<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42841
This change is just new columns in a table. No other functional changes.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added tracking for Windows device enrollment configuration status,
including timestamps indicating when devices entered the
awaiting-configuration state to improve enrollment lifecycle management.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42369
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. **Done in backend task for whole story**
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added "Clear passcode" action for iOS and iPad hosts in the host
actions menu, accessible only to Premium tier users with appropriate
permissions.
* Added confirmation modal for clearing device passcodes.
* Passcode clearing activity now appears in the activity feed with actor
information.
* Action is conditionally disabled during specific device states (Lost
Mode, pending wipe) with contextual tooltips.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42405
Demo video: https://www.youtube.com/watch?v=F3nfFvwdj-c
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Android Wi‑Fi configuration profiles that reference client
certificates are withheld until the certificate is installed or reaches
a terminal state.
* Host OS settings now show the specific pending reason in the detail
column when Android profiles are waiting on certificate installation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43046
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
## Summary
- Updates the CEO shadow program section in the handbook so that Account
Executives (AEs) complete their shadow program with the SVP Global Sales
instead of the CEO.
- Adds a note to the onboarding checklist in
`handbook/company/communications.md` clarifying the AE exception.
## Changes
**`handbook/company/leadership.md`**: Added a callout under the CEO
shadow program description noting that AEs complete their shadow program
with the SVP Global Sales instead.
**`handbook/company/communications.md`**: Updated the onboarding
contributor experience training checklist to note that AEs shadow the
SVP Global Sales rather than the CEO.
---
Built for [Isabell
Reedy](https://fleetdm.slack.com/archives/D0AEGJCGJR0/p1775558368006279)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42368
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. For the overall story
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42103
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved profile removal handling: Fleet now successfully removes host
OS setting entries even when the removal command encounters a "profile
not found" error from the device.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42991
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
Comment out Zoom Fleet Maintained App entries and associated labels and
patch policies until Zoom FMA is present in Fleet. Files updated:
workstations.yml (zoom/darwin and zoom/windows software entries
commented), labels/* (macOS and x86 Windows Zoom labels commented), and
macOS/Windows patch policy files (Zoom patch policies disabled via
comments). This prevents Fleet from referencing or enforcing Zoom
policies while the FMA is not available.
Closes: https://github.com/fleetdm/fleet/issues/42116
Changes:
- Updated the syntax highlighting styles on documentation pages
(app-details, query-details, osquery-table-details, vital-details,
command-details, script-details, and policy-details)
- Added support and styles for syntax highlighting on article pages.
I learned that it doesn't matter if the client certificate is signed by
a root CA certificate specified under `Certificates[0].X509` when `Type`
is `Authority`.
In the case of `customer-pingali`, they have a client certificate signed
by a different CA, which confused their IT team. They initially used the
root CA that signed the client certificate and assumed that the same
certificate also signed the server certificate.
- @noahtalerman: Feedback from `cisneros` that it's not clear that Fleet
retries 3 times for software and scripts.
For the following quick win:
- https://github.com/fleetdm/fleet/issues/41107
Temporarily disable Zoom-related Fleet Maintained App (FMA) labels and
patch policies across macOS and Windows while the FMA installer issue is
resolved in gitops (SQL returned no rows). Commented out the Zoom label
entries in lib/all/labels/*-with-fleet-maintained-apps-installed.yml and
the corresponding Zoom patch policies in
it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml and
it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml,
with comments noting to uncomment them together when re-enabling.
Remove local Zoom software manifests and icon and replace them with
fleet-maintained app slugs. Workstations fleet now references
zoom/darwin and zoom/windows slugs; added dynamic labels for Macs and
x86 Windows hosts with Zoom installed. Patch policies for macOS and
Windows updated to include Zoom using the new slugs so patch
checks/notifications are centralized. Deleted legacy
it-and-security/lib/*/software/zoom.yml and the Zoom icon to avoid
duplicate/local package definitions.
Add lock_end_user_info: false to it-and-security/fleets/workstations.yml
under macos_setup so end-user information is not locked during macOS
enrollment. This allows end users to view or edit their info while
end-user authentication remains enabled.
## Summary
- Adds a new kilocode skill for cherry-picking PRs onto release
candidate branches
- Codifies the single-session constraint to prevent duplicate PRs
- Documents branch naming, commit message format, and common issues
## Test plan
- [ ] Verify the skill is picked up by Kilo when prompted with a
cherry-pick task
- [ ] Confirm the documented steps match the existing cherry-pick
workflow
Usage:
- `/cherry-pick 43082`: auto-picks the latest RC branch
- `/cherry-pick 43082 rc-minor-fleet-v4.84.0`: targets a specific RC
branch
Sample PR I opened with the skill:
https://github.com/fleetdm/fleet/pull/43110
This PR updates VSCode settings to use Fleet's installed version of
Typescript (v4.7.4) for its language server (linting, autocomplete,
etc.) instead of what's built in to VSCode (v6.0.2). As the two can
drift, we end up with VSCode incorrectly highlighting certain syntax as
incorrect.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43064
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Certificate enrollment now verifies system delegation availability
before attempting installation, preventing unnecessary failures.
* **Bug Fixes**
* Enhanced error messages to include specific certificate alias and
delegation status information for better troubleshooting.
* Improved handling of system state exceptions during the enrollment
process.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Replace individual department-*.yml label files with a single
lib/all/labels/departments.yml and update it-and-security/default.yml to
reference the consolidated file. Removes the separate department files
and moves their label entries into departments.yml; behavior and label
criteria are unchanged — this is a refactor to reduce file clutter and
simplify label management.
Migrate Firefox management to the fleet-maintained app slug
(firefox/darwin): update workstations.yml to remove the old update
policy and replace the macOS software entry with the firefox/darwin
slug; add a dynamic label for Macs with Firefox installed; add a patch
policy that targets the fleet_maintained_app_slug and uses the new
label. Also remove legacy update policy and package files for Firefox
(macOS and Windows) and the hardcoded Firefox pkg URL. This consolidates
Firefox management under Fleet-maintained apps and removes
duplicated/obsolete artifacts.
## Summary
- Removes YubiKey/Yubikey mentions from onboarding-related handbook
pages
- Security policy pages (`handbook/it/security.md`) are intentionally
**not** modified
## Changes
### `handbook/it/README.md`
- Removed "and YubiKey security keys" from the equipment provisioning
intro
- Removed the bullet item to order YubiKey 5C NFC keys for new team
members
- Removed "and include Yubikeys (if requested)" from the shipping
checklist
### `handbook/company/leadership.md`
- Removed "do NOT receive Yubikeys" from the consultant distinction list
(no longer relevant since YubiKeys are not part of onboarding)
- Removed "and Yubikeys" from the core team member hiring description
### `handbook/company/communications.md`
- Removed "YubiKey security keys," from the tools & equipment overview
---
Built for [Isabell
Reedy](https://fleetdm.slack.com/archives/D0AEGJCGJR0/p1775558324267559?thread_ts=1775484858.521199&cid=D0AEGJCGJR0)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
**Related issue:** Resolves#42881
- Added user_api_endpoints table to track per user API endpoint
permissions.
- Added service/api_endpoints, used to handle service/api_endpoints.yml
artifact.
- Added check on server start that makes sure that
service/apin_endpoints.yml is a subset of router routes.
