## Summary
- Documents the new ability to combine `labels_exclude_any` with either
`labels_include_all` or `labels_include_any` on configuration profiles,
giving IT admins more granular control over profile targeting without
complex label queries.
- Adds documentation for the new `added_label_to_host` and
`removed_label_from_host` activity log entries.
- Includes GitOps YAML examples showing combined label targeting.
**Related issue:** Closes#32073
---
Built for [Mel
Pike](https://fleetdm.slack.com/archives/D0AKX7DJFCN/p1778016679163449?thread_ts=1777299502.461149&cid=D0AKX7DJFCN)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: melpike <79950145+melpike@users.noreply.github.com>
Fleet added automatic renewal for SCEP certificates that are not proxied
through Fleet:
- https://github.com/fleetdm/fleet/issues/40639
I think the Okta conditional access certificate is one of these.
## What & why
The [role-based access
guide](https://fleetdm.com/guides/role-based-access) listed
custom-variables permissions that don't match what Fleet actually
enforces in `server/authz/policy.rego` (the "Secret variables" rules):
- **Write** (create/edit/delete) is allowed for global **Admin,
Maintainer, and GitOps** only — the guide incorrectly granted it to
**Observer, Observer+, and Technician**, and omitted **GitOps**.
- **Read** (view) is allowed for **all global roles, including GitOps**
— the guide omitted GitOps.
This updates the two rows in the global permissions table so they match
enforcement (and mirror the existing "queries" rows, which share the
same role logic).
### Source of truth
`server/authz/policy.rego` — Secret variables:
```rego
# Global admins, maintainers, and gitops can write secret variables.
subject.global_role == [admin, maintainer, gitops][_] # action == write
# Any global user can read secret variables.
subject.global_role == [admin, maintainer, gitops, technician, observer_plus, observer][_] # action == read
```
### Notes
- Found during a QA chaos-engineering review (originally reported
2026-03-25): the docs implied read-only roles like Observer could
create/edit/delete custom variables, which the UI/API don't allow.
- The separate "the RBAC guide calls the Reports page the Query page"
terminology cleanup is **not** included here — it overlaps the in-flight
Query → Report rename (#41419) and is better handled there.
- Docs/article-only change; no `changes/` entry needed.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
And add redirects
Part of the following issue:
- https://github.com/fleetdm/fleet/issues/41419
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated legacy documentation redirects so older `/docs/using-fleet/*`
and `/guides/*` URLs now point to the correct current guide and report
destinations (301), including fixes for Fleet UI, learn-how-to-use, and
report/library links.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
Adds "The hidden cost of config-as-code: simplicity, tribal knowledge,
and what stays in Git" by Henry Stamerjohann.
---------
Co-authored-by: Dan Gordon <daniel@fleetdm.com>
Co-authored-by: Irena Reedy <irena@fleetdm.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
- @noahtalerman: For Windows, I think we want to squeeze turning off MDM
and uninstalling fleetd into one script.
- Why? Because Fleet automatically turns on Windows MDM, two scripts
means Fleet could beat the IT admin and turn MDM back on before they
uninstall fleetd.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Windows fleetd uninstall now proactively detects and disables MDM
enrollment before removal to help ensure a cleaner device unenrollment.
* **Bug Fixes**
* Improved uninstall error reporting by surfacing the underlying failure
message and exiting with a clear non-zero code.
* **Chores**
* Updated fleet testing and workstation configurations: removed the
Windows uninstall/MDM-related steps from QA and workstation controls,
and added new Windows security/setup scripts plus additional
cross-platform post-install and extension installation tasks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Steven Palmesano <3100993+spalmesano0@users.noreply.github.com>
- @noahtalerman: Landed on this terminology: "Fleet Desktop menu bar
icon" and "Fleet Desktop app"
- We were already calling Fleet Desktop a menu bar icon so I think this
is the smallest change
Created this article after attending the Twin Cities MacAdmins meetup
this week and there were questions raised on how to identify and prepare
for this change in macOS 27.
https://fleetdm.slack.com/archives/C062D0THVV1/p1781805740505939
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Documentation**
* Added a new article, “Find apps that need Rosetta before macOS 27,”
with fleet-ready methods to identify Intel-only (Rosetta-dependent) apps
on Apple silicon. Includes multiple approaches (running process
detection, Spotlight-based inventory, and a Spotlight-less fallback) and
troubleshooting notes for correctly handling `arm64e`.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Steven Palmesano <3100993+spalmesano0@users.noreply.github.com>
## Summary
- Documents that on macOS 15.7, FileVault cannot be enabled locally
through System Settings when the end user account type is set to
Standard or Skip (no account).
- Adds notes to both the setup experience guide and the enforce disk
encryption guide with the workaround (enforce disk encryption via
Fleet).
- Notes that this issue does not affect macOS 26.
Closes#47711
Related to #47680
Built for [Mel
Pike](https://fleetdm.slack.com/archives/D0AKX7DJFCN/p1781726233185189?thread_ts=1777299502.461149&cid=D0AKX7DJFCN)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Changes:
- Removed, compressed, or resized large images in the website's assets
folder
- compressed whitepaper pdfs
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Adds Mollie case study.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Mollie as a featured customer case study on the customers page,
including company branding, overview information, and a link to the full
case study.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
Adds "Benchmarks without the burden: continuous CIS compliance" by Dhruv
Majumdar.
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Dan Gordon <daniel@fleetdm.com>
This pull request updates the logic for scheduling calendar events to
always select the next business day (skipping weekends) instead of
scheduling on the next Tuesday. The test suite for this functionality
has also been rewritten to reflect the new behavior and to improve
clarity.
**Business logic update:**
* Changed `getPreferredCalendarEventDate` in `calendar_cron.go` to
return the next business day after the provided date, skipping weekends,
instead of always selecting the next Tuesday.
**Test updates:**
* Refactored the test cases in `calendar_cron_test.go` to use specific
`today` dates and expected results, ensuring coverage for weekday
transitions, weekend skipping, and month/year rollovers. The tests now
directly check the next business day logic rather than iterating over
ranges of days.
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Calendar events now schedule on the next business day (skipping
weekends) after a policy failure instead of a fixed weekly day.
* **Tests**
* Updated unit tests to validate the new next-business-day behavior with
explicit expected dates.
* **Documentation**
* Updated scheduling description to reflect next-business-day
remediation timing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #https://github.com/fleetdm/fleet/issues/46927
Added information about using HTTPS and handling self-signed
certificates during Fleet setup.
Allen Houchins