Fixed an issue where an SSO-only invitation could be accepted with a
password, creating a local password-authenticated account and
bypassing SSO enforcement. The authentication mode is now derived
solely from the invite. Derive the authentication mode from the invite
record instead of client input during invite acceptance.
The "Deploying Platform SSO with Okta Device Access" guide pointed
readers to the wrong Okta Admin Console tab and button when generating
SCEP credentials, so they couldn't reach the "Use Okta as certificate
authority" option.
Correct both the dynamic and static SCEP sections to match Okta's
current console flow (Device integrations → Endpoint management → Add
platform):
- "Device Access" tab → "Endpoint management" tab
- "Add SCEP configuration" → "Add platform"
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for the latest releases of numerous managed applications
across macOS and Windows, including ChatGPT, Claude, Cursor, Dropbox,
Microsoft 365 apps, RubyMine, Telegram, and others.
* **Bug Fixes**
* Updated installation downloads and integrity checks to match current
app releases.
* Improved cleanup for Dropbox and updated RubyMine and PyCharm
uninstall handling.
* Refreshed installation steps for applications with updated package
formats.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolvesfleetdm/confidential#16883
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Summary
Normalized LocURI target values before validation checks in Windows MDM
profile handling.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
- [x] Confirmed that the fix is not expected to adversely impact load
test results
### Reproduction
Wrote test cases that construct Windows SCEP profile XML with trailing
whitespace appended to LocURI paths (e.g., `/Install/SubjectName ` with
a trailing space). Before the fix, these profiles passed validation
without the required renewal-id marker because `strings.HasSuffix` did
not match the whitespace-suffixed path. The same bypass applied to
Challenge and ServerURL LocURIs.
### Unit tests added
7 new test cases across two test functions:
**`TestAdditionalNDESValidationForWindowsProfiles`** (3 new cases):
- SubjectName LocURI with trailing whitespace is still validated for
renewal id
- Challenge LocURI with trailing whitespace still validates correctly
- ServerURL LocURI with trailing whitespace still validates correctly
**`TestAdditionalCustomSCEPValidationForWindowsProfiles`** (new
function, 4 cases):
- Valid custom SCEP profile passes
- SubjectName missing renewal id is rejected
- SubjectName with trailing whitespace in LocURI is still validated for
renewal id
- SubjectName with internal whitespace (not trailing) is rejected
### Local verification
1. Wrote failing tests first, confirmed the whitespace bypass existed
(tests failed as expected before the fix)
2. Applied the fix (`strings.TrimSpace` on target before `HasSuffix`
checks)
3. Confirmed all new tests pass after the fix
4. Ran full test suite: `go test ./server/service/ -run
"TestAdditionalNDESValidation|TestAdditionalCustomSCEPValidation" -v`
with all 14 tests passing
5. Ran `make lint-go-incremental` with 0 issues
Changes:
- Updated the form on the /new-license page to link users who create a
quote for >700 hosts to the /contact page
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the high-volume license quote flow with a direct “Talk to us”
link to the contact page.
* **Style**
* Improved submit button alignment and hover visibility for clearer
interaction feedback.
* Removed outdated link styling from the new license page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new **Solutions Consultant, Channel** position to the
company’s open roles.
* Included compensation details, hiring manager information,
responsibilities, and experience requirements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48653
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved Apple Business Manager configuration handling when updating
team assignments, including creating the assignment entry when it
doesn’t already exist.
- Removing an Apple Business Manager token now also removes its
corresponding assignment details and properly updates configuration
status when no tokens remain.
- Prevented `generate-gitops` from exporting an empty `apple_business`
section when default fleets are configured only via the UI.
- **Tests**
- Expanded coverage for team assignment updates to validate creation of
new configuration entries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48845
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Apple MDM reconciliation no longer queues profiles for deleted or
non–MDM-enrolled hosts.
* Apple MDM reconciliation batching/snapshots now include only hosts
with confirmed active MDM enrollment, reducing incorrect or stale
reconciliation candidates.
* **Tests**
* Added MySQL datastore coverage to validate reconcile snapshot
selection and reconcile host lookup behavior.
* Improved Apple MDM and related test setups to explicitly ensure
required MDM server configuration exists before reconciliation
assertions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds a new Claude skill that encodes Fleet's house style for articles:
structure (title → dek → key takeaways → CTA button → intro → body →
closing CTA), voice rules, honest-claims guardrails, terminology rules,
and step-by-step workflows for writing new articles and updating
existing ones. Includes a blank article template in the skill's assets
folder.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
**Related issue:** N/A (documentation, handbook, and article changes
only)
## Details
Gives Fleet-maintained apps (FMAs) customer-facing documentation of the
process behind the catalog:
- **New handbook section** (`handbook/company/product-groups.md` >
"Fleet-maintained apps"): what FMAs are, how the catalog is kept up to
date (4-hour upstream checks, automated PRs, validation on real hosts,
human review, hourly server refresh), the freeze process, security
expectations (vendor-direct downloads, pinned SHA-256 hashes,
open-source manifests and scripts), service level objectives, and how to
request or contribute an app.
- **New article** (`articles/inside-fleet-maintained-apps.md`, publishes
to `fleetdm.com/articles/inside-fleet-maintained-apps`): a
customer-facing explainer of the same pipeline with a mermaid diagram of
the add/review/validation workflow, coverage of automatic updates,
version pinning, and patch policies, the security model, and a
contributor section highlighting the repo's `new-fma` Claude Code skill.
Follows Fleet's article format (dek, key takeaways, CTA button).
- **Cross-links** from the existing FMA guide
(`articles/fleet-maintained-apps.md`) and between the handbook section
and the article.
## Notes for reviewers
- The SLO "Publish a validated app update within 1 business day of
detection" in the handbook table is a **new public commitment**. The
other numbers (4-hour ingest checks, hourly server catalog refresh,
3-business-day review of new app PRs) are grounded in the existing
workflows, server cron intervals, and the FMA contributor README. Please
confirm the 1-business-day target before merging.
- The article's author meta is Allen Houchins with a publish date of
2026-07-17; adjust if it should ship later or under a different author.
- All process claims were verified against the repo:
`.github/workflows/ingest-maintained-apps.yml`, `cmd/fleet/cron.go`
(hourly `maintained_apps` schedule),
`ee/server/service/maintained_apps.go` (SHA-256 verification and
`no_check` behavior), and `ee/maintained-apps/README.md` (contribution
and freeze process).
# Checklist for submitter
- [x] Documentation, handbook, and article changes only. No product code
changes, so the changes-file, testing, database migration,
configuration, and fleetd checklists don't apply.
- [x] Manually verified all links resolve (website routes, GitHub paths,
in-page anchors) and that the website renders mermaid code blocks
(`website/views/layouts/layout.ejs` loads `mermaid.min.js`; precedent in
`articles/enroll-hosts.md`).
prep work for #49367
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for disowning Apple DEP devices, returning per-device
results (successful, failed, and inaccessible).
* **Bug Fixes**
* Improved consistency of authentication-related requests by carrying
over the original `User-Agent` when it is set.
* **Chores**
* Updated the bundled upstream dependency to a newer commit.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#47698
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for marking ABM tokens as invalid with a new
default-enabled status field.
* Existing token records are now initialized with a valid default state
during the update.
* **Tests**
* Added coverage to verify the new token status field is created
correctly and backfilled for existing records.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated BetterTouchTool for macOS to 6.651.
- Updated BetterZip for macOS to 6.0.
- Updated Downie for macOS to 4.12.11.
- Updated Firefox for macOS to 153.0, Firefox ESR to 140.13.0esr, and
Firefox Nightly to the latest build.
- Updated NordPass for macOS to 7.9.2.
- Updated Miro for Windows to 0.11.162.
- Updated Royal TS for Windows to 7.4.50721.0.
- Updated Typora for Windows to 1.14.7.
- Refreshed installer links and verification data for applicable
applications.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Token redemption consumed the key via a non-atomic read-then-delete,
which allowed concurrent requests to redeem the same one-time token more
than once. Made consumption atomic so a token can only be used once,
even under concurrent access, and added coverage for the concurrent
path.
Resolve the matching Fleet user from the persisted SCIM record rather
than the incoming request state when handling deactivation, so
deprovisioning still works when identifiers change in the same request.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated managed app packages to newer releases across macOS and
Windows, including Aptakube, AWS CLI, AWS VPN Client, ChatGPT,
CleanShot, DisplayLink, Firefox Nightly, Granola, Jamovi, Keyboard
Maestro, Microsoft 365 Copilot, NAPS2, Notion, Postman, Reqable, Tor
Browser, Typora, VirtualBox, WebCatalog, Webex, WhatsApp, and Wispr
Flow.
* Refreshed version detection logic and package integrity checks, along
with the associated download links.
* Updated installation behavior where required for DisplayLink,
Microsoft 365 Copilot, and NAPS2.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** No issue
Add Rajendra Kadam to Apple at Work team page.
Updated formatting for app request section in communications.md.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Changes:
- Updated the meta title of the /ai page (AI in IT » AI-powered IT)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the AI page’s metadata title to “AI-powered IT” for improved
page labeling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
systemd-run runs the detached child as a transient unit with
WorkingDirectory=/, so a relative $0 (e.g. ./uninstall-fleetd-linux.sh
per the uninstall guide) couldn't be found and the removal silently
never ran. Resolve $0 to an absolute path before re-exec.
Fixes#49411
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved the Linux uninstall process so the detached cleanup task
always runs from the correct script location.
- Enhanced compatibility between systemd-based environments and
non-systemd systems.
- Better supports script paths that include spaces or special
characters.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#49328
Adds Prisma Access Browser (Homebrew cask `prisma-access-browser`) as a
macOS Fleet-maintained app.
## Notes for reviewers
**Naming/slug:** This product already ships as a Windows FMA named
**Prisma Browser** (`prisma-browser/windows`, added in #46409 — "Prisma
Browser" is Palo Alto's current branding for what was Prisma Access
Browser). The FMA library combines platforms into one row by slug token,
so this entry uses `name: "Prisma Browser"` and `slug:
"prisma-browser/darwin"` while keeping `token: "prisma-access-browser"`
for the cask lookup (same token≠slug pattern as the `libreoffice`,
`ollama`, and `zoom` inputs). Both platforms now show as a single
"Prisma Browser" library row and share the existing Prisma icon, so no
icon changes are needed.
**Identity verified against the real installer** (downloaded the full
pkg; SHA256 matches the cask):
- `CFBundleIdentifier` = `com.talon-sec.Work` (from the pkg
Distribution/PackageInfo), so the exists query matches osquery's `apps`
table.
- `CFBundleShortVersionString` = `150.49.5.129`, exactly the cask
version before the comma, so the patched query's `bundle_short_version`
comparison reconciles.
- Installs `Prisma Access Browser.app` machine-wide to `/Applications`
as root; requires macOS 12+. Not a bootstrapper.
**Install script filename:** the cask's pkg artifact
(`PrismaBrowser-universal.pkg`) doesn't match the URL basename, but the
vendor serves that name via `Content-Disposition`, which is what the
server stores (`FilenameFromResponse`) and what orbit names the
downloaded installer on both download paths — so the auto-generated
install script works without a custom script.
**Installer URL** is pinned (version + hash in the path), so no
latest-redirect SHA-drift risk.
# Checklist for submitter
## Testing
- [x] Verified installer identity fields (bundle ID, versions, SHA256)
against the real pkg
- [x] `go test ./ee/maintained-apps/... ./cmd/maintained-apps/...`
passes; generated JSON validated
- [ ] FMA validator run (CI) confirms install/uninstall on a macOS host
Closes: https://github.com/fleetdm/confidential/issues/16847
Changes:
- Added a new page, AI-powered IT (/ai)
- Added links to the new page to the homepage, /linux-management,
/infrastructure-as-code, /device-management, and
/visibility-and-reporting pages
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an “AI-powered IT” page at `/ai`, including structured marketing
content, responsive hero imagery, and clear calls to action.
* Added an “AI-powered IT” entry to the Solutions navigation and updated
key page CTAs to link to `/ai`.
* **Style**
* Introduced and refined responsive `section-buttons`/button-group
layouts across multiple pages.
* Added dedicated styling for the new AI in IT page and adjusted related
feature-with-image spacing for better mobile presentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
The ESP release wrote the user-scope ServerHasFinishedProvisioning
Replace and immediately committed awaiting_configuration=None. During
OOBE the device rejects user-scope writes with SyncML 405 until its user
MDM context initializes, so the Account setup phase never received its
completion signal and the device hung until the 3-hour timeout, while
Fleet believed the ESP had completed (and relaxed the DMClient poll,
crippling remediation).
The release path now stays Active until the device acks the user-scope
Replace with a 200: a new resend phase re-sends the Replace once per
session (bounded by the existing 3-hour timeout), and the Active->None
transition commits only on the 200.
Live-validated on Win11 26200 on both a fresh and a re-enrolled device:
the 405 reproduced at release time in both flows, and the retried
Replace acked 200 one session after the user context came up, releasing
the ESP.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#49134
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
- Fixed an issue where Windows Autopilot enrollment could intermittently
hang at **“Account setup”** on the Enrollment Status Page.
- Updated Enrollment Status Page release handling so enrollment **stays
active until the device acknowledges** the user-scope completion
command.
- When the user-scope completion is rejected or still unacknowledged, it
is **retried in subsequent management sessions** until successfully
acknowledged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44954
When a custom host vital referenced in a script or profile has no value
set for a host, the delivery failure detail didn't name the vital,
making it hard for admins to tell which one needed a value. The message
now includes both the vital's name and its `$FLEET_HOST_VITAL_<id>`
token.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved missing custom host vital error messages by including both
the vital name and its corresponding environment variable identifier.
- Updated the wording to be clearer about why values can’t be populated
when no value is set for the host.
- Kept singular vs. plural messaging correct when one or multiple vital
values are missing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enabled the “Product Designer” role so it now appears on the open
positions page.
* Published complete position details, including department,
compensation range, hiring manager, responsibilities, and experience
requirements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Isabell Reedy <113355639+ireedy@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
Saw I missed these when doing the DDM assets backend
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Expanded endpoint coverage for device management asset routes,
including listing, retrieving, deleting, and batch creation.
* Documented a remaining limitation affecting multipart asset uploads.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48343
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
No changes file as this is covered by the base feature branch
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added the ability to edit existing configuration profiles, including
profile contents and targeting labels.
* Added file validation for supported profile formats and clearer
edit-specific error messages.
* Added activity feed entries and filtering for edited configuration
profiles.
* Updated profile actions with an edit option and improved team-specific
label handling.
* **Bug Fixes**
* Improved label data refreshing when switching between teams.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: andymFleet <andrewmellor@fleetdm.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48342
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for editing existing Apple, Windows, and Android
configuration profiles through the API.
* Supports updating profile content, names where applicable, label
targeting, and Fleet variable associations without replacing the profile
identity.
* Added support for editing Apple DDM declarations.
* Added activity tracking for configuration profile edits.
* **Bug Fixes**
* Added validation for unsupported edits, invalid labels, duplicate
names, missing profiles, and protected Fleet-managed profiles.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Changes:
- Added a case study from Primo
- Added a link to the new case study to the /customers page
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added a new Primo case study card to the Customers page, including its
logo, description, and navigation link.
- **Bug Fixes**
- Corrected the Customers page template block comment syntax to improve
rendering consistency.
- Updated case-study quote author images to display with a circular
shape.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Changed typo "manger" to "manager"
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Closes: https://github.com/fleetdm/fleet/issues/46496
Changes:
- Updated the website's custom hook to create a Google API auth client
and make it available at `sails.googleAuthClient`
- Updated Android proxy endpoints to use the shared Google API auth
client.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Optimized Google API authentication handling for Android management
features to improve system performance and reliability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Juan Fernandez