<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45715
# Details
This PR refactors the way the charts module stores historical data to
use the [roaring bitmap](https://github.com/RoaringBitmap/roaring)
package instead of saving raw bitmaps. See [this
blurb](https://github.com/RoaringBitmap/roaring#how-does-roaring-compares-with-the-alternatives)
to learn how roaring compresses data, but TL;DR for our purposes it
represents a huge improvement especially for larger deployments where
host ID numbers may be very large. In testing, some data was reduced
96%.
The majority of the changes in this PR are straight swapping of types
from `[]byte` to `*roaring.Bitmap` in vars and function signatures, and
updating the internals of our bit math helpers to use roaring methods
instead of native AND and OR methods. I've tried to comment on all
functional changes.
Since the charts have been shipped already, so there will be data in the
wild in the prior "dense" format, the code still handles dense bitmaps
on _read_, but will always _write_ roaring bitmaps. The majority of the
data will therefore have turned over within 30 days on its own, but I
plan on a follow-up PR that will transform open rows when the cron runs
so that we should be guaranteed to turn over completely within 30 days.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [X] Added/updated automated tests
- Tests updated to accommodate the new format, and existing unchanged
tests act as proof against regression
- [X] QA'd all new/changed functionality manually
- Using a tool that dumps the `host_scd_data` rows data into a JSON file
(with the keys being entity_id+data and the values being host IDs on
that date), compared the data from main branch and this and confirmed
they're identical
- With a host count of ~9000, some of which have IDs of over 1,000,000,
the data storage requirements were:
* 82,558,976 bytes for dense
* 2,867,200 for roaring (a 96% decrease)
For unreleased bug fixes in a release candidate, one of:
- [X] Confirmed that the fix is not expected to adversely impact load
test results
- should hugely improve
- [X] Alerted the release DRI if additional load testing is needed
## Database migrations
- [X] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Implemented roaring bitmaps in historical data collection to optimize
bitmap handling for chart data aggregation
* Added encoding support to bitmap storage schema for flexible data
representation
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Correct the 'patched' SQL predicates across many
ee/maintained-apps/outputs/*.json files by moving the version_compare
condition into the subquery's WHERE clause and removing the extra
parentheses. This normalizes the NOT EXISTS checks so installed-version
detection works as intended for both macOS and Windows app outputs.
This PR adds the company process for temporary landing pages to the
handbook.
For now, I have included it in the writing handbook, since this is where
we document processes for publishing content on the website. I plan to
separate these topics at a later date.
Created a handbook page to document brand guidelines.
- Added brand.md in the Company handbook folder.
- Intent is to have a dedicated page for brand-related content that can
grow and be easily seen by and shared with contributors, rather than
buried in the communications page.
- Added example brand images.
- Adjusted handbook image width
https://github.com/user-attachments/assets/ead7e92a-9a21-4438-895d-a93103086e37
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
Fleet is for both "IT engineers" and "IT admins", let's be inclusive in
the other direction to avoid confusion when placed side by side with
"For CISOs"
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **UI Updates**
* Reordered pricing mode options so the IT option appears before
Security.
* Updated IT option label text to better reflect its audience.
* Adjusted pricing-mode switch styling and responsive positioning so the
selected option aligns correctly across screen sizes.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45727?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
Changes:
- Updated the receive-from-stripe webhook to handle
`customer.subscription.updated` type events sent by Stripe when a
subscription's number of hosts is changed in the Stripe UI.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45700
Not a product change. This PR will allow us to run the workflow
manually. After ~2 weeks, if there are no issues, we'll make it
automatic.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automated workflow to identify and close stale issues created by
Fleet team members, with dry-run capability and operation limits.
* Added system to build and maintain a deduplicated list of Fleet team
member handles from GitHub organization and repository history.
* **Tests**
* Added comprehensive test suites for stale issue management and handle
list generation with mock GitHub API interactions and boundary condition
coverage.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45530?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43895
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Self-service install/uninstall activities now render in passive voice,
omit an actor name, and include a “(self-service)” marker across feeds
* Global admins see a "My device" button on host user cards that opens
the end‑user device page in a new tab; the link is refreshed/generated
as needed
* Device page and browser tab header show the end‑user's name when
available (fallback: "My device")
* **Tests**
* Added/updated coverage for self‑service activity rendering and the "My
device" flow
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45659?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Closes#43637
## Summary
- Adds `min-width: 0` to `.side-nav__card-container` so the flex child
can shrink below its content width, enabling horizontal scroll on data
tables inside the side-nav layout at narrow viewports.
## Root cause
`.side-nav__container` uses `display: flex`, and its child
`.side-nav__card-container` has `width: 100%` but no `min-width`
override. Flex children default to `min-width: auto`, which prevents
them from shrinking below their content width. This means `overflow-x:
auto` on `.data-table__wrapper` never activates because the parent chain
stretches to fit the table content instead of constraining it.
## Changes
**`frontend/pages/admin/components/SideNav/_styles.scss`** -- added
`min-width: 0` to `.side-nav__card-container`.
## Manual testing
- [x] Built and ran Fleet server locally (`make fleet && ./build/fleet
serve --dev --dev_license`)
- [x] Navigated to **Controls > Disk encryption**
(https://localhost:8080/controls/os-settings/disk-encryption?fleet_id=2)
- [x] Enabled disk encryption for the team and confirmed the table
rendered
- [x] Resized browser to smallest supported viewport width
- [x] **Before fix:** table columns were squished/truncated with no
horizontal scrollbar
- [x] **After fix:** horizontal scrollbar appeared and table content
scrolled correctly
- [x] Verified other pages using the SideNav component (e.g., Settings)
were not affected
## Unit tests
- [x] Ran all related frontend test suites (`SideNav`, `DiskEncryption`,
`TableContainer`) -- 39 tests, all passing
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Fixed side navigation layout to properly handle content overflow and
enable horizontal scrolling when navigation items exceed available
space.
* **Documentation**
* Added note: Disk Encryption > Disk encryption table now supports
horizontal scrolling on narrow viewports.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45736?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Summary
- Adds a `/pr-approvals` skill to `.claude/skills/` so all fleeties can
use it
- Quickly identifies who is blocking a PR merge by checking CODEOWNERS
(blocking) vs custom.js DRI (non-blocking)
- Usage: ask Claude "who needs to approve this PR?" or run
`/pr-approvals <number>`
## Test plan
- [x] Tested against PR #45696 (correctly identified @lukeheath as the
only blocker for openspec files)
- [x] Tested against PR #45663 (correctly identified failing CI, no
reviewer blocking)
- [x] Tested against PR #42435 (correctly identified missing @fleetdm/go
approval)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Summary
- Swap "Integrations" and "Support" between footer sections: "Support"
now appears under Solutions, "Integrations" now appears under
Documentation
- Remove "Orchestration" link from the footer entirely
- Add new "Downloads" link (pointing to `/download`) under the
Documentation section
## Changes
**Solutions section:**
- Removed "Orchestration"
- Removed "Integrations"
- Added "Support"
**Documentation section:**
- Removed "Support"
- Added "Integrations"
- Added "Downloads" (`/download`)
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1779125879174289?thread_ts=1778225078.313209&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
Resolves#36417.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
## Manual tests performed
✅ MDM enrollment first, then fleetd enrollment (checked both activities
match serial and display name is preserved).
✅ fleetd enrollment first, then MDM enrollment (checked both activities
match serial and display name is preserved).
<img width="520" height="383" alt="activities_mdm_macos_enrollment"
src="https://github.com/user-attachments/assets/35c74612-ad80-4245-bfd9-20a3dc5e78bb"
/>
✅ Enrolled ABM iPad.
<img width="599" height="65" alt="Screenshot 2026-05-18 at 10 57 23 AM"
src="https://github.com/user-attachments/assets/b7ad552b-82af-4606-a860-361eedb97483"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enrollment activities now show device serial numbers alongside host
display names, avoid duplicating the serial if already included, and
fall back to serial/generic messaging when no display name is available.
* Fleet enrollment entries no longer show an actor prefix, matching
other enrollment activity items.
* **Bug Fixes**
* Display names set by prior fleetd enrollment are preserved and no
longer overwritten during MDM enrollment.
* **Tests**
* Added and relaxed activity-feed tests covering enrollment message
variants.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45697?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#45520
The Pub/Sub status-report and enrollment handlers dereferenced
device.HardwareInfo before any nil check, so a payload from Google's
Android Management API with hardwareInfo omitted panicked the request
goroutine.
Fixes#42874
Empty, whitespace-only, and missing `FLEET_JIT_USER_ROLE_*` SAML
attribute values are now treated as `null` (ignored) instead of
returning an error, matching the literal `"null"` workaround.
Add a list of form-based contact sources and set
Most_recent_campaign_member_status__c to 'Registered' when contactSource
matches any of them. This marks contacts originating from website
contact forms, webinars, gated docs, and related sources as registered.
The change includes an eslint-disable-line camelcase comment for the
Salesforce field name.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced contact registration tracking to automatically set
appropriate campaign status when contacts are registered through
form-based sources such as webinars.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45427)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#45220
Here's one example why this is a good idea.
On `main`, the fleet production binary contains a private key used for
testing:
```
$ strings ./build/fleet | rg "BEGIN RSA TESTING"
proto3-----BEGIN RSA TESTING KEY-----
```
And it's gone when using this branch:
```
$ strings ./build/fleet | rg "BEGIN RSA TESTING"
<empty>
```
## Testing
- [X] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Reorganized and centralized SCEP test helpers and servers for
certificate enrollment tests.
* Added embedded HTML fixtures to better emulate SCEP/NDES admin
responses (cache/full, permissions, password).
* Standardized UTF‑16 handling for test responses and improved test
server response handling.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45619?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Scott Gress
