<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45700
Not a product change. This PR will allow us to run the workflow
manually. After ~2 weeks, if there are no issues, we'll make it
automatic.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automated workflow to identify and close stale issues created by
Fleet team members, with dry-run capability and operation limits.
* Added system to build and maintain a deduplicated list of Fleet team
member handles from GitHub organization and repository history.
* **Tests**
* Added comprehensive test suites for stale issue management and handle
list generation with mock GitHub API interactions and boundary condition
coverage.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45530?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43895
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Self-service install/uninstall activities now render in passive voice,
omit an actor name, and include a “(self-service)” marker across feeds
* Global admins see a "My device" button on host user cards that opens
the end‑user device page in a new tab; the link is refreshed/generated
as needed
* Device page and browser tab header show the end‑user's name when
available (fallback: "My device")
* **Tests**
* Added/updated coverage for self‑service activity rendering and the "My
device" flow
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45659?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Closes#43637
## Summary
- Adds `min-width: 0` to `.side-nav__card-container` so the flex child
can shrink below its content width, enabling horizontal scroll on data
tables inside the side-nav layout at narrow viewports.
## Root cause
`.side-nav__container` uses `display: flex`, and its child
`.side-nav__card-container` has `width: 100%` but no `min-width`
override. Flex children default to `min-width: auto`, which prevents
them from shrinking below their content width. This means `overflow-x:
auto` on `.data-table__wrapper` never activates because the parent chain
stretches to fit the table content instead of constraining it.
## Changes
**`frontend/pages/admin/components/SideNav/_styles.scss`** -- added
`min-width: 0` to `.side-nav__card-container`.
## Manual testing
- [x] Built and ran Fleet server locally (`make fleet && ./build/fleet
serve --dev --dev_license`)
- [x] Navigated to **Controls > Disk encryption**
(https://localhost:8080/controls/os-settings/disk-encryption?fleet_id=2)
- [x] Enabled disk encryption for the team and confirmed the table
rendered
- [x] Resized browser to smallest supported viewport width
- [x] **Before fix:** table columns were squished/truncated with no
horizontal scrollbar
- [x] **After fix:** horizontal scrollbar appeared and table content
scrolled correctly
- [x] Verified other pages using the SideNav component (e.g., Settings)
were not affected
## Unit tests
- [x] Ran all related frontend test suites (`SideNav`, `DiskEncryption`,
`TableContainer`) -- 39 tests, all passing
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Fixed side navigation layout to properly handle content overflow and
enable horizontal scrolling when navigation items exceed available
space.
* **Documentation**
* Added note: Disk Encryption > Disk encryption table now supports
horizontal scrolling on narrow viewports.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45736?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Summary
- Adds a `/pr-approvals` skill to `.claude/skills/` so all fleeties can
use it
- Quickly identifies who is blocking a PR merge by checking CODEOWNERS
(blocking) vs custom.js DRI (non-blocking)
- Usage: ask Claude "who needs to approve this PR?" or run
`/pr-approvals <number>`
## Test plan
- [x] Tested against PR #45696 (correctly identified @lukeheath as the
only blocker for openspec files)
- [x] Tested against PR #45663 (correctly identified failing CI, no
reviewer blocking)
- [x] Tested against PR #42435 (correctly identified missing @fleetdm/go
approval)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Summary
- Swap "Integrations" and "Support" between footer sections: "Support"
now appears under Solutions, "Integrations" now appears under
Documentation
- Remove "Orchestration" link from the footer entirely
- Add new "Downloads" link (pointing to `/download`) under the
Documentation section
## Changes
**Solutions section:**
- Removed "Orchestration"
- Removed "Integrations"
- Added "Support"
**Documentation section:**
- Removed "Support"
- Added "Integrations"
- Added "Downloads" (`/download`)
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1779125879174289?thread_ts=1778225078.313209&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
Resolves#36417.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
## Manual tests performed
✅ MDM enrollment first, then fleetd enrollment (checked both activities
match serial and display name is preserved).
✅ fleetd enrollment first, then MDM enrollment (checked both activities
match serial and display name is preserved).
<img width="520" height="383" alt="activities_mdm_macos_enrollment"
src="https://github.com/user-attachments/assets/35c74612-ad80-4245-bfd9-20a3dc5e78bb"
/>
✅ Enrolled ABM iPad.
<img width="599" height="65" alt="Screenshot 2026-05-18 at 10 57 23 AM"
src="https://github.com/user-attachments/assets/b7ad552b-82af-4606-a860-361eedb97483"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enrollment activities now show device serial numbers alongside host
display names, avoid duplicating the serial if already included, and
fall back to serial/generic messaging when no display name is available.
* Fleet enrollment entries no longer show an actor prefix, matching
other enrollment activity items.
* **Bug Fixes**
* Display names set by prior fleetd enrollment are preserved and no
longer overwritten during MDM enrollment.
* **Tests**
* Added and relaxed activity-feed tests covering enrollment message
variants.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45697?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#45520
The Pub/Sub status-report and enrollment handlers dereferenced
device.HardwareInfo before any nil check, so a payload from Google's
Android Management API with hardwareInfo omitted panicked the request
goroutine.
Fixes#42874
Empty, whitespace-only, and missing `FLEET_JIT_USER_ROLE_*` SAML
attribute values are now treated as `null` (ignored) instead of
returning an error, matching the literal `"null"` workaround.
Add a list of form-based contact sources and set
Most_recent_campaign_member_status__c to 'Registered' when contactSource
matches any of them. This marks contacts originating from website
contact forms, webinars, gated docs, and related sources as registered.
The change includes an eslint-disable-line camelcase comment for the
Salesforce field name.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced contact registration tracking to automatically set
appropriate campaign status when contacts are registered through
form-based sources such as webinars.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45427)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#45220
Here's one example why this is a good idea.
On `main`, the fleet production binary contains a private key used for
testing:
```
$ strings ./build/fleet | rg "BEGIN RSA TESTING"
proto3-----BEGIN RSA TESTING KEY-----
```
And it's gone when using this branch:
```
$ strings ./build/fleet | rg "BEGIN RSA TESTING"
<empty>
```
## Testing
- [X] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Reorganized and centralized SCEP test helpers and servers for
certificate enrollment tests.
* Added embedded HTML fixtures to better emulate SCEP/NDES admin
responses (cache/full, permissions, password).
* Standardized UTF‑16 handling for test responses and improved test
server response handling.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45619?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- `pkg/patch_policy/GenerateQueryForManifest` now wraps the
caller-supplied exists query in an inner set of parentheses before
appending the trailing `AND version_compare(...) < 0` clause. Without
the wrap, any `OR` in the exists body binds *after* the appended `AND`
(SQL precedence: `AND` > `OR`), producing an incorrect `patched` query.
The bug is currently only observable on `codex-cli` (uses `path = ... OR
path LIKE ...`) but would silently break any future FMA whose exists
query contains `OR`.
- All FMA outputs regenerated via `cmd/maintained-apps`. For AND-only
exists queries (the vast majority of existing FMAs), the new patched SQL
is semantically identical to the previous form — just with extra parens
around the WHERE body. `codex-cli/windows.json`'s OR clause is now
correctly grouped.
- `docker-desktop` is unchanged: its patched SQL is constructed inline
in the homebrew ingester at
[ingester.go:198-201](https://github.com/fleetdm/fleet/blob/claude/compassionate-merkle-afbd8a/ee/maintained-apps/ingesters/homebrew/ingester.go#L198-L201)
and bypasses the generator.
### Heads-up: upstream version drift bundled in
The regeneration also pulled in a handful of upstream version bumps that
landed since the last FMA run. These are real upstream changes, not
generator artifacts:
| App | Platform | Old → New |
|---|---|---|
| Figma | windows | 126.3.12 → 126.4.9 |
| GoLand | darwin | 2026.1.1 → 2026.1.2 |
| IntelliJ IDEA | darwin | 2026.1.1 → 2026.1.2 |
| RubyMine | darwin | 2026.1.1 → 2026.1.2 |
| Zed | darwin | 1.2.5 → 1.2.6 |
If you'd prefer these isolated from the paren-only change, let me know
and I'll split the PR.
### Code changes
- [pkg/patch_policy/patch_policy.go](pkg/patch_policy/patch_policy.go):
added `(` to `templateStart` and `)` to `templateEnd{Darwin,Windows}` so
`GenerateQueryForManifest` emits `... NOT EXISTS ((<before>) AND
version_compare(...) < 0);`.
-
[pkg/patch_policy/patch_policy_test.go](pkg/patch_policy/patch_policy_test.go):
updated existing expectations and added an OR-precedence case mirroring
codex-cli's exists query.
-
[ee/maintained-apps/ingesters/homebrew/ingester_test.go](ee/maintained-apps/ingesters/homebrew/ingester_test.go):
updated the generic `Patched` assertion (docker-desktop's hardcoded
expectation is unchanged — it bypasses the generator).
- 282 regenerated files under `ee/maintained-apps/outputs/**/*.json`.
## Test plan
- [x] `go test ./pkg/patch_policy/...` passes (incl. new OR case).
- [x] `go test ./ee/maintained-apps/...` passes.
- [x] `go vet ./pkg/patch_policy/... ./ee/maintained-apps/...` clean.
- [x] `cmd/maintained-apps` runs end-to-end with no errors against the
live Homebrew/winget APIs (with `NETWORK_TEST_GITHUB_TOKEN` set).
- [x] `git diff` audited: every diffed `patched` line on
`outputs/**/*.json` is a paren-only delta; non-`patched` deltas confined
to the 5 upstream version bumps listed above.
- [x] `docker-desktop/darwin.json` unchanged after regeneration.
- [ ] CI green.
Victor Lyuboslavsky
