**Related issue:** Resolves#34521
Updated NDES add/edit modal:
<img width="649" height="592" alt="Screenshot 2026-01-27 at 11 29 20 PM"
src="https://github.com/user-attachments/assets/88a083e5-0ba3-40b9-9668-5cd0bfa427a1"
/>
Also - CA descriptions made consistent between modal and list:
<img width="1424" height="934" alt="Screenshot 2026-01-28 at 10 13
43 AM"
src="https://github.com/user-attachments/assets/b2266e45-30e7-40ad-b5b1-d1fa2cf97952"
/>
<img width="738" height="572" alt="Screenshot 2026-01-28 at 11 19 13 AM"
src="https://github.com/user-attachments/assets/b7e133a8-a055-41f7-b074-2f0db74f257c"
/>
- [x] Changes file added for user-visible changes in `changes/`
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for dynamic SCEP challenges for Okta certificates.
* **Improvements**
* Enhanced help text for NDES form fields with clearer references to
Network Device Enrollment Service configuration details.
* Align CA descriptions between cert list and cert options dropdown in
Add/Edit CA modal
* Improve organization of relevant code
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
# Details
v1.3.5 release of Chrome extension, including dependency fixes. v1.3.4
went to beta but will go unreleased since another dependency update came
in right after it, so just skipping ahead to v1.3.5.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] QA'd all new/changed functionality manually
- No functional changes, but did smoke tests on a Chromebook 👍
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#36335
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed false negative CVE vulnerability detection for 7-Zip
installations on Windows (MSI). Version numbers are now correctly
normalized to industry standards, enabling accurate identification of
applicable security vulnerabilities for this software.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37957
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
* **Enhanced pgAdmin 4 vulnerability detection** – Improved the system's
ability to identify pgAdmin 4-related vulnerabilities across multiple
platforms and installation configurations, addressing previously
undetected security issues.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#35281
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed false positives when detecting security vulnerabilities in
Microsoft 365 companion apps by improving targeting accuracy.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37651
Switched to issue the SCEP fleet challenge on demand instead of ahead of
time.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Resolved Android certificate enrollment failures caused by SCEP
challenge expiration during offline periods, improving enrollment
reliability when devices lack connectivity.
* **Improvements**
* Certificate challenges are now generated on-demand when requested by
devices, rather than pre-generated, enhancing offline enrollment
support.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35211
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35717
# Details
This PR adds a check before enqueuing setup experience items, so that if
the specified host has already been enrolled for > 24 hours we skip the
setup experience. This handles the edge case where an enrolled host
upgrades from an Orbit version that didn't support setup experience to
one that does.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
I didn't go through the process of getting a 1.48.1 fleetd installation
on my VM, but I tested in this way:
1. Installed fleetd on a host to a team with no setup experience items
2. Manually adjusted the `last_enrolled_at` date of that host's db
record to be > 24 hours in the past.
3. After enrollment, added setup experience items to that team. No setup
window popped up (expected).
4. Deleted the `setup_experience.json` file on that host and restarted
Orbit.
5. On `main` branch, the setup experience window popped up. When
repeating these steps on this branch, no window popped up.
6. Also verified that for a new enrollment wiht `last_enrolled_at` in
the last 24 hours, the setup experience window popped up as expected.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37111
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed false positive CVE detection for ninxsoft Mist, preventing
incorrect matching against unrelated vulnerability records.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request updates the naming and configuration for mobile device
teams and associated settings, primarily shifting references from
"Company-owned mobile devices" to "Employee-issued mobile devices"
across configuration files. It also introduces new team and organization
mappings and updates app store app ID formatting for consistency.
**Team and naming updates:**
* Renamed the team from "📱🏢 Company-owned mobile devices" to "📱🏢
Employee-issued mobile devices" in `company-owned-mobile-devices.yml`
and updated all related references in `default.yml`.
[[1]](diffhunk://#diff-b86f7c2a3c8266d5f17dc1cbb37b248bee72ce749c7e0c7f7d16f69c7265b821L1-R1)
[[2]](diffhunk://#diff-381910c0ec6788e1ad9a97eb1065cd37c6510f67d4c45d1fc93b2ca2d9fce0f3L28-R29)
[[3]](diffhunk://#diff-381910c0ec6788e1ad9a97eb1065cd37c6510f67d4c45d1fc93b2ca2d9fce0f3L38-R53)
**Configuration and mapping enhancements:**
* Added new organization and team mappings for both Fleet Device
Management Inc. and Mactivate LLC, including updates to `macos_team`,
`ios_team`, and `ipados_team` assignments.
[[1]](diffhunk://#diff-381910c0ec6788e1ad9a97eb1065cd37c6510f67d4c45d1fc93b2ca2d9fce0f3L28-R29)
[[2]](diffhunk://#diff-381910c0ec6788e1ad9a97eb1065cd37c6510f67d4c45d1fc93b2ca2d9fce0f3L38-R53)
* Expanded the list of teams under the Fleet Device Management Inc.
location and introduced a new `volume_purchasing_program` section with
appropriate team assignments.
**Formatting consistency:**
* Standardized App Store app IDs to use double quotes instead of single
quotes in the `app_store_apps` section of
`company-owned-mobile-devices.yml`.
This pull request introduces several updates to the configuration for
the Workstations team, primarily to support conditional access testing,
enhance device management, and expand policy coverage. The changes
include enabling conditional access, adding new configuration profiles
and scripts, and updating policies and software deployments.
**Conditional Access and Device Management Enhancements:**
- Enabled conditional access for the Workstations team by setting
`conditional_access_enabled: true` in the integrations section.
- Added new configuration profiles for conditional access and Santa
(macOS security tool), targeting specific test groups via labels.
[[1]](diffhunk://#diff-96f80858f5a487334ae6014cddaa65d1bb79d7e85fa0ea596d1e49063f5b99bdR49-R51)
[[2]](diffhunk://#diff-96f80858f5a487334ae6014cddaa65d1bb79d7e85fa0ea596d1e49063f5b99bdR72-R83)
- Included new scripts to support conditional access and device
security, such as creating allow files, installing/uninstalling security
tools, and enabling Windows Defender.
**Policy and Query Expansion:**
- Introduced new policies to check for Company Portal installation and
Entra conditional access compliance.
- Added a query to collect Santa denied logs for improved security
monitoring.
**Software Deployment Updates:**
- Added Company Portal for macOS as a self-service app for the
"Conditional access test group".
- Minor formatting update for the Keynote app store ID.
**Other Notable Changes:**
- Removed the "💻🐣 Workstations (canary)" entry from the organization
settings, streamlining team categorization.
- Cleaned up comments related to update channels in agent options for
clarity.
Resolves#38622.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [x] Setting(s) is/are explicitly excluded from GitOps
Related issue: #31916
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
- [x] Alerted the release DRI if additional load testing is needed
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed automation attempt tracking for policy automations to properly
reset attempt counters when policies, scripts, or software installers
are updated.
* Resolved handling of legacy policy automation attempts in the
database.
* **Tests**
* Added comprehensive integration tests for policy automation retry
behavior and state management.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changed the installer format for ExpressVPN from pkg to zip and added a
custom install script to handle extraction and installation. Updated the
version, installer URL, script reference, and SHA256 in the output
manifest to reflect the new release (12.1.0.12128).
Resolves#38484. This includes a CI job change to make sure we don't
introduce any more env vars that don't get proxied (and thus turned off
outside `--dev`).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
Manual QA touched hot paths, but did _not_ manually test every
FLEET_DEV_* environment variable change.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Centralized dev-mode environment management for consistent FLEET_DEV_*
handling and test-friendly overrides.
* Dev-mode allows targeted overrides for certain dev-only configuration
when running with --dev.
* **Chores**
* Migrated environment access to the centralized dev-mode helper across
the codebase.
* Added CI checks to enforce proper usage of FLEET_DEV_* variables.
* **Documentation**
* Added guidance on dev-mode environment variable rules and overrides.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
If the osquery version is new enough (>= 5.21.0), Orbit will set the
configuration option.
**Related issue:** #38663
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows (tested on
macOS but functionality is same on each platform)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves
https://github.com/fleetdm/fleet/issues/33522#issuecomment-3780274767
- Removes current "get the sha256 of a binary path directly"
functionality from the table as well, so it is now strictly for getting
the executable hashes for application bundles with the
`/Contents/Info.plist` > `CFBundleExecutable` and
`/Contents/MacOS/<executable>` structure
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35768
It doesn't fix the issue at hand, but we agreed to update the log to
include more information so if it happens again we have more insights,
we've been unable to reproduce the issue at hand, and it was reported
once from a customer and not again, as well as it would self-heal on the
next cron run (30 seconds)
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
^ Didn't add one, as it's not really a fix.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38777
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
This pull request removes the configuration and team settings for the
"Servers (canary)" group and updates the display name for the main
servers team. The most significant changes are the deletion of the
`servers-canary` agent options and team configuration, and a minor
update to the `servers` team name.
Removed configuration for "Servers (canary)":
* Deleted the `servers-canary.agent-options.yml` file, which contained
agent configuration and update channel settings for canary servers.
* Removed the `servers-canary.yml` team configuration, including team
settings, secrets, agent options, controls, and policy/query/software
placeholders.
Updated team naming:
* Changed the display name in `servers.yml` from "☁️ Servers" to "☁️ IT
Servers" for clarity.
Scott Gress