This adds a section with instructions on collecting and exporting the
sysdiagnose logs from an iOS or iPadOS device without having to use
Feedback Assistant, or Apple Configurator.
Closes#48929
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
## Summary
Applies Fleet's article-formatting house style to 17 articles.
Content/prose only — no code, config, or schema changes.
Each article now follows the house structure: sentence-case `# Title`,
italic dek, **Key takeaways** (5–6 outcome-first bullets placed above
the fold), a post-takeaways CTA button, a tightened two-paragraph intro,
a terminology sweep (customer-facing "osquery" → "Fleet's
agent"/"fleetd", sentence-case headings), de-duplication, and format
trimming. Detection-pack SQL, IOC/reference tables, and code blocks were
left intact. All `<meta>` tags (including `category` values) and author
fields were preserved unchanged.
Articles updated:
- shadow-ai-is-already-on-your-fleet
- clickfix-copy-paste-fleet-detection-pack
- shadow-earth-053-fleet-detection-pack
- microsoft-is-rotating-every-windows-pcs-secure-boot-keys
- pre-cve-threat-response-with-fleet
- managing-linux-desktops-with-gitops
- patch-management-and-vulnerability-reporting-for-linux-desktops
- managing-linux-desktop-drift
- linux-desktop-inventory-and-visibility
- zero-trust-endpoint-security
- natural-language-endpoint-security-fleet-mcp
- detecting-the-mini-shai-hulud-npm-supply-chain-worm-with-fleet
- security-compliance-automation
- gitops-for-device-management
- endpoint-management-mixed-platform
- enterprise-device-management-2026
- what-is-device-attestation
## Claims flagged for human review before publishing
**Content issues to reconcile:**
- `detecting-the-mini-shai-hulud`: internal number conflict — intro/IOC
say "175 additional packages", SQL section says "133 additional packages
across 322 versions". Left as-is; pick one.
- `linux-desktop-inventory-and-visibility`: "IdP group" was removed as a
label type (couldn't confirm). Fleet does support IdP/SSO-group labels —
likely should be restored.
- `shadow-earth-053`: an ambiguous "17 validated queries" count was
removed (15 numbered queries, some with two statements). Re-add a number
if desired.
**Claims softened for honesty (revert only if the stronger version can
be backed):**
- `managing-linux-desktops-with-gitops`: two absolute "only MDM/only
platform with native GitOps" claims softened.
- `gitops-for-device-management`: unverifiable "up to three retry
attempts" number dropped; confirm CIS policies are Premium-gated.
- `endpoint-management-mixed-platform`: "enforces OS updates across
every supported platform" → "major platforms" (excludes Linux/ChromeOS);
confirm Entra conditional-access "macOS and Windows" scope.
**Specifics to confirm against fleetdm.com/tables or docs:**
- `shadow-ai`: `mcp_listening_servers` table, `vscode_edition` column,
MCP-client support list.
- `clickfix`: agent-option flags, `powershell_events.cosine_similarity`,
`es_process_events` columns, XProtect Remediator min macOS version.
- `shadow-earth-053`: schema notes and author-hosted download links.
- `microsoft-secure-boot-keys`: Microsoft cert-expiry dates / Event IDs
(author-supplied).
- `natural-language-endpoint-security-fleet-mcp`: fleet-mcp tool
inventory (third-party repo); CTA points to the external
`github.com/karmine05/fleet-mcp`.
# Checklist for submitter
- [x] No user-visible product changes; content/articles only (no
`changes/` file required).
- [x] QA'd rendered structure: each article has one `# Title`, dek,
single Key takeaways section, and one CTA button; code blocks and tables
preserved.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
## Summary
- Renamed `articles/manage-boostrap-package-with-gitops.md` to
`articles/manage-bootstrap-package-with-gitops.md` to fix the "boostrap"
typo (article title/content were already spelled correctly).
- Added a 301 redirect in `website/config/routes.js` from the old
misspelled URL (`/guides/manage-boostrap-package-with-gitops`) to the
corrected URL (`/guides/manage-bootstrap-package-with-gitops`).
- Updated the two internal links that pointed at the misspelled URL, in
`articles/enroll-macbook-neo-at-scale-with-fleet-zero-touch.md` and
`handbook/marketing/marketing-assets.md`.
## Testing
- [x] QA'd all new/changed functionality manually — verified the
redirect rule matches the existing pattern used for other renamed
`/guides/*` pages in `website/config/routes.js`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Added a redirect for a misspelled guides URL so visitors are sent to
the correct page automatically.
* Improved navigation reliability for the affected guide link without
changing any other routes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Retires old success stories and redirects `/success-stories` to
`/customers`.
@eashaw, is there anything else / different that needs to be done to
retire these old pages? I suspect there will still be some article
category artifacts hanging around.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated story-related redirects so visitors are sent to the customers
page instead of older story URLs.
* Fixed deprecated device-management “fleet user story” links to land on
the customers page.
* Adjusted article page metadata and category resolution so the “success
stories” category no longer uses the previous titles/descriptions or
friendly-name mapping.
* **Chores**
* Updated static-content build rules for allowed category values and
adjusted how certain category URL prefixes are generated.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41056
Follow-up documentation change for #41056. The unused Windows MDM STS
auth endpoint (`/api/mdm/microsoft/auth`) was removed in #48734, so this
removes it from the "what API endpoints to expose to the public
internet" guide:
- The "endpoints to expose" bullet in the Windows section, along with
its now-orphaned MS-MDE2 section 3.2 reference.
- The entry in the "these endpoints don't use mTLS" list.
Supersedes #41058, which removes the same two references but leaves the
section 3.2 sub-bullet dangling under `/api/mdm/microsoft/tos`.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually (verified no remaining
`/api/mdm/microsoft/auth` references in the article and that the
surrounding lists render correctly).
Documentation-only change: no code, automated tests, database
migrations, Fleet configuration settings, or fleetd/orbit/Fleet Desktop
impact.
Moves opening context paragraphs in several articles to follow the key
takeaways section for a more consistent structure. Also refines a few
takeaway phrases for clarity and updates calls to action, including
linking the Managed Migration Assistant article to the setup guide and
simplifying the closing CTA in the config-as-code article.
- [x] QA'd all new/changed functionality manually
- Enrollment methods: ADE, profile-based manual, Managed Apple Account
- Also, update Controls > Setup experience copy. "Automatically" only
applies to macOS:
<img width="505" height="168" alt="Screenshot 2026-07-02 at 9 41 17 AM"
src="https://github.com/user-attachments/assets/ff46682f-e87b-4d2e-9889-7d0382b0d3d5"
/>
- Every other platform:
<img width="517" height="174" alt="Screenshot 2026-07-02 at 9 41 31 AM"
src="https://github.com/user-attachments/assets/0ab115fb-76fb-4080-afb4-52edcf4900b7"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the setup guidance text for platform-specific enrollment so
macOS now shows “automatically enroll to Fleet.”
* Other platforms continue to show “enroll to Fleet,” improving clarity
in the install experience.
* **Tests**
* Adjusted the Android empty-state test to match the updated enrollment
wording.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** NA
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] QA'd all new/changed functionality manually
---
Brings `articles/control-apple-beta-programs-with-ddm.md` up to the
current article format:
- Moved the "Key takeaways" section and CTA button directly under the
dek, ahead of the intro, so the full argument sits at the top of the
page.
- Reworded two takeaways ("Beta control is no longer all-or-nothing" and
the token-fetching bullet) that echoed body sentences nearly verbatim —
takeaways now preview the body instead of repeating it.
No changes to metadata, links, or the substance of the article.
@headmin can you give this a review? The intention was not to rewrite
your article but to have it follow the new article format.
---
Reframes the opening to focus on operational cost and team dependency
tradeoffs, adds a new "Key takeaways" section, and inserts an early CTA
link. Also normalizes capitalization in the closing demo bullet for
consistency.
Reworks the article opening with a stronger headline, intro framing, and
a new key takeaways section plus CTA. It also tightens product language
(agent/query-based verification, Premium benchmark availability),
simplifies the “what changes” section into a clearer narrative, and
updates metadata by moving the category from `security` to `articles`.
**Related issue:** N/A
New article: "Take control of Apple beta programs with declarative
device management."
Covers the `com.apple.configuration.softwareupdate.settings` DDM
declaration for controlling Apple beta program enrollment, automating
AppleSeed for IT token retrieval from Apple Business Manager using the
Microsoft/HCS `betaTokens.sh` script, and deploying the declaration
through Fleet's custom OS settings (UI upload or GitOps) with
label-based scoping.
Follows the Fleet article format: dek, key takeaways above the fold,
post-takeaways CTA button, and closing "See it live" block.
Notes for reviewers:
- Verified `com.apple.configuration.softwareupdate.settings` is not in
Fleet's `ForbiddenDeclTypes` (`server/fleet/apple_mdm.go`), so the
"deploy with Fleet" section is accurate.
- CTA routes (`/try-fleet`, `/gitops-workshop`,
`/guides/custom-os-settings`) verified against
`website/config/routes.js`.
- Please click-check the Apple developer docs link for the
`SoftwareUpdateSettings` schema.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Article-only change; no changes file, tests, migrations, or config
changes needed.
---------
Co-authored-by: Harrison Ravazzolo <38767391+harrisonravazzolo@users.noreply.github.com>
- Clarified the absence of a Refetch button for Android hosts
- Removed "Sync policies" header because the term policies could be
confusing. After that, just decided to remove the headers because the
article is short.
- Piece of the following request:
https://github.com/fleetdm/fleet/issues/42755
**Related issue:** Resolves#25574
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
---
## Summary
- Adds a new `splunk` log plugin that sends osquery logs directly to
Splunk's HTTP Event Collector (HEC) endpoint
- Eliminates the need for middleware like AWS Firehose when using Splunk
as a log destination
- Follows the same pattern as existing log destinations (Firehose, Kafka
REST, NATS, etc.)
- Includes `insecure_skip_verify` option for environments with
self-signed TLS certs
## UI changes
Follows the same pattern as the NATS log destination PR (#36527) --
adding "Splunk" to the display name, tooltip, and TypeScript type union.
No new components, pages, or styles.
### Manage automations modal -- "Log destination: Splunk"
<img width="822" height="527" alt="image"
src="https://github.com/user-attachments/assets/2533207f-fa95-4364-8ee0-3c39cd3e8e4d"
/>
### Query details page -- "Log destination: Splunk"
<img width="1905" height="662" alt="image"
src="https://github.com/user-attachments/assets/069a5005-f95c-4562-a819-fd8bdcc349f7"
/>
### Tooltip on hover
<img width="639" height="348" alt="image"
src="https://github.com/user-attachments/assets/809a47a6-b82a-4f45-b731-77b2d2c87947"
/>
### Edit query form -- "sent to your log destination: Splunk"
<img width="451" height="814" alt="image"
src="https://github.com/user-attachments/assets/b78b9a57-1f0c-4413-8b7c-654de1fd40a2"
/>
### Save new query modal -- "sent to your log destination: Splunk"
<img width="536" height="698" alt="image"
src="https://github.com/user-attachments/assets/d0a0ab01-66fe-4d63-9190-9c5e840e456d"
/>
---
### How it works
The Splunk writer (`server/logging/splunk.go`) implements the
`fleet.JSONLogger` interface. On startup it performs a health check
against the HEC `/services/collector/health` endpoint. On each `Write()`
call, it wraps each log entry in Splunk's HEC event format (adding
`time`, `index`, `source`, `sourcetype`), batches them up to 1 MB, and
POSTs to `/services/collector/event` with the `Authorization: Splunk
<token>` header. If a batch exceeds 1 MB it flushes and starts a new
one. Events over 1 MB are dropped with a log warning. Transient errors
(HTTP 503) are retried with exponential backoff (up to 8 retries).
### Configuration
```yaml
osquery:
status_log_plugin: splunk
result_log_plugin: splunk
splunk:
url: https://splunk.example.com:8088
token: <HEC token>
index: main
source: fleet
source_type: fleet:json
insecure_skip_verify: false # set true for self-signed certs
```
Or via environment variables:
```
FLEET_OSQUERY_STATUS_LOG_PLUGIN=splunk
FLEET_OSQUERY_RESULT_LOG_PLUGIN=splunk
FLEET_SPLUNK_URL=https://splunk.example.com:8088
FLEET_SPLUNK_TOKEN=<HEC token>
FLEET_SPLUNK_INDEX=main
FLEET_SPLUNK_SOURCE=fleet
FLEET_SPLUNK_SOURCE_TYPE=fleet:json
```
### Files changed
- `server/logging/splunk.go` -- Splunk HEC log writer with batching,
retry, and health check
- `server/logging/splunk_test.go` -- 9 unit tests
- `server/logging/splunk_integration_test.go` -- 3 integration tests
against real Splunk (gated by env var)
- `server/logging/logging.go` -- Added `SplunkConfig` and `case
"splunk"` to factory
- `server/config/config.go` -- Added `SplunkConfig` struct and config
flags
- `cmd/fleet/logging.go` -- Wired Splunk config into logging builder
- `server/fleet/app.go` -- Added `SplunkConfig` type for API responses
(excludes token)
- `server/service/service_appconfig.go` -- Added `case "splunk"` to
logging plugin validation
- `frontend/interfaces/config.ts` -- Added `"splunk"` to LogDestination
type
-
`frontend/components/LogDestinationIndicator/LogDestinationIndicator.tsx`
-- Added Splunk display name and tooltip
- `docs/Configuration/fleet-server-configuration.md` -- Splunk config
documentation
- `docs/Get started/FAQ.md` -- Updated plugin list
- `articles/log-destinations.md` -- Updated Splunk section with native
HEC docs
- `changes/25574-splunk-log-destination` -- Change file
## Test plan
### Unit tests (9 tests)
- [x] `TestSplunkWrite` -- sends 3 events, verifies HEC format, auth
header, index/source/sourcetype
- [x] `TestSplunkWriteEmpty` -- empty logs don't trigger HTTP request
- [x] `TestSplunkServerError` -- HEC 403 propagates as error
- [x] `TestSplunkHealthCheckFailure` -- constructor fails on bad health
- [x] `TestSplunkRecordTooBig` -- oversized events (>1MB) are dropped,
normal events still sent
- [x] `TestSplunkSplitBatchBySize` -- logs exceeding 1MB batch limit are
split into multiple requests
- [x] `TestSplunkRetryOnServiceUnavailable` -- 503 retried with backoff,
succeeds on 3rd attempt
- [x] `TestSplunkRetryExhausted` -- after 9 attempts (1 + 8 retries)
returns error
- [x] `TestSplunkMissingConfig` -- empty URL/token returns descriptive
error
### Integration tests (3 tests, gated by `SPLUNK_INTEGRATION_TEST=1`)
- [x] `TestSplunkIntegration` -- 3 events sent via writer, queried back
from Splunk REST API
- [x] `TestSplunkIntegrationBatch` -- 100 events in one Write(), all
confirmed indexed
- [x] `TestSplunkIntegrationBadToken` -- bad token Write() returns 403
### End-to-end test (macOS ARM64, real osquery agent)
1. Started Splunk Enterprise, MySQL, Redis via Docker
2. Built Fleet server from this branch with
`--osquery_status_log_plugin=splunk`
3. Set up Fleet, enrolled a real osquery 5.23.0 agent on this MacBook
4. **83 real osquery status log events indexed in Splunk** with correct
source/sourcetype/index
5. Each event contained full osquery data (`hostIdentifier`,
`host_uuid`, `calendarTime`, `severity`, `message`, `decorations`)
### Splunk showing real osquery events from Fleet
<img width="1910" height="861" alt="image"
src="https://github.com/user-attachments/assets/192490bf-d594-4424-a3e3-a18306892873"
/>
Generated with [Claude Code](https://claude.ai/code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added native Splunk HEC logging destination for status, result, and
audit logs.
* Updated the log destination UI to display **Splunk** with a dedicated
tooltip.
* Added Splunk HEC configuration (URL/token/index/source/source type)
including TLS verification control.
* **Bug Fixes**
* Improved log delivery with batching, retries for temporary HTTP
failures, and safeguards for oversized events.
* **Tests**
* Added unit tests and optional integration tests covering routing,
batching, retries, and error scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Changes
- Deleted 52 anonymous case study article files from the `articles/`
directory
- Removed all anonymous case study sections (financial services,
technology & SaaS, security/IT/healthcare/other) from
`handbook/marketing/fleet-social-proof.md`
- Removed 21 redirect entries from `website/config/routes.js` that
pointed to these removed case studies
The named customer stories (Stripe, Foursquare, Faire, Thumbtack,
Deputy, Fastly) and customer testimonials are preserved.
---
Built for [Irena
Reedy](https://fleetdm.slack.com/archives/D0APYC9R9SL/p1783033337222849?thread_ts=1775761161.561979&cid=D0APYC9R9SL)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Irena Reedy <irena@fleetdm.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Closes https://github.com/fleetdm/confidential/issues/16163
- Updates body to match approved Thumbtack content
- Rebuilds summary cards using verbatim sentences from approved
Thumbtack content
- Updates Adam Anklewicz's title to "Manager, IT Systems Engineering"
per the approved doc.
Refines the opening to better frame the core argument, adds a new “Key
takeaways” section summarizing the main data-backed points, and
introduces stronger calls to action. This update improves scannability
and ties the article’s thesis to clear next steps around
code-first/GitOps workflows.
Reworked the article opening into a stronger narrative with a new key
takeaways section and an early CTA to deploy Santa with Fleet. Updated
wording to align on Fleet agent/Santa tables terminology, moved
deployment-series links into the setup section, and tightened copy
around monitoring guidance and telemetry setup. Added a new "See it
live" closing section with demo/training CTAs, and refined the meta
description text.
- Update the best practice is to create an API-only user w/ the admin
role and access only to necessary SCIM API endpoints
- These doc updates require [this
bug](https://github.com/fleetdm/fleet/issues/48062) to be fixed because
the `/scim/*` API endpoints aren't exposed as API endpoints one can pick
when creating an API only user
- Document the `/scim/*` API endpoints
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added SCIM API endpoints for managing users and groups.
* Supported actions include listing, creating, viewing, replacing,
updating, and deleting SCIM users and groups.
* Added read-only endpoints for SCIM schemas, service provider
configuration, and resource types.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Changes:
- Updated the website's build-static-content script to use download URLs
from the next latest released version of Fleet when the latest release
does not contain installers for a platform in its release assets.
- Reduced the length of the description meta tag value in the "Block and
monitor EDR Freeze on macOS with Santa and Fleet" article
- Updated the labels values for two engineering rituals (The old label
was removed from the GH repo)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Improved resilience when generating fleetctl download links if the
latest GitHub release is missing one or more required platform installer
assets.
* The system now looks for the most recent release that contains the
complete installer set, warns for any missing platform, and fails only
if no complete set is available.
* **Documentation**
* Updated labels for two Apple-related engineering rituals to use the
correct label.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This article explains how to block and monitor EDR Freeze on macOS using
Santa 2026.3 and Fleet. It covers the functionality of EDR Freeze, the
implementation of AntiSuspendSigningIDs, and how to utilize Fleet's
Santa osquery tables for monitoring.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Adds a comprehensive article explaining Apple's Managed Migration
Assistant in macOS 26.4, covering how it transforms Mac-to-Mac migration
from an uncontrolled user choice into declarative organizational policy.
Discusses governance, compliance, operational benefits, and how Fleet
can operationalize migration policies through version-controlled YAML.
Victor Lyuboslavsky