## Summary
- Replace "See Fleet in action" video buttons (with play icon and "3
mins" label) on `/device-management` and `/linux-management` with "Join
a workshop" `<animated-arrow-button>` linking to `/gitops-workshop`
- Matches the homepage hero secondary CTA style established in #45122
for `/replace-jamf`
## Changes
- `website/views/pages/device-management.ejs` — replaced video-button
CTA with animated-arrow-button
- `website/views/pages/landing-pages/linux-management.ejs` — replaced
video-button CTA with animated-arrow-button
## Notes
Searched the entire website codebase for all instances. Only
`/device-management` and `/linux-management` had the matching "See Fleet
in action" video modal CTA pattern. Other uses of `clickOpenVideoModal`
(transparency page's "Why is Fleet on my computer?", calendar banner,
customer testimonials) are different CTAs and were left unchanged.
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1778477147893939?thread_ts=1778225078.313209&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Replace the "See Fleet in action" video button (with "3 mins" duration
label) on the `/replace-jamf` hero section with an
`<animated-arrow-button>` linking to `/gitops-workshop` with the text
"Join a workshop"
- This matches the homepage hero's secondary CTA styling, text, and link
## Changes
**`website/views/pages/landing-pages/replace-jamf.ejs`**
Before:
```html
<a purpose="video-button" @click="clickOpenVideoModal('fleet-in-three-minutes')">
<img alt="Play" class="d-inline" src="/images/icon-play-video-32x32@2x.png">
See Fleet in action <span>3 mins</span>
</a>
```
After:
```html
<animated-arrow-button href="/gitops-workshop">Join a workshop</animated-arrow-button>
```
This aligns the `/replace-jamf` page CTA with the homepage hero's
secondary CTA pattern.
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1778476868031439?thread_ts=1778225078.313209&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Renames the "Resources / blog" navigation item in the website header
to "Releases / news"
- Changes the link destination from `/articles` to `/releases`
- Updates both desktop and mobile nav occurrences in
`website/views/layouts/layout.ejs`
## Changes
In `website/views/layouts/layout.ejs`:
- Updated `data-dropdown-option` attribute from "Resources / blog" to
"Releases / news"
- Updated `href` from "/articles" to "/releases"
- Updated `alt` text on the icon image
- Updated the visible label text
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1778476577694689?thread_ts=1778225078.313209&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Cursor for macOS and Windows to version 3.3.30 with new
installer URLs and verification checksums.
* Updated Draw.io Desktop for macOS to version 30.0.0.
* Updated OrbStack for macOS to version 2.1.3.
* Refreshed package metadata and installation queries for all updated
applications.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45120)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44286
Unset `patch_software_title_id` rather than deleting the policy in
`BatchSetSoftwareInstallers`, so the orphaned policy gets picked up by
the `policiesToDelete` loop in `server/service/client.go:3121`. As a
result, the `deleted_policy` activity is now created properly, and
gitops dry/real runs also report the deletion:
```
dry run:
[-] would've deleted policy macOS - 010 Editor up to date
[-] would've deleted 1 policy
real run:
[-] deleting policy macOS - 010 Editor up to date
[-] deleting 1 policy
[-] deleted 1 policy
```
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed missing deletion activity logs when patch policies are removed
via GitOps so policy deletion events are now recorded.
* **Behavior Changes**
* Batch-updating installers now retains obsolete patch policies but
clears their patch installer reference instead of deleting the policy.
* **Tests**
* Added integration coverage to verify deletion activities are emitted
and installer batch behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adding a new webpage on-premise and the menu navigation button using
Claude
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Introduced "On-premise" landing page with deployment details, feature
highlights, comparison tables, and customer testimonials
* Added "On-premise" option to Solutions navigation menu
* **Style**
* Updated homepage content and layout
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
Co-authored-by: johnjeremiah <jjeremiah@gmail.com>
Changes:
- updated logged errors in the website's build static content script
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved error reporting for GitHub API issues during build process,
providing clearer diagnostic messages.
* Optimized validation error detection order for pricing table features.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Added an embedded YT feature video for each highlighted feature from the
release. Also added anchor points so can jump down from the list at the
top.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed script references for deprecated features including payment
processing, account overview, and specific event-related pages from the
application layout.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Inkscape to version 1.4.4
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #NA
Found this while just browsing the codebase and testing some gitops
stuff.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed GitOps controls detection to correctly identify when controls
are set with specific configurations, including BitLocker PIN
requirements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Updated Cisco Jabber Windows to version 15.2.2.60904
* Updated ClickUp Desktop macOS to version 3.5.208
* Updated Raycast macOS to version 1.104.16
* Updated Thunderbird on macOS to version 150.0.2
* Updated Thunderbird on Windows to version 150.0.2
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Turns out his experience was for when he was at a customer that needs us
to get permissions to post. Taking down for now.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed a testimonial section from a landing page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#38437
The list activities endpoint applied an implicit `created_at <= now` cap
only when `start_created_at` was set, leaving the upper bound unbounded
in every other case, this was changed so that we now apply that cap
unconditionally and override only when the caller passes an explicit
`end_created_at` (as peer the REST docs).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44826
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Windows MSI builds now correctly exclude placeholder secret values
during installation, preventing unnecessary dummy configuration files
from being created.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Changes:
- Added a new Github workflow that runs on branches that change the
website's dependencies (website/package-lock.json or
website/package.json), and fails for 72 hours after a change to those
files have been made. After 72 hours, if the workflow has not run again
on a pull request, the workflow can be rerun to give a PR a passing
status.
- Updated the website handbook page to document this process.
@lukeheath After this is merged, I will need help setting up a branch
protection rule to require a passing status from this workflow to merge
pull requests that change the website's dependencies
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added an automated workflow to enforce a wait period before website
dependency updates can proceed, preventing premature merges.
* Added scheduled and manual re-triggering for recent failed workflow
runs to ensure dependency checks are retried without manual
intervention.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Prevents `terraform destroy` from running against load test
infrastructure, for a given workspace, if an identical osquery perf
workspace exists.
- Adds a check to the osquery perf workflow, to fail fast, if the
specified load test infrastructure workspace is not detected.
- Adds ability for users to configure the osquery perf (increment -
`input.loadtest_containers_increment`) batch size that get deployed to
an environment during every loop. Default: 4.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a configurable load-test container increment input (default: 4)
to control scaling increments.
* **Improvements**
* Prevented destructive runs when an existing infra workspace matches
the requested name.
* Tightened workspace-existence checks to require exact name matching.
* **Chores**
* Default load-test increment reduced from 8 to 4 and input validated as
a positive integer.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Updated image of Oscar Taracena to one he sent me (instead of one I got
off the internet).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the testimonial author image asset on the Linux management
landing page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45042
# Details
On Dogfood, we have v4.85.0 server running but we run our GitOps with
the currently published fleetctl (4.84). This mismatch caused us to
disable (and therefore wipe out data for) both of our historical chart
datasets. This PR patches the "update app config" code so that when in
"overwrite mode" (i.e. GitOps), it checks for empty `historical_data`
keys in the incoming JSON and replaces them with the default values
(currently `true`, i.e. "collect the data"). Tested manually (see
testing below).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
## Testing
- [X] Added/updated automated tests
- [X] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [X] QA'd all new/changed functionality manually
- [X] reproduced issue on both current fleet v4.85 and main branch
servers, using fleetctl v4.84
- [X] on this branch, ran fleetctl v4.84 w/out `historical_data` in
gitops and verified that charts were enabled.
- [X] on branch applied to 4.85, ran fleetctl v4.84 w/out
`historical_data` in gitops and verified that charts were enabled.
- [X] disabled one chart in the UI, and verified that updating unrelated
app config in the UI did not affect that config (PATCH still works)
For unreleased bug fixes in a release candidate, one of:
- [X] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Fixed GitOps configuration handling for historical data settings to
properly apply default values when fields are omitted by clients. This
ensures that previous configuration settings are preserved correctly in
overwrite mode, preventing incorrect defaults from being inadvertently
persisted when managing configurations with older clients.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#44818
## Summary
- Show tier-specific description on the Variables page: Premium users
see "Manage custom variables that will be available in scripts and
profiles across all fleets." while Free users see "Manage custom
variables that will be available in scripts and profiles."
- Uses existing `isPremiumTier` from `AppContext`, consistent with the
rest of the ManageControlsPage components.
## Changes
- `frontend/pages/ManageControlsPage/Variables/Variables.tsx`: Added
`isPremiumTier` to the `AppContext` destructuring and conditionally
render the description text based on tier.
---
Built for [Rachael
Shaw](https://fleetdm.slack.com/archives/D0AFC5BRFHD/p1778192832326539?thread_ts=1777406096.224979&cid=D0AFC5BRFHD)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Added an optional HTTP-level pre-auth middleware (enabled using the
FLEET_OSQUERY_ALLOW_BODY_AUTH_FALLBACK server config) that validates
incoming osquery requests based on `Authorization: NodeKey <node_key>`
header.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the macOS application manifest with a new version entry and
updated installer configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Postman Windows installer metadata to version 12.9.7 with new
installation package details
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Chores
* Updated version records for maintained applications: Cursor macOS
(3.3.27), Firefox Windows (150.0.2), Google Drive macOS (125.0), Ollama
macOS (0.23.2), and Postman macOS (12.9.7). Version verification
metadata and installation parameters have been synchronized to reflect
the latest releases, ensuring accurate system monitoring and
compatibility checks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
---------
Co-authored-by: Isabell Reedy <113355639+ireedy@users.noreply.github.com>
## Summary
- Replace "carry Yubikeys" with "use Okta Verify with FastPass" in the
Security section of `handbook/company/communications.md` (line 38) to
reflect the current authentication method used by Fleeties.
- The link target (`#hardware-security-keys`) and the rest of the
sentence remain unchanged.
---
Built for [Andrea
Pepper](https://fleetdm.slack.com/archives/D0AENPQMD2S/p1778187814061669?thread_ts=1776965257.297969&cid=D0AENPQMD2S)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Remove the entire "Hardware security keys" section from
`handbook/it/security.md`, including the "Are they YubiKeys or security
keys?" subsection and all related FAQ entries (7 items covering YubiKey
usage, setup, and recovery).
- Update the 2FA comparison table to reference **Okta Verify with
FastPass** instead of YubiKeys as the most secure authentication method.
## Context
Fleet is transitioning from hardware security keys (YubiKeys) to Okta
Verify with FastPass for phishing-resistant authentication. This PR
removes the now-outdated YubiKey documentation. A replacement section
with Okta Verify + FastPass setup instructions will land in a separate
PR.
## Changes
- **Removed**: `### Hardware security keys` section and all subsections
(setup instructions, goals, FAQ)
- **Updated**: 2FA table row from "Hardware security keys / YubiKeys" →
"Okta Verify with FastPass"
---
Built for [Andrea
Pepper](https://fleetdm.slack.com/archives/D0AENPQMD2S/p1778188035759309?thread_ts=1776965257.297969&cid=D0AENPQMD2S)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44980
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually (Not, outside of tests
due to exercising replica lag is difficult)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Improved reliability of device profile assignment by ensuring all
devices receive profiles consistently, even when replica lag affects
device synchronization from Device Enrollment Program services.
* **Tests**
* Added test coverage validating device profile assignment behavior
under replica lag scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
