<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42473
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
With image URL set:
<img width="598" height="476" alt="Screenshot 2026-06-29 at 1 48 45 PM"
src="https://github.com/user-attachments/assets/9e10c92d-57ce-448e-94c8-01cf852550a9"
/>
Without image:
<img width="598" height="507" alt="Screenshot 2026-06-29 at 1 49 13 PM"
src="https://github.com/user-attachments/assets/782324e9-ffd3-459f-85ea-6bece16b8ce5"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Prevented SSO sign-in button text from overflowing by standardizing
the visible label to **“Sign in with SSO”**.
* Show the configured identity provider name in a **hover tooltip**,
instead of altering the button label.
* Improved SSO button/tooltip layout and spacing, including refined icon
spacing and better button sizing within the tooltip.
* **Tests**
* Updated LoginForm focus assertions to match the revised SSO button
labeling and accessibility name.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Updated the query tab on the report details page to say "Query"
instead of report, and updated the link to the reports guide to not say
queries.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Corrected the “learn more” link text so report guidance now points to
the reports guide.
* Updated the visible label in the SQL tab area to show “Query” for
clearer wording.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Update the best practice is to create an API-only user w/ the admin
role and access only to necessary SCIM API endpoints
- These doc updates require [this
bug](https://github.com/fleetdm/fleet/issues/48062) to be fixed because
the `/scim/*` API endpoints aren't exposed as API endpoints one can pick
when creating an API only user
- Document the `/scim/*` API endpoints
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added SCIM API endpoints for managing users and groups.
* Supported actions include listing, creating, viewing, replacing,
updating, and deleting SCIM users and groups.
* Added read-only endpoints for SCIM schemas, service provider
configuration, and resource types.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Changes:
- Updated the website's build-static-content script to use download URLs
from the next latest released version of Fleet when the latest release
does not contain installers for a platform in its release assets.
- Reduced the length of the description meta tag value in the "Block and
monitor EDR Freeze on macOS with Santa and Fleet" article
- Updated the labels values for two engineering rituals (The old label
was removed from the GH repo)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Improved resilience when generating fleetctl download links if the
latest GitHub release is missing one or more required platform installer
assets.
* The system now looks for the most recent release that contains the
complete installer set, warns for any missing platform, and fails only
if no complete set is available.
* **Documentation**
* Updated labels for two Apple-related engineering rituals to use the
correct label.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated app release metadata for multiple macOS and Windows apps so
users get the latest available installers.
* Bumped versions for Bezel, ClipBook, Cryptomator, Downie, DuckDuckGo,
Genesys Cloud, MacWhisper, Miro, Nextcloud, Notepad.exe, Opera, Proton
Drive, Reqable, WhatsApp, and Wins.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
## Summary
**QA / load-test tooling** for the Google Workspace IdP integration —
lets QA exercise the real sync path at scale without a Google Workspace
tenant.
- **`tools/gw-directory-fake`** — a standalone fake of the Google Admin
SDK Directory API (not production code):
- `generate` — writes an editable JSON fixture (`-users`, `-groups`,
`-members-per-group`, `-domain`).
- `serve` — serves users/groups/members with real pagination from the
fixture, **hot-reloading** the file on change (poll modtime), plus
`-latency` / `-error-rate` (429/503) knobs. Responses are built from the
real `directory` SDK structs so the schema can't drift.
- **Fleet-side seam** (`ee/server/googleworkspace/google_workspace.go`):
- honors `token_uri` from the service-account JSON (falls back to
Google's endpoint),
- `FLEET_TEST_GOOGLE_WORKSPACE_ENDPOINT` redirects the Directory API
base to the fake (logs a warning each sync; never set in production),
- `seam_test.go` proves the loop end to end (JWT token exchange +
paginated Directory calls against a local fake over plain HTTP).
### QA workflow
```
go run ./tools/gw-directory-fake generate -users 50000 -groups 2000 -domain qa.example.com -out fixture.json
go run ./tools/gw-directory-fake serve -fixture fixture.json -addr :8091
```
Set `FLEET_TEST_GOOGLE_WORKSPACE_ENDPOINT=http://<host>:8091` on Fleet
and configure the integration with a throwaway service-account JSON
whose `token_uri` is `http://<host>:8091/token`. Edit `fixture.json`
anytime to change directory state mid-test.
> 🥞 **Stacked PR.** Base: `42915-gw-idp-vitals-5-frontend` (top of the
feature code stack, #48168).
**Related issue:** Resolves#42915
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Google Workspace directory access now supports custom OAuth token
endpoints and a configurable API base endpoint for testing and special
environments.
* Added a local fake Google Workspace Directory server tool for
generating sample data and serving directory responses, including
pagination and optional fault injection.
* **Bug Fixes**
* Improved handling for Google Workspace API calls when alternate
endpoints are required.
* **Tests**
* Added coverage for overriding the Google Workspace directory endpoint.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** NA — Claude Code config maintenance
## What changed
Tidies the shared `.claude/` config for accuracy and leaner startup
context:
- **README:** synced the Skills reference to all 24 skills (was
documenting 12); fixed the stale "~2,500 tokens at startup" claim;
flagged external deps (`release-retro` needs Slack MCP, `new-endpoint`
is user-invoked only); documents skill versions only.
- **CLAUDE.md:** removed Go/API pattern bullets that duplicate the
path-scoped rules
(`fleet-go-backend.md`, `fleet-api.md`), which already auto-load on
`.go` edits. Replaced with a one-line pointer (~200 fewer startup
tokens).
- **Removed 4 dead root-level hook scripts** (`.claude/goimports.sh`,
`guard-dangerous-commands.sh`, `lint-on-save.sh`,
`prettier-frontend.sh`) — unreferenced duplicates of the live
`.claude/hooks/*.sh` copies that settings.json actually runs.
No behavior change to skills, hooks, permissions, rules, or agents.
## Testing
- [x] Verified hooks still wired to `.claude/hooks/*.sh` (4 references,
4 files present)
- [x] Confirmed all 24 skills still load (`/context`) and README table
matches `ls .claude/skills/`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* ~Removed several automatic formatting, linting, and command-safety
hooks from the development workflow.~
* ~File edits will no longer be automatically reformatted or linted
after tool use.~
* ~Some previously blocked risky shell and Git commands are no longer
intercepted by these hooks.~
(These three points are inaccurate. They're still invoked as hooks, the
files in the root of the `.claude/` directory were redundant.)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the container build process for the migration proxy so the
binary is built during image creation.
* Adjusted the runtime image packaging to copy the generated executable
from the build output location while keeping runtime behavior unchanged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
### 🥞 Stack (review/merge bottom-up)
1. #48164 — Activity types (FE+BE)
2. #48165 — Backend (cron + directory sync)
3. #48166 — Usage statistics
4. #48167 — fleetctl generate-gitops
5. **#48168 — Settings UI ⬅ this PR**
📄 Documentation is tracked separately in #48169 (targets
`docs-v4.89.0`).
---
## Summary
**PR 5 of 6.** **Settings UI**: the Google Workspace section in the IdP
providers card (`GoogleWorkspaceSection/`), interfaces, config mock, and
mutual-exclusion messaging with SCIM. Uses the new `notify` toast API.
> 🥞 **Stacked PR.** Base: `42915-gw-idp-vitals-4-gitops` (PR 4).
**Related issue:** Resolves#42915
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a Google Workspace identity provider configuration section in
the Integrations area (domain, admin impersonation email, and API key
JSON).
* Added premium-tier gating so non-premium users see the upgrade message
and do not see the Google Workspace section.
* **Bug Fixes**
* Improved Google Workspace form validation and submission, including
safe masking of the saved API key JSON and proper disconnect when
clearing all fields.
* **Tests**
* Added tests covering premium visibility, Google Workspace rendering,
pre-filled configuration, and masked API key behavior.
* **Style**
* Updated Identity Providers and Google Workspace section layout styling
for consistent spacing and sizing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
### 🥞 Stack (review/merge bottom-up)
1. #48164 — Activity types (FE+BE)
2. #48165 — Backend (cron + directory sync)
3. #48166 — Usage statistics
4. **#48167 — fleetctl generate-gitops ⬅ this PR**
5. #48168 — Settings UI
📄 Documentation is tracked separately in #48169 (targets
`docs-v4.89.0`).
---
## Summary
**PR 4 of 6.** **GitOps / fleetctl**: `fleetctl generate-gitops` support
for the Google Workspace integration, redacting `api_key_json` with a
TODO + secret warning, plus updated golden testdata.
> 🥞 **Stacked PR.** Base: `42915-gw-idp-vitals-3-statistics` (PR 3).
**Related issue:** Resolves#42915
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* GitOps now supports Google Workspace settings in organization
configuration output.
* **Bug Fixes**
* Free-tier accounts no longer include Google Workspace settings in
global GitOps output.
* Sensitive Google Workspace API key content is now replaced with a
placeholder in generated GitOps files, with a warning recorded.
* GitOps applies a clear state when Google Workspace settings are
omitted or left empty.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#44629
This folds the connected-to-Fleet check into `GetHostMDM` via a
`connected_to_fleet` column that mirrors the existing
`IsHostConnectedToFleetMDM` and `hostMDMSelect` conditions, and derives
the value in `GetOrbitConfig` from the `host_mdm` data it already
fetches. Result: **2 queries → 1** on the orbit check-in hot path, with
no semantic change.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Performance Improvements**
* Orbit check-ins now determine MDM connection status from existing host
MDM data, reducing database work and improving response time.
* **Bug Fixes**
* Added platform-aware connection detection so Windows, Apple, and
Android devices report MDM connectivity more accurately.
* Updated related checks and tests to keep connection status consistent
across enrollment and unenrollment changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This article explains how to block and monitor EDR Freeze on macOS using
Santa 2026.3 and Fleet. It covers the functionality of EDR Freeze, the
implementation of AntiSuspendSigningIDs, and how to utilize Fleet's
Santa osquery tables for monitoring.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
**Related issue:** Resolves#42797
Adds support for pre-install query, post-install script, and uninstall
script on script-only packages (`.sh` and `.ps1`) across the API, UI,
and GitOps; previously these were silently stripped. The install script
remains the uploaded file's contents (file-driven) and is shown
read-only. Automatic install stays unsupported for script-only packages.
- **API** (`POST`/`PATCH /software/package`): stop stripping the fields;
validate post-install and uninstall scripts for script packages
- **GitOps**: allow
`uninstall_script`/`post_install_script`/`pre_install_query` paths
inline in the team YAML for script-only packages
- **UI**: show advanced options for `.sh`/`.ps1`; install script shown
read-only
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Script-only packages (`.sh`/`.ps1`) now expose advanced
options—pre-install query, post-install script, and uninstall
script—consistently across the UI, REST API, and GitOps.
* Script-only packages display advanced options in the UI, and the
“Install script” editor can be made read-only where appropriate.
* **Bug Fixes**
* Preserved advanced option values for script-only packages during
upload, edits, and synchronization (including replace-file scenarios).
* Improved YAML generation and validation so supported fields are
included while unsupported ones are correctly rejected/omitted.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
### 🥞 Stack (review/merge bottom-up)
1. #48164 — Activity types (FE+BE)
2. #48165 — Backend (cron + directory sync)
3. **#48166 — Usage statistics ⬅ this PR**
4. #48167 — fleetctl generate-gitops
5. #48168 — Settings UI
📄 Documentation is tracked separately in #48169 (targets
`docs-v4.89.0`).
---
## Summary
**PR 3 of 6.** **Usage statistics**: report whether a Google Workspace
IdP integration is configured via the new `googleWorkspaceConfigured`
field (`server/fleet/statistics.go`,
`server/datastore/mysql/statistics.go`).
> 🥞 **Stacked PR.** Base: `42915-gw-idp-vitals-2-backend` (PR 2).
**Related issue:** Resolves#42915
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Usage statistics now include whether Google Workspace is configured,
improving reporting accuracy.
* **Bug Fixes**
* Fixed statistics submissions so the Google Workspace configuration
status is included consistently in outgoing requests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
### 🥞 Stack (review/merge bottom-up)
1. #48164 — Activity types (FE+BE)
2. **#48165 — Backend (cron + directory sync) ⬅ this PR**
3. #48166 — Usage statistics
4. #48167 — fleetctl generate-gitops
5. #48168 — Settings UI
📄 Documentation is tracked separately in #48169 (targets
`docs-v4.89.0`).
---
## Summary
**PR 2 of 6.** Core **backend** for the Google Workspace IdP
integration:
- Directory sync client (`ee/server/googleworkspace/`) and cron job
(`server/cron/google_workspace_cron.go`) reusing the `scim_*` tables
(Google Workspace and SCIM are mutually exclusive).
- Config types + validation (`server/fleet/google_workspace.go`,
`app.go`, `integrations.go`), appconfig handling + activity emission
(`server/service/appconfig.go`), cron registration and schedule.
- SCIM is ignored while Google Workspace is configured
(`ee/server/scim/scim.go`).
> 🥞 **Stacked PR.** Base: `42915-gw-idp-vitals-1-activities` (PR 1) —
review/merge that first.
**Related issue:** Resolves#42915
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Google Workspace integration support for syncing users, groups,
and host-related identity data.
* Added a scheduled sync that keeps directory data up to date
automatically.
* Added support for configuring Google Workspace in app settings, with
validation and masking of sensitive credentials.
* **Bug Fixes**
* Prevented SCIM provisioning from overwriting data when Google
Workspace sync is configured.
* Preserved existing Google Workspace credentials when an update omits
masked API key values.
* Added handling for deleted users and group membership changes during
sync.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Document the scenarios for load testing Windows MDM at scale.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44188
**Related issue:** N/A (security hardening)
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Summary
Added network-level validation for outbound HTTP requests made by Fleet
integrations (webhooks, SSO, Jira, Zendesk, certificate authorities,
etc.) to prevent requests to unintended destinations. Includes a
configuration option for environments that require connectivity to
private network addresses.
Also fixes a pre-existing nil pointer panic in Jira retry logic and
ensures all HTTP clients use the validated transport.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Unit and integration tests cover validation logic, boundary conditions,
and multiple configuration modes.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
### 🥞 Stack (review/merge bottom-up)
1. **#48164 — Activity types (FE+BE) ⬅ this PR**
2. #48165 — Backend (cron + directory sync)
3. #48166 — Usage statistics
4. #48167 — fleetctl generate-gitops
5. #48168 — Settings UI
📄 Documentation is tracked separately in #48169 (targets
`docs-v4.89.0`).
---
## Summary
**PR 1 of 6** — splits the Google Workspace IdP host-vitals feature into
a reviewable stack.
Adds the **activity types** for the Google Workspace integration,
frontend and backend:
- Backend: `added_google_workspace_integration`,
`edited_google_workspace_integration`,
`deleted_google_workspace_integration` (`server/fleet/activities.go`).
- Frontend: activity-feed rendering for those three types (`activity.ts`
enum + display names + `domain` detail; `GlobalActivityItem.tsx`
templates).
> 🥞 **Stacked PR.** Base: `main`.
**Related issue:** Resolves#42915
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for new Google Workspace integration activity entries:
added, edited, and deleted.
* Activity feeds now display the integration domain when available.
* New filter labels were added for these activity types.
* **Bug Fixes**
* Activity details now render Google Workspace integration events
correctly in the dashboard feed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
I have a Fleet-provided external HDD that I use to permanently store VMs
and OS installers for testing.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Expanded the list of Mac hosts allowed for external storage access
under the relevant label, enabling read-write use on an additional
machine.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Fixes#46643
BaseClient.URL() built request paths as `URLPrefix + path`, overwriting
any path already present in BaseURL. Orbit and Fleet Desktop parse the
full fleet URL (subpath included) into BaseURL and pass an empty
URLPrefix, so the subpath was discarded and every API call 404'd when
Fleet was deployed at https://host/subpath. Preserve BaseURL.Path as a
prefix on each request. fleetctl is unaffected since it carries the
subpath in URLPrefix with an empty BaseURL.Path, and non-subpath
deployments are unchanged.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed API request URL construction for deployments hosted under a
subpath, preventing broken requests and 404 errors.
* Preserved query parameters when generating request URLs.
* Improved resolution of request paths with and without a leading slash
when combined with a base URL subpath.
* **Documentation**
* Added clearer guidance on how base URL subpaths and additional path
prefixes are combined.
* **Tests**
* Expanded URL-generation coverage to verify correct behavior across
subpath and prefix combinations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the Reqable Windows package entry to version 3.2.0.
* Switched the download reference to the latest 3.2.0 release artifact.
* Refreshed the package checksum to match the new release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47947
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed GitOps generation for script-only packages added by path so it
no longer creates invalid output files.
* Script package entries now use cleaner comments, while regular
packages still show version details.
* Placeholder `script://` installer URLs are now cleared properly and
won’t remain stored after processing.
* **Tests**
* Added coverage for script package comment formatting and for clearing
placeholder installer URLs during GitOps workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#42441
Store queries that target at most
redis.live_query_small_target_threshold hosts (default 1000) in a
per-host reverse index instead instead of a per-query bitfield indexed
by host ID.
Setting the threshold to 0 disables the reverse index (no query has <= 0
targets), serving as the kill-switch.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A — internal release-QA issue template update
## Description
Updates the **Release QA** issue template
(`.github/ISSUE_TEMPLATE/release-qa.md`) to match the format already
used by the **Release QA - fleetd** template:
- Adds a **"How to check off"** note explaining that testers tick the
per-section **Progress** checkboxes (so GitHub shows the "X of Y tasks"
tracker), and record failures under **Notes**.
- Adds a **Progress** checkbox list before each section table
(Orchestration, MDM, Power to PC, Software, Security & Compliance, All
product groups).
- Drops the **pass/fail** column from every table (now 3 columns: Test
name / Step instructions / Expected result) and removes the `$Name`
placeholder example row.
- Splits the single **Load tests** entry into **Baseline loadtest** and
**Migration loadtest** rows (and matching checkboxes), and reworks both
around the `tools/loadtest/metrics/` tooling (see below).
No code or product behavior changes — issue template only.
## New load test flow
Both load tests now use the `tools/loadtest/metrics/` scripts —
[`collect-metrics.sh`](https://github.com/fleetdm/fleet/blob/main/tools/loadtest/metrics/collect-metrics.sh)
(pulls CloudWatch metrics into a `.json` data file + `.md` synopsis) and
[`compare-metrics.sh`](https://github.com/fleetdm/fleet/blob/main/tools/loadtest/metrics/compare-metrics.sh)
(diffs two runs and flags deltas `ok` / `WARN` / `ALERT`). Condition of
satisfaction for each: collect → compare → post the comparison as an
issue comment → open a PR with the run artifacts and record results in
the metrics spreadsheet.
**Baseline loadtest** (compared against the previous release, n-1):
1. Stand up a fresh RC environment (new instance, no data) and run it
~24h.
2. Collect metrics under the `baseline` category.
3. Compare against the previous release (n-1); post the comparison as an
issue comment — deltas should be `ok`.
4. Open a PR with the run artifacts (`.json` + `.md`) under
`runs/baseline/<workspace>/` and record metrics in the spreadsheet.
**Migration loadtest** (compared before vs. after the migration):
1. Run a load test on the previous minor release (n-1); right before
migrating, collect the last 2h.
2. Migrate the environment to the RC (n).
3. Wait ~2h, then collect the past 2h (symmetric window for an
apples-to-apples diff).
4. Compare post-migration vs. pre-migration; post the comparison as an
issue comment — deltas should be `ok`.
5. Open a PR with the run artifacts under `runs/migration/<workspace>/`
and record metrics in the spreadsheet.
Example result PRs this flow produces: fleetdm/fleet#47794 (baseline),
fleetdm/fleet#47803 (migration).
# Checklist for submitter
- [ ] QA'd all new/changed functionality manually
**Related issue:** Resolves#48368
# Before / After
- Before: "Old tooltip for Windows/Linux"
<img width="591" height="278" alt="image"
src="https://github.com/user-attachments/assets/c413c8a0-4c3b-489c-a046-c65d03452c44"
/>
- After: "Updated tooltip for Windows/Linux"
<img width="629" height="283" alt="image"
src="https://github.com/user-attachments/assets/b9e99430-5d63-470d-801e-2d4c060c112d"
/>
- for Mac and Apple-related OS stays unchanged.
<img width="583" height="273" alt="Screenshot 2026-06-28 at 5 52 50 PM"
src="https://github.com/user-attachments/assets/cac7990d-6212-4b69-9467-73d6a3f7d733"
/>
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the “installed during setup” tooltip to clarify installation
order rules.
* The tooltip now specifies ordering by software name (0–9, then A–Z).
* Added clearer policy sequencing: software without an install policy is
installed before software with a policy.
* Android setup messaging remains unchanged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a queryable `socket_path` field for containerd-related data,
with a safe default for existing setups.
* Improved resilience by automatically recovering when a startup binary
is found to be corrupt.
* **Bug Fixes**
* macOS detail queries now handle app bundles with missing executables
more gracefully.
* Reduced issues caused by repeated startup failures and improved
overall stability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Bumped several maintained app entries to newer releases, including
Cursor for macOS and Windows, Proxyman for macOS, and Stats for macOS.
* Refreshed associated download links and checksums so installs and
update checks point to the latest available versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Refreshed maintained app entries for several Windows and macOS apps to
their latest releases.
* Updated version checks, download links, and checksums so installs and
update detection reflect the newer builds.
* Included version bumps for Comet, Marked, Notepad, Only Switch, and
Spokenly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated macOS installer metadata for Antigravity, ChatGPT Desktop,
DevKnife, jamovi, Marked, Netron, OpenAudible, and Workflowy to newer
versions.
* Refreshed download links and checksums so installs and updates use the
latest available release files.
* Improved ChatGPT Desktop cleanup behavior during removal for a more
complete uninstall.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated installer metadata for multiple maintained apps on macOS and
Windows, including Claude, Clop, Codex, LookAway, Ocenaudio, Ollama,
Shotcut, Spyder, Teleport Connect, Teleport Suite, and Zen Browser.
* Added newer release versions for several apps, so package listings now
reflect the latest available downloads.
* **Bug Fixes**
* Refreshed download links and checksum values to match the updated
installer packages.
* Improved version checks so installed apps are compared against the
correct current release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Add targeted styling for `p a[purpose='cta-button']` in basic article
pages so markdown-authored CTA links render as branded Fleet buttons. It
reuses the existing `.cta-button()` mixin while overriding layout
details (inline-flex, fit-content width, padding, spacing, and hover
text decoration) so the button sizes to its label and fits article flow.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Improved the appearance of inline “Green Fleet” call-to-action links
in article content.
* Buttons now display inline, size more naturally with the text, and
have updated spacing for better readability.
* Hover behavior has been kept clean by preventing unwanted text
decoration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated maintained app definitions so installs and update checks
recognize the latest releases for Arc, Brave, Claude, Dockside, eM
Client, Fantastical, Figma, Funter, Gather, Microsoft Edge, Ocenaudio,
Ollama, P4V, Quip, R for Windows, Tuple, and Warp.
* Refreshed download links and package checksums to match the newest
installers, improving update reliability across macOS and Windows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Dante Catalfamo