<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45946
Unreleased bug.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
**Bug Fixes**
- Enhanced Windows setup experience cancellation to accurately validate
device enrollment status before processing cancellations
- Improved device identification reliability during concurrent
operations through robust fallback mechanisms that reference recent
enrollment records when initial lookups fail
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45994?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Make MSIX installs (Claude, Slack) provision machine-wide and
opportunistically register the package for the currently logged-on
console user by creating and running a scheduled task in that user's
session. This avoids running Add-AppxPackage as Local System (which can
surface HRESULT 0x80073CF9), captures per-user install exit codes, waits
for task start/completion with timeouts, and performs cleanup of the
task and helper files. Also bumps Claude to 1.8555.0 (URL, sha256, and
install script ref updated) and updates Slack's install script
reference. Adds a changelog entry describing the fix.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45356
The Fleet Android Agent's orbit-enroll did not match the existing
AMAPI-created host record on Fleet instances with Apple MDM disabled,
creating a duplicate hosts row alongside the AMAPI-enrolled one. The
Android-specific UUID match clause in matchHostDuringEnrollment was
gated by isMDMEnabled, which only reflects Apple MDM status. Gate the
clause on platform="android" instead. The Fleet Android Agent always
sends this since PR #43809, and the SELECT itself filters
platform=android, so the clause is Android-safe by construction and no
longer depends on the Apple-MDM flag. The serial-match clause keeps its
existing isMDMEnabled gate.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46001
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Updated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Prevents duplicate host records when enrolling Android devices on
instances with Apple MDM disabled.
* Improves enrollment host-matching so devices are identified by their
platform, reducing misattributed or duplicate hosts during enrollment.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46008?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Resolves#45066.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed user email/device mapping for Windows and Linux hosts enrolling
via end-user authentication (browser-based and EUA-token flows). Host
listings and device mapping now reliably show the IdP email after
enrollment, improving device identification and inventory accuracy.
* **Tests**
* Expanded integration tests to validate end-to-end enrollment and
device mapping across platforms.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45951?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
## Summary
Adds `tools/screencap`, a CLI for automated screenshots of the Fleet UI
via headless Chrome (CDP).
- **Built-in full workflow** captures all major pages and their
modals/tabs (dashboard, hosts, queries, policies, software, controls,
settings, account) in one command.
- **Record custom workflows** in a visible browser — clicks, tabs,
radios, checkboxes, and tooltip hovers are recorded automatically and
saved as replayable JSON under `tools/screencap/workflows/`.
- **Auth options** for SSO, email/password, or session cookie; the
Chrome profile is persisted at `~/.fleet/screencap-profile/` so sessions
survive across runs.
- **Output** is written to `screenshots/<timestamp>-<workflow>-<host>/`
as numbered PNGs, with multi-viewport pages split into separate images.
See `tools/screencap/README.md` for full usage.
## Test plan
- [ ] `cd tools/screencap && make build` produces the binary
- [ ] `./screencap -sso https://<fleet-host>` captures the full built-in
workflow
- [ ] `./screencap -record demo https://<fleet-host>` records a workflow
and saves it under `workflows/demo.json`
- [ ] `./screencap -workflow demo https://<fleet-host>` replays the
recorded workflow
- [ ] `./screencap -list` shows saved workflows
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a screenshot automation tool that records and replays UI
workflows, captures full-page and modal screenshots, restores scroll
positions, and supports session persistence and multiple login methods.
* **Chores**
* Added a minimal build/clean workflow for the tool and updated ignore
rules to avoid committing generated screenshots.
* **Documentation / Templates**
* Included example workflow templates demonstrating common navigation
and interaction sequences.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/42437?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Luke Heath <luke@fleetdm.com>
For article #45967: Rollout rings with Fleet labels.
Adds three drop-in label YAML files under docs/solutions/all/labels/:
rollout-rings.labels.yml — five cumulative dynamic labels (1%, 5%, 25%,
75%, 100%) for gradual software rollouts via labels_include_any. Each
ring is a superset of the previous.
rollout-waves.labels.yml — five disjoint dynamic labels covering the
same percentage breakpoints, for A/B experiments and per-wave reporting.
pinned-canaries.labels.yml — manual label for pinning specific hosts
(dev Macs, QA machines) into the first wave regardless of their natural
UUID shard.
All three use the same deterministic UUID-based shard expression
(positions 10 and 25, avoiding RFC 4122's fixed version/variant digits
at positions 15 and 20) so a host's ring assignment never changes across
reboots or agent reinstalls.
New folder docs/solutions/all/labels/ follows the existing pattern of
docs/solutions/all/policies/ and docs/solutions/all/queries/.
The companion article is in draft and will follow in a separate PR; it
references these files via
https://github.com/fleetdm/fleet/blob/main/docs/solutions/all/labels/...
URLs.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Documentation**
* Added comprehensive labeling solutions for managing staged rollouts:
manual pinned canaries for selecting priority hosts, cumulative rollout
rings covering multiple deployment phases (1%, 5%, 25%, 75%, 100%), and
partitioned rollout waves for balanced phased distribution strategies.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45971?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#41783.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Technicians can transfer hosts between fleets (Fleet Premium). Global
technicians can transfer via the Fleet UI and REST API; fleet-scoped
technicians can transfer between fleets they manage via the REST API.
* Bulk transfer selection added on the hosts list for eligible global
technicians, enabling multi-host transfers while preserving other bulk
behaviors.
* **Tests**
* Added and updated tests covering Transfer visibility and authorization
for global and fleet-scoped technician roles.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45956?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Extracts early config-validation logic out of `runServeCmd` and puts it
on the relevant config types in `server/config/`, following the existing
pattern used by `ConditionalAccessConfig.Validate(initFatal)` and
`AndroidAgentConfig.Validate(initFatal)`. (First commit on this branch
did the extraction into a separate file in `cmd/fleet/`; reshaped per
review.)
`runServeCmd` is now a series of `config.X.Validate(initFatal)` calls:
- `config.Logging.Validate(initFatal)` — OTEL logs requires tracing
enabled
- `config.Osquery.Validate(initFatal)` — `host_identifier` must be one
of `provided`, `instance`, `uuid`, `hostname`
- `config.Server.NormalizeURLPrefix()` +
`config.Server.ValidateURLPrefix(initFatal)` — Normalize mutates,
ValidateURLPrefix is pure
- `config.Server.Validate(initFatal)` — `private_key` vs
`private_key_arn` mutex check (called before Secrets Manager retrieval
so a misconfig fails fast without paying for an external lookup)
- `config.Server.ValidatePrivateKeyLength(initFatal)` — minimum 32 bytes
(called after Secrets Manager retrieval so an SM-provided short key is
also caught)
The private-key checks are split into two methods rather than folded
into one because the XOR check has to fire before the SM call, and SM
retrieval populates `PrivateKey` — so a single Validate called twice
would false-positive the XOR check post-SM whenever the user originally
configured only `private_key_arn`. Open to feedback if a different split
is preferred.
Tests live in `server/config/config_test.go` next to the existing config
Validate tests, structured as one smoke case plus error branches per the
existing convention.
Behavior is preserved: `runServeCmd` still calls `initFatal` at the same
points with the same descriptions.
## Broader plan
Issue #33370 calls for moving logic out of `serve.go` ("should only
contain critical config and dependency injection logic"). This PR is one
slice. Follow-ups, each in their own small PR:
- Extract more config validations (Apple APNs/SCEP both-or-neither,
etc.)
- Use the `initFatal` injection from #45343 to cover runtime failure
paths (datastore init, Redis init, MDM init)
- Larger extractions (license init, MDM wiring, mailer init)
**Related issue:** Refs #33370
# Checklist for submitter
- [x] Added/updated automated tests
- [x] Input data is properly validated (validators added, no
SQL/JS/shell paths involved)
- Changes file: not applicable — internal refactor with no user-visible
behavior change
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes & Improvements**
* Centralized and strengthened startup configuration validation.
* Enforced mutual exclusivity for private key sources and minimum
private-key length.
* Added URL-prefix normalization (ensure leading slash, trim trailing
slash) and validation.
* Ensured OTEL logging requires tracing when enabled.
* Restricted osquery host identifier to supported values.
* **Tests**
* Added tests covering validation rules and URL-prefix
normalization/validation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45583?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37503
Test-code changes only. No product changes.
Adding Windows SCEP support for osquery and Windows integration tests.
Refactoring so that code can be reused from Apple client.
Can be used when working on
https://github.com/fleetdm/fleet/issues/45550
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved Windows MDM SCEP certificate installation handling during
profile enrollment (avoids duplicate responses and properly tracks
handled commands).
* **Monitoring & Observability**
* Added SCEP enrollment metrics: requests, successes, and errors.
* **Tests**
* Expanded unit and integration tests for Windows SCEP parsing,
enrollment flows, and end-to-end profile verification.
* **Refactor**
* Centralized SCEP exchange logic for Apple and Windows test flows.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44562?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Changes the primary CTA button in the hero section of the
`/linux-management` page from "Read the whitepaper" (linking to
`/whitepapers/it-leaders-guide-to-linux-device-management`) to "Talk to
an engineer" (linking to `/contact`).
- This aligns the page with the site's standard contact flow for landing
pages driving inbound traffic, making it easier for visitors to engage
directly with the Fleet team.
## Changes
- `website/views/pages/linux-management.ejs`: Updated hero CTA button
text and href.
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/C097P4TAPRR/p1779368832256439?thread_ts=1779368819.494599&cid=C097P4TAPRR)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
Closes#45969
## Summary
The `List certificate templates` API endpoint returned `null` for
certificates because the **API docs documented the wrong query parameter
name**. The docs said `fleet` but the code accepts `fleet_id` (or the
deprecated `team_id`). Customers following the docs used `?fleet=11`,
which was silently ignored, causing the endpoint to default to team 0
(unassigned) -- which typically has no certificates.
- **Docs fix**: Changed the parameter name from `fleet` (string) to
`fleet_id` (integer) in the REST API docs, matching how all other list
endpoints document this parameter.
- **API quality fix**: Initialize the `templates` slice in
`GetCertificateTemplatesByTeamID` so that when no templates exist, the
JSON response returns `"certificates": []` instead of `"certificates":
null`.
## Root cause
In `docs/REST API/rest-api.md`, the "List certificate templates"
endpoint documented the query parameter as `fleet` (string), but the
request struct accepts `fleet_id` or `team_id`:
```go
type listCertificateTemplatesRequest struct {
TeamID uint `query:"team_id,optional" renameto:"fleet_id"`
}
```
When the customer used `?fleet=11` (as documented), the parameter was
unrecognized and silently ignored. The endpoint defaulted to `team_id=0`
(unassigned), which had no certificates. The nil Go slice then
serialized to JSON `null`.
Credit to Andrey Kizimenko for identifying the docs mismatch.
## Changes
- `docs/REST API/rest-api.md` -- Fix parameter name from `fleet`
(string) to `fleet_id` (integer)
- `server/datastore/mysql/certificate_templates.go:174` -- Initialize
slice to avoid `null` in JSON
- `server/datastore/mysql/certificate_templates_test.go:489` -- Add
`require.NotNil` regression test
## Testing
All tests run locally against a real MySQL (Docker) and Redis instance:
| Test suite | Command | Result |
|---|---|---|
| Datastore integration (all certificate tests) | `MYSQL_TEST=1 go test
-run TestCertificates ./server/datastore/mysql/...` | 11 suites, 33
subtests, all PASS |
| Service unit tests | `go test -run
"TestCreateCertificateTemplate\|TestApplyCertificateTemplateSpecs\|..."`
| 4 suites, all PASS |
| Enterprise integration (full HTTP) | `MYSQL_TEST=1 REDIS_TEST=1 go
test -run "TestIntegrationsEnterprise/TestCertificatesSpecs"` | PASS |
| Enterprise integration (team delete) | `MYSQL_TEST=1 REDIS_TEST=1 go
test -run
"TestIntegrationsEnterprise/TestDeleteTeamCertificateTemplates"` | PASS
|
| Static analysis | `go build`, `go vet` | Clean |
Andrey's reproduction confirmed via screenshots:
- `?fleet_id=11` returns certificates correctly
- `?fleet=11` (the documented param) returns `null` -- the bug
- No param returns results when "unassigned" team has certificates
## QA steps
1. Follow the API docs to list certificate templates using
`?fleet_id=<id>`
2. Verify the response contains `"certificates": [...]` with the correct
data
3. Call without `fleet_id` and verify `"certificates": []` (not `null`)
for a team with no templates
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed the "List certificate templates" API documentation with the
correct query parameter name, enabling proper filtering of results.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45978?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds a new "Health, dental, and life insurance" subsection to the
Benefits section of the company handbook
(`handbook/company/communications.md`)
- Documents the premium US benefits plan (health, dental, life) with
66%+ dependent coverage
- Documents international employee premium health benefits via
Remote.com
## Changes
Added a new `### Health, dental, and life insurance` subsection at the
top of the `## Benefits` section (before Paid time off), since health
insurance is the most fundamental benefits offering.
---
Built for [Isabell
Reedy](https://fleetdm.slack.com/archives/D0AEGJCGJR0/p1779363636464629?thread_ts=1779363462.853629&cid=D0AEGJCGJR0)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Isabell Reedy <113355639+ireedy@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45862
Speculative fixes since I wasn't able to repro issue locally.
Refresh AppContext and the React Query ["config"] cache directly after
the SSE/DELETE response so AndroidMdmCard and AndroidMdmPage flip
without a manual page reload, with a bounded retry to defeat the 1s
cached_mysql.AppConfig TTL. Also harden startSSE to detect the success
signal across chunk boundaries and reject (rather than hang) when the
stream ends without it.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed Android Enterprise page not refreshing after connecting or
disconnecting Android MDM. The Enterprise ID and card state now update
automatically without requiring a manual page reload.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45914?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
iteration 1
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Launched a comprehensive Windows Device Management landing page
showcasing Fleet's Windows MDM features, capabilities, and deployment
options. The page features detailed product information, multiple
hosting configurations (self-hosted, Fleet-hosted, air-gapped), verified
customer testimonials, video demonstrations, and a comprehensive FAQ
section addressing Windows MDM enrollment, management, and support
topics. Accessible at `/lp/windows-mdm`.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45690?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38785
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a manual "force rebuild" option to trigger base MSI/PKG rebuilds
regardless of automatic checks.
* **Chores**
* Improved update detection to more reliably decide when rebuilds are
required by comparing current and new metadata and by validating publish
timestamps.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45907?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Comments out the Quality Assurance Engineer position from
`handbook/company/open-positions.yml` to remove it from the website's
active job listings.
## Changes
- Commented out the full QA Engineer entry (job title, department,
hiring manager details, responsibilities, and experience requirements)
using YAML `#` comment syntax, consistent with other inactive positions
in the file.
---
Built for [Isabell
Reedy](https://fleetdm.slack.com/archives/D0AEGJCGJR0/p1779307558878359?thread_ts=1779307544.204199&cid=D0AEGJCGJR0)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Victor Lyuboslavsky
