A bunch of little things I found while working on an unrelated PR awhile
back (handled here to reduce API design diff):
+ Fix broken link formatting
+ Finish up incomplete "Cancel batch script docs"
+ Fix ordering of "Get vulnerability" sections
+ Remove note about feature being GitOps-only (no longer true)
+ Add missing link to section contents
+ Add missing endpoint to `api_endpoints.yml`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added ability to cancel running batch script executions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Brought back the "Manage, update, and secure all your devices like
it's 2026" heading on the homepage
- Moved the quote from Wes on the homepage to be next to the statistics
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Updates
* **Updates**
* Refreshed homepage hero section with new headline and supporting text
* Added new call-to-action buttons: "Get a demo" and "Join a workshop"
* Enhanced hero layout and styling with improved responsiveness across
all device sizes
* Restructured testimonial quote section with improved visual
presentation
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
Setup experience is pretty hard to reason about through code alone, and
there isn't really any existing documentation for it outside of code
comments.
---------
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
**Related issue:** N/A — adds Vivaldi to the Fleet-maintained apps
catalog.
## Summary
Adds **Vivaldi** as a Fleet-maintained app for **macOS** and
**Windows**.
- **macOS (`vivaldi/darwin`)** — Homebrew cask input plus a
`VivaldiDMGInstaller` enricher that redirects Homebrew's unsupported
`tar.xz` download to Vivaldi's direct universal DMG
(`https://downloads.vivaldi.com/stable/Vivaldi.{version}.universal.dmg`),
keeping `installer_format: dmg` so the standard `hdiutil`-based
install/uninstall scripts are generated. `unique_identifier` is the
verified bundle id `com.vivaldi.Vivaldi`.
- **Windows (`vivaldi/windows`)** — winget input (`Vivaldi.Vivaldi`)
with custom install/uninstall scripts. Installs **machine-wide** with
`--vivaldi-silent --do-not-launch-chrome --system-level`. Because Fleet
runs installers as `SYSTEM`, the `--system-level` flag is required —
without it the Chromium-based installer lands in the `SYSTEM` profile
and is invisible to the real user. The exists query matches the registry
`DisplayName` `Vivaldi` and verified `Publisher` `Vivaldi Technologies
AS.`; the uninstall script looks up the entry under HKLM (with an HKCU
fallback) and runs the Chromium uninstaller with `--force-uninstall`.
Outputs were regenerated via the ingester (`go run
cmd/maintained-apps/main.go --slug=...`) at Vivaldi **8.0.4033.46**;
script refs are content-addressed, not hand-edited.
## Changes
- `ee/maintained-apps/inputs/homebrew/vivaldi.json`,
`ingesters/homebrew/external_refs/vivaldi.go` (+ registration in
`main.go`) — macOS input and DMG-URL enricher
- `ee/maintained-apps/inputs/winget/vivaldi.json` +
`scripts/vivaldi_install.ps1` / `vivaldi_uninstall.ps1` — Windows input
and custom machine-wide install/uninstall
- `ee/maintained-apps/outputs/vivaldi/darwin.json`,
`vivaldi/windows.json`, `outputs/apps.json` — generated catalog entries
(with descriptions)
- `frontend/pages/SoftwarePage/components/icons/Vivaldi.tsx` +
`index.ts`, `website/assets/images/app-icon-vivaldi-60x60@2x.png` —
UI/website icon
# Checklist for submitter
- [x] Input data is properly validated; untrusted data interpolated into
shell scripts/commands is validated against shell metacharacters.
(Silent-install flags are documented Vivaldi switches; the uninstall
script parses the registry UninstallString defensively.)
## Testing
- [x] Regenerated both outputs via the ingester; verified
`installer_url`, SHA, and non-empty install/uninstall script refs.
- [x] Verified macOS `unique_identifier` (`com.vivaldi.Vivaldi`) and
Windows identity (DisplayName `Vivaldi`, Publisher `Vivaldi Technologies
AS.`) against the cask/winget manifests.
- [x] `apps.json` validates as JSON; `go build
./cmd/maintained-apps/...` and `GOOS=windows go build
./cmd/maintained-apps/validate/` pass.
- [ ] QA'd all new/changed functionality manually (via the FMA validator
on macOS + Windows hosts).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for Vivaldi browser across macOS (Homebrew) and Windows
(Winget) platforms with version management capabilities.
* Included automated installation and uninstallation scripts for both
operating systems.
* Added Vivaldi icon to the application interface.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
## Summary
- Documents that on macOS 15.7, FileVault cannot be enabled locally
through System Settings when the end user account type is set to
Standard or Skip (no account).
- Adds notes to both the setup experience guide and the enforce disk
encryption guide with the workaround (enforce disk encryption via
Fleet).
- Notes that this issue does not affect macOS 26.
Closes#47711
Related to #47680
Built for [Mel
Pike](https://fleetdm.slack.com/archives/D0AKX7DJFCN/p1781726233185189?thread_ts=1777299502.461149&cid=D0AKX7DJFCN)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Changes:
- Added `rachaelshaw` as a maintainer for
`server/api_endpoints/api_endpoints.yml`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated internal maintainer configuration for API endpoints file
management.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves
https://github.com/fleetdm/fleet/issues/41968
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for using Fleet variables (`$FLEET_VAR_HOST_*`) in
Android configuration profiles, enabling per-host dynamic value
substitution during deployment.
* **Improvements**
* Strengthened Android profile validation to reject unsupported Fleet
variables and prevent invalid placements (for example, using variables
in JSON object keys or non-string fields).
* Enhanced deployment behavior when variables can’t be resolved for a
host, marking affected profiles as delivery failed and avoiding partial
policy application.
* Improved Android per-host rollout by applying installs in staggered
batches for smoother throughput.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **`api_endpoints.yml`**
* Added new Fleet API documentation entries for creating configuration
profiles and updating setup experience.
* Added documentation for creating Android web apps.
* Expanded Android Enterprise coverage by adding a new “Get Android
Enterprise” entry (kept disabled).
* Added complete documentation for certificate authority management,
including list, retrieve, update, and delete.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated supported application versions and deployment metadata for 20+
applications, including Arc, AWS CLI, Claude, Cursor, Cyberduck, Deezer,
Firefox, Godot, Insomnia, pgAdmin4, and others, to ensure latest
releases are properly recognized and deployable across macOS and Windows
environments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Add VSCodeUniversalInstaller to rewrite Homebrew's arm64-only VS Code
URL to the architecture-independent "darwin" (universal) path and set
SHA256 to "no_check". Register the transformer in external_refs main.go
and update the visual-studio-code darwin.json to use the new
installer_url and no_check sha256 so the FMA installs work on both Intel
and Apple Silicon Macs.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added macOS installation support for Visual Studio Code with universal
installer path configuration.
* **Updates**
* Updated installer URL routing to use architecture-agnostic deployment
path for improved compatibility.
* Modified SHA256 verification settings for the macOS installer.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Updated the `<parallax-city>` component to show a static image and
renamed it `<cloud-city>`.
- Removed the gradient that appears on pages where the `<parallax-city>`
component is used
- Updated pages to use the component's new name.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Introduced a new static cloud-city banner component across the site,
replacing the previous parallax-animated city banners.
* **Style**
* Added new responsive styling for the cloud-city banner (including
breakpoint-specific background/height behavior).
* Removed the old parallax-city banner styling.
* Removed bottom “gradient” background sections on multiple pages to
clean up the visual transitions between sections.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Unreleased bugs while going through test plan
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Apple Business Manager (ABM) token team assignments now stay
synchronized when team defaults change across BYOD, macOS, iOS, and
iPadOS.
* “No team” selections are now saved as cleared (empty) assignments for
cleaner configuration output.
* Improved ABM token cleanup during team deletion to remove references
tied to the deleted team.
* **Tests**
* Added/extended coverage for ABM token team update behavior (including
invalid team handling and nil inputs) and deletion cleanup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The fleetd install Add and Exec were enqueued as two separate Windows
MDM commands ordered only by created_at (1-second granularity), so they
could be delivered Exec-before-Add. The device then ran DownloadInstall
on a not-yet-created node, returned 404, and fleetd never installed,
which could hang the Windows Autopilot Enrollment Status Page. Enqueue
them as a single command so Add always precedes Exec.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47683
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed intermittent fleetd installation failures during Windows MDM
enrollment that could cause the Windows Autopilot Enrollment Status Page
to hang.
* **Documentation**
* Updated Windows MDM fleetd installation documentation to reflect the
fix.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47811
# Details
- Outline the slot containing 'now' (the timeframe still being
collected) with a fleet-black-50 border.
- Show 'No data' instead of a host count in the tooltip for the current
and future timeframes.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<img width="708" height="416" alt="image"
src="https://github.com/user-attachments/assets/2878c72b-6c56-4302-b77f-2c9ebdaf9c8c"
/>
<img width="706" height="412" alt="image"
src="https://github.com/user-attachments/assets/a17a37a3-7264-42aa-9880-db3c68946c56"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced checkerboard graph visualization to clearly distinguish
current time slots from future (uncollected) time slots with distinct
visual styling
* Updated tooltips and accessibility labels to display "No data" for
future time periods
* **Tests**
* Added test coverage for current and future time cell behavior
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated macOS app management and deployment configuration for seven
applications: Adobe DNG Converter (18.4), CloudMounter (4.18), Downie
(4.12.8), Framer (2026.24.3), Hive App (1.2.1), Microsoft 365 Copilot
(1.2606.0801), and Mullvad Browser (15.0.16). Installation and patching
metadata have been synchronized with the latest available releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Windows and Linux hosts that had already orbit-enrolled were prompted
for end user authentication (an SSO browser tab) when fleetd re-enrolled
after a service restart, node key file loss, or osquery DB rebuild.
Hosts enrolled before EUA was enabled have no host_mdm_idp_accounts row,
so the service-layer EUA gate treated every re-enroll like a brand-new
device.
Before returning END_USER_AUTH_REQUIRED, EnrollOrbit now checks whether
a host matching the enrollment identifiers already exists and previously
held an orbit node key (HostPreviouslyOrbitEnrolled, reusing
matchHostDuringEnrollment's semantics). If so, the re-enroll proceeds
without prompting. Genuinely new devices, and hosts moved to a different
Fleet server, are still gated.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46300
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
**Bug Fixes**
* Fixed unnecessary end-user authentication prompts for Windows and
Linux hosts during fleetd re-enrollment after a service restart.
Previously enrolled devices can now re-enroll without being prompted for
SSO authentication, while new devices still require the appropriate
authentication.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- [x] QA'd all new/changed functionality manually
For the following quick win:
- https://github.com/fleetdm/fleet/issues/47784
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the error message shown when saving a custom variable fails
due to a missing required private key configuration, including a direct
link with guidance to resolve it.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Sharon <sharon@fleetdm.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed a scheduled ritual from the product design handbook.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#47552
Currently, a corruption in the download process is caught by our TUF
updater and will re-download.
So the main scenario we are covering here is a corruption in the
extraction process of the .tar.gz components.
I'm simulating this by modifying the executables in the hosts and
restarting (now with these changes it self-heals).
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Orbit now self-heals corrupt component binaries by detecting
executables that fail to run, removing the broken artifacts,
re-downloading, and re-verifying before continuing (including the
osqueryd and Fleet Desktop components).
* **Bug Fixes**
* Prevents endless crash loops caused by truncated or otherwise invalid
on-disk binaries.
* **Tests**
* Added coverage for exec verification and target cleanup/re-download,
including corruption, healthy binaries, and cross-platform behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46322
I'm not sure why, but it already had pagination? I suspect the frontend
filtering was breaking it, so I moved the platform filtering to the
backend via the `MatchQuery` query param.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Fixed pagination for OS version lists containing more than 8 entries.
* Improved OS version filtering so platform queries are applied
consistently before pagination, yielding correct results and counts.
* Enhanced OS version list coverage with a new test validating
platform-specific filtering and ordering.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Added api/responses/notFound.js, an updated version of the notFound
response built into Sails that sets a `hideFooter` page local variable
to hide the website footer on the 404 page.
- Updated the styles and layout of the 404 page to match the latest
wireframes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Completely redesigned the 404 error page with refreshed content and a
more modern layout.
* Added new visual styling, including animated interactive elements on
the 404 page.
* **Bug Fixes**
* Improved 404 response handling to consistently return the correct
status for JSON requests and render the 404 page when available.
* Ensures the 404 page can render cleanly even if view rendering fails,
and hides the footer for a cleaner error-page presentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#46245
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Refined MDM enrollment status filter tooltip text for improved clarity
on enrollment states.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45948
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Updated Windows ESP failure copy with clearer “Reset your device to
try again…” wording.
* When not all apps are required, added a **“Reset PC and Continue
Anyway”** soft-block option and continuable error text that lists failed
app names with truncation (“N more”).
* **Bug Fixes**
* Improved SyncML generation by escaping XML-sensitive characters in
embedded text.
* **Tests**
* Added/expanded unit and property-based tests covering continuable
error formatting, soft-block behavior, and SyncML XML escaping.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#21818
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* The CLI now detects when SSO is enabled on the server and shows a
warning directing users to authenticate with an API token (with guidance
link) instead of email/password.
* **Bug Fixes**
* Authentication error messaging is now SSO-aware, improving guidance
when credential login fails.
* **Tests**
* Added coverage to verify the authentication guidance changes correctly
based on whether SSO is enabled.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Juan Fernandez <juan@fleetdm.com>
## Summary
Adds the loadtest metrics for the **4.86 → 4.87 migration** run,
following the existing `tools/loadtest/metrics/runs/migration/`
convention (cf. `485to486mig`).
Two files:
- `486to487mig-2026-06-17-195042Z-1h.md` — 1h metrics synopsis
- `486to487mig-2026-06-17-195042Z-1h.json` — raw collected metrics
## Results (1h window, 2026-06-17)
✅ All metrics within expected thresholds
- Fleet errors: **0**
- RDS deadlocks: **0**
- Abnormal container stops: **0**
- ALB 5xx: **0**
Data only — no code changes.
cc @AndreyKizimenko for approval.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added load testing metrics data capturing performance statistics for
infrastructure components including Fleet Server, database, caching, and
load balancer metrics during a 1-hour test window.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Pd macOS app to version 0.56.5
* Updated Postman macOS app to version 12.15.6
* Updated SideNotes macOS app to version 1.6.2
* Updated Zed macOS app to version 1.7.2
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#35615
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved YAML output generation for agent options. Empty command line
flags are now cleanly omitted, and unnecessary comment blocks are
removed for a more concise output structure.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** #44719
Also, make sure the **Dashboard > Activity > Automations** modal is
grayed out when in GitOps mode.
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Standardized button labels across modals to use "Example payload" /
"Example data" consistently instead of mixed "Preview" or "Show/Hide"
variants.
* **Bug Fixes**
* Disabled relevant controls (example toggles, payload preview,
destination URL inputs, toggles) when GitOps mode is enabled so UI
reflects read-only mode.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Baseline loadtest results for Fleet 4.87.0 (20h run).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added baseline load test performance metrics for infrastructure
monitoring and analysis.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Introduce Spokenly to the catalog and UI: add homebrew input metadata,
add apps.json entry, and add darwin output with version 2.22.1,
installer URL, sha256, and install/uninstall script refs. Also add
frontend icon component and image, and register Spokenly in the icon
index mapping.
**Related issue:** Resolves#47524
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
## Context
[CVE-2026-34182](https://nvd.nist.gov/vuln/detail/CVE-2026-34182) (CVSS
9.1, Critical) is an OpenSSL CMS `AuthEnvelopedData` input-validation
flaw fixed in `openssl 3.5.7-r0`. The Alpine base image used by
`fleetdm/fleet` ships `3.5.6-r0`, which scanners (Aikido, Trivy) flag on
our published image.
`fleet serve` itself is statically compiled and does not link OpenSSL,
so the running process is unaffected — but the package is present in the
base image and shows up in customer-side SBOM scans.
## Approach
The issue's preferred path is a base-image SHA bump to `alpine:3.23.5`.
Docker Hub's latest `3.23.x` tag is still `3.23.4` (pushed 2026-04-15),
so that path isn't yet available. Applying the issue's fallback:
```dockerfile
RUN apk --no-cache upgrade openssl libcrypto3 libssl3
```
This pulls the patched `openssl 3.5.7-r0` from the Alpine 3.23 repos at
image build time without waiting on a new base tag. Once `alpine:3.23.5`
lands we can revert to a clean SHA-pinned `FROM` bump per the pattern in
#43671.
## Scope
Limited to `tools/fleet-docker/Dockerfile` per the issue's scope
guidance. Other Dockerfiles pinned to the same Alpine SHA (loadtest,
scep, mdmproxy) are out of scope here.
## Test plan
- [ ] CI image build passes.
- [ ] Trivy/scanner re-scan of the resulting `fleetdm/fleet` image
confirms CVE-2026-34182 is gone and `openssl` reports `3.5.7-r0`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated OpenSSL and related packages in Docker image build
configuration to ensure the latest versions are included during image
creation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47678
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Teams can now pin software titles to designate preferred versions for
tracking and management.
* **Chores**
* Database schema updated to support software title pinning.
* Updated team deletion procedures to handle associated pins.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated macOS application versions: 4k-YouTube-to-MP3 (26.1.5), Claude
for Desktop (1.13576.1), CMake (4.3.4), Codex (26.611.62324), and Loom
(0.354.2).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Updated version metadata and installer information for 63 maintained
applications across macOS and Windows platforms, including development
tools, browsers, communication utilities, and productivity software.
Updated version numbers, download links, and integrity checksums to
support deployment of latest stable application releases across
supported systems.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46059
Added `daemon_reachable` and `error` columns to the `santa_status`
fleetd table so the table reports a row when the Santa daemon is
unreachable instead of silently returning zero rows.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Reproduced the issue:
<img width="1476" height="255" alt="Screenshot 2026-06-17 at 11 12
55 AM"
src="https://github.com/user-attachments/assets/bf7f20c2-9e77-499d-9962-0996f5c57cb1"
/>
<img width="1644" height="632" alt="Screenshot 2026-06-17 at 11 14
34 AM"
src="https://github.com/user-attachments/assets/57c790b6-ccf2-4446-90a4-164cdcbacadd"
/>
Pushed a new orbit version with the fix to the TUF server:
<img width="689" height="58" alt="Screenshot 2026-06-17 at 11 34 25 AM"
src="https://github.com/user-attachments/assets/77b70d51-856f-4957-869e-1458540154dd"
/>
Ran the query again: we now return one row instead of no rows, and
`daemon_reachable = 0` is returned. Rest of the values are null.
<img width="2542" height="545" alt="Screenshot 2026-06-17 at 11 36
37 AM"
src="https://github.com/user-attachments/assets/6d71167e-9711-4284-9142-48629edbd9be"
/>
Approved the system extension and granted full disk access:
<img width="791" height="664" alt="Screenshot 2026-06-17 at 11 38 39 AM"
src="https://github.com/user-attachments/assets/3f4f91b0-d20a-4afc-93f9-347efe823beb"
/>
<img width="733" height="643" alt="Screenshot 2026-06-17 at 11 39 20 AM"
src="https://github.com/user-attachments/assets/596d3fb8-7b0e-4532-94d6-f5c28802f343"
/>\
Verified the state changed from `[activated waiting for user]` to
`[activated enabled]` and `santactl status` did not return errors:
<img width="1429" height="708" alt="Screenshot 2026-06-17 at 11 40
02 AM"
src="https://github.com/user-attachments/assets/f9402808-0755-478c-9c95-78aa2e5c65f4"
/>
Ran queries again and verified `daemon_reachable = 1`
<img width="2525" height="548" alt="Screenshot 2026-06-17 at 11 41
33 AM"
src="https://github.com/user-attachments/assets/bf65ec55-c719-48e1-9a29-4b38aa52a882"
/>
<img width="1656" height="528" alt="Screenshot 2026-06-17 at 11 42
34 AM"
src="https://github.com/user-attachments/assets/42b51b5b-9123-4919-beeb-b847a0a99668"
/>
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added `daemon_reachable` to Santa status monitoring to clearly
indicate reachability (`1` reachable, `0` unreachable).
* Added an `error` column to expose the `santactl status` error when the
daemon is not reachable.
* **Bug Fixes**
* Updated Santa status behavior so daemon communication failures now
return exactly one row with `daemon_reachable = 0` (and `error`
populated) instead of returning no rows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47650
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Improved authentication resilience by debouncing repeated unauthorized
responses and only triggering recovery after a grace period.
* Updated node-key handling to avoid treating empty key files as valid
and to prevent accidental deletion during short failures.
* Ensured node-key storage is written atomically to avoid partial or
empty credential files.
* **Tests**
* Added comprehensive test coverage for node re-enrollment behavior,
authentication grace-period timing, and atomic file write guarantees.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Relates to #43045
Skip carves whose upload has not completed (BlocksComplete) so cleanup
only reconciles carves that should already have a listable object.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45661
I couldn't really find another good solution that would solve it all, as
the path resolution is spread out, plus unassigned merging into global
config definitely makes it more complex (root cause of the issue).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed GitOps relative path resolution so controls and nested
organization settings correctly resolve referenced files from their
source directory, including cases with `unassigned.yml`.
* Corrected macOS setup assistant uploads to use the base filename
instead of the full configured path/URL.
* **Tests**
* Added regression coverage for GitOps relative path handling across
working-directory and nested-file scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45353
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added support for `$FLEET_VAR_HOST_*` variables in Android managed app
configurations, including host UUID, hardware serial, platform, and
end-user IdP details.
* **Improvements**
* Android app configurations are now validated to reject unsupported
Fleet variables.
* Fleet variables are substituted with real per-host values during
Android app configuration deployment, including batch/GitOps and
host-specific workflows.
* **Tests**
* Added unit and integration coverage for supported/unsupported
variables, substitution behavior, and JSON escaping.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#47343
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for providing an identity provider (IdP) UUID in
enrollment-token requests via an `idp_uuid` query parameter, affecting
both fully-managed and non-fully-managed flows.
* Enrollment OTA now carries the IdP UUID into the enrollment flow and
token request, with server-rendered pages exposing the selected IdP when
applicable.
* **Bug Fixes**
* For fully-managed enrollments, the IdP/SSO cookie is cleared after
successful authentication to avoid stale IdP selection.
* **Tests**
* Extended coverage for `idp_uuid` precedence over the IdP cookie and
for cookie-clearing behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Rachael Shaw
