changes are allowed
* **Documentation**
* Revised tooltip text and UI copy for SmartScreen, firewall messages,
and two Android policies to reflect actual policy meanings
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#33557
The tems.name column uses utf8mb4_unicode_ci, so names like "ABC" and
"abc" compare as equal at the database level. Before this change name
collisions were handled in different ways in the UI and in GitOps.
The changes introduced here, consolidates the logic used for detecting
name collisions in all code path. All conflicts return 409 with the
canonical copy "Fleet names must differ by at least one non-special
character (case-insensitive).
Closes: https://github.com/fleetdm/fleet/issues/44066
Changes:
- updated the `update-or-create-contact-and-account` helper to:
- Save potential duplicate contacts with placeholder name values (`?
?`).
- Use the firstName and lastName values returned by the get-enriched
helper if a name is not provided.
- Update contacts with placeholder name values if a name is provided.
- Removed a domain from the lists of banned email domains.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced Salesforce contact creation with automatic name derivation
from enrichment data.
* Improved duplicate detection allowing new contacts to be created with
flexible matching rules.
* Automatic replacement of placeholder names with verified data during
contact updates.
* **Chores**
* Updated email domain blocklists configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#35171
# macOS 15 CIS benchmark v1.1.0 → v2.0.0 change set
## Policy changes
| CIS ID | Policy name (new) | Change type | Effect |
|---|---|---|---|
| 1.1 | CIS - Ensure Apple-provided Software Updates Are Installed
(Fleetd Required) | Modified | Renamed from "Ensure All Apple-provided
Software Is Current"; resolution expanded with terminal `softwareupdate
-i -a` method; `cis_id` added. Query unchanged (still uses fleetd's
`software_update` table). |
| 1.6 | CIS - Ensure Software Update Deferment Is Less Than or Equal to
30 Days (MDM Required) | Modified | Added Apple-deprecation note to
description; `cis_id` added. Query unchanged. |
| 1.7 | CIS - Ensure XProtect Is Running and Updated | Removed | Deleted
— v2.0.0 removed 1.7 from the numbered benchmark and moved it to
Supplemental section 7.4. Per authoring outline, Fleet does not track
section 7+ recommendations. |
| 2.1.1.1 | CIS - Ensure iCloud Passwords & Keychain is enabled/disabled
(MDM Required) | Modified | Renamed from "iCloud Keychain" to match
v2.0.0's "Audit iCloud Passwords & Keychain"; Description, Rationale,
and Impact Statement updated from the new PDF; `cis_id` added to both
enable/disable variants. Query unchanged (`allowCloudKeychainSync` key
is the same). |
| 2.3.1.1 | CIS - Ensure AirDrop Is Disabled (MDM Required) | Modified |
Added note to resolution stating AirDrop can only be toggled via
configuration profile; `cis_id` added. Query unchanged. |
| 2.3.3.4 | CIS - Ensure Remote Login Is Disabled | Modified |
Description rewritten to match v2.0.0 text; terminal remediation
(`systemsetup -setremotelogin off`) added to resolution; `cis_id` added.
Query unchanged (still checks `disabled.plist`). |
| 2.6.3.1, 2.6.3.2, 2.6.3.3, 2.6.3.4 | CIS - Ensure Sending Diagnostic
and Usage Data to Apple Is Disabled (MDM Required) | Modified | **Query
change**: Siri Data Sharing Opt-In Status check moved from
`com.apple.applicationaccess` → `com.apple.assistant.support` domain to
track v2.0.0's new PayloadType; `cis_id` added (combined). |
| 2.4.1 | CIS - Ensure Show Wi-Fi status in Menu Bar Is Enabled (MDM
Required) | Removed | Deleted — recommendation removed in v2.0.0. |
| 2.4.2 | CIS - Ensure Show Bluetooth Status in Menu Bar Is Enabled (MDM
Required) | Removed | Deleted — recommendation removed in v2.0.0
(replaced by Manual 2.4.1 "Audit Menu Bar and Control Center Icons"). |
| 6.1.1 | CIS - Ensure Show All Filename Extensions Setting is Enabled |
Removed | Deleted — recommendation downgraded to Manual in v2.0.0. |
Policy count: 113 → 109.
## Test artifacts added
| Target CIS ID | File | Type | Notes |
|---|---|---|---|
| 2.3.3.4 | `ee/cis/macos-15/test/scripts/CIS_2.3.3.4_pass.sh` | pass
script | `systemsetup -setremotelogin off` |
| 2.3.3.4 | `ee/cis/macos-15/test/scripts/CIS_2.3.3.4_fail.sh` | fail
script | `systemsetup -setremotelogin on` |
| 1.6 | `ee/cis/macos-15/test/profiles/1.6.mobileconfig` | MDM profile |
Sets `enforcedSoftwareUpdateDelay=30`,
`forceDelayedSoftwareUpdates=true` |
| 2.3.1.1 | `ee/cis/macos-15/test/profiles/2.3.1.1.mobileconfig` | MDM
profile | Sets `allowAirDrop=false` |
| 2.6.3.2 | `ee/cis/macos-15/test/profiles/2.6.3.2.mobileconfig` | MDM
profile | Four payloads covering the combined Fleet query: Siri opt-in
(new v2.0.0 domain), AutoSubmit, allowDiagnosticSubmission,
AXSAudioDonationSiriImprovementEnabled |
No test added for 1.1 — query depends on live OS update state (fleetd
`software_update` table) and cannot be toggled by a script or profile.
No test added for 2.1.1.1 — it is an org-decision Audit recommendation
(Fleet ships both enable and disable variants); one of the two policies
fails by construction regardless of system state.
## Documentation updates
| File | Change |
|---|---|
| `ee/cis/macos-15/README.md` | Benchmark version bumped v1.1.0 →
v2.0.0. Limitations list renumbered to v2.0.0 section numbers; added
2.4.1 (new "Audit Menu Bar and Control Center Icons") and 6.1.1 (now
Manual "Audit Show All Filename Extensions"). Org-decision entry renamed
from "Audit iCloud Keychain" to "Audit iCloud Passwords & Keychain" to
match v2.0.0 terminology. |
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42948
- Updated `(mos *MacOSSetup) Validate()` and `(mos *MacOSSetup)
SetDefaultsIfNeeded()` to account for new fields
- Updated default creation and editing for team edit/creation paths
- Updated `generate-gitops` warning message from `macos_setup` to
`setup_experience`
- Updated fields types to optjson and updated test files
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- Team edit and team creation through GitOps, validated config with `
curl -k -X GET 'https://localhost:8080/api/v1/fleet/fleets/:id'`
- New error message says `setup_experience` instead of `macos_setup`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added macOS MDM settings to control local account behavior: enable
managed local accounts (default false) and specify end-user local
account type (default "admin") for fleet and team configs. GitOps output
now highlights unsupported setup-experience cases.
* **Tests**
* Updated fixtures and integration tests to assert and persist the new
macOS local-account settings across config, team, and GitOps scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Luke Heath