Remove stale "frozen" flags from multiple input manifests and bump
versions/refs for several maintained apps. Changes include:
- Inputs: removed "frozen": true from homebrew and winget inputs for
adobe-acrobat-pro, backblaze, filemaker-pro, keeper-password-manager,
logi-options+, quip, telegram, and cloudflare-warp.
- Adobe Acrobat (darwin): bumped version to 26.001.21563, updated
install/uninstall script refs and install script content, added a
"patched" query.
- Backblaze (darwin): bumped version to 10.0.2.1048, updated installer
URL and sha256, reorganized/refactored installer refs and scripts, added
a "patched" query.
- Cloudflare WARP (windows): bumped version to 26.4.1350.0, updated
installer URL and sha256, updated patched query.
- Evernote (darwin): bumped version to 11.17.3 and added a "patched"
query.
- FileMaker Pro (darwin): bumped version to 22.0.6, updated installer
URL, sha256 and install script ref, adjusted patched query.
These updates refresh installers, checksums and scripts and enable
patched-version detection for the updated entries.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41683
Support for Android lock, wipe, and clear passcode commands. Behavior is
slightly different between BYOD and CODO. The fleetdm.com proxy isn't
wired up, so they only work with direct Google connection.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Clear-passcode CLI plus Android Lock and Wipe commands (Wipe
restricted to company-owned devices).
* BYO unenroll now removes only the work profile, preserving personal
data.
* Commands issued with a 10-year duration; UI/CLI show Android-specific
messaging and command IDs.
* **Improvements**
* Host MDM pages reflect command lifecycle transitions (pending →
acknowledged or error with code/message) via Pub/Sub updates.
* **Documentation**
* Updated docs for Android MDM commands, ownership rules, and command
duration.
* **Tests**
* New unit and integration tests for Android MDM flows.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46031?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Remove the frozen flag from the Homebrew input and update the darwin
output for com.google.GeminiMacOS: bump version to 1.60.2.323, update
the patched query to use the new version, and refresh the
install_script_ref (5a341444 -> e3521e04) along with its script content.
Installer URL and sha256 remain unchanged; uninstall ref unchanged.
Extracts the Apple APNs/SCEP both-or-neither check out of `runServeCmd`
and puts it on `MDMConfig` as `ValidateAppleAPNSAndSCEPPair(initFatal)`.
Same pattern as `ConditionalAccessConfig.Validate`,
`AndroidAgentConfig.Validate`, and the validators added in #45583.
The call site (inside the existing `if len(toInsert) > 0` gate) goes
from six lines of inline conditional `initFatal` calls to one method
call. Behavior, error messages, and gating are unchanged.
Tests live in `server/config/config_test.go`: one smoke case plus two
error branches (APNs-only and SCEP-only). Skipped the "neither set" case
on purpose — the outer `if config.MDM.IsAppleAPNsSet() ||
config.MDM.IsAppleSCEPSet()` gate in `runServeCmd` guarantees at least
one is set before the validator is ever reached.
This is the last pure config validation left in `runServeCmd` per the
broader-plan note on #45583. Remaining `initFatal` sites are runtime
failure paths (datastore init, Redis init, MDM init wiring) which need
the injection from #45343 — those would be the next slice.
**Related issue:** Refs #33370
# Checklist for submitter
- [x] Added/updated automated tests
- [x] Input validation (validator method plus tests; no SQL/JS/shell
paths involved)
- Changes file: not applicable, internal refactor with no user-visible
behavior change
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Apple MDM configuration validation to ensure APNs and SCEP
certificates are properly paired during setup.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46166?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This is an independent contribution. No part of this PR was generated,
reviewed, or influenced by any competitive or automated system.
## Summary
Fix a typo in a code comment: `explicty` → `explicitly`
## Root Cause
The comment on `TotalHostsCount` in `server/service/packs.go` contains
the misspelling `explicty` instead of `explicitly`.
## Fix
Corrected the spelling in the comment at line 18.
## Testing
- No functional changes — comment-only fix
- Go compilation unaffected
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Corrected spelling errors in internal code comments to improve code
quality.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45874?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
On my Fleet instance, "No team" was automatically named "Unassigned" in
the UI. If this isn't the case for a user, they need to rename the fleet
in the UI first, before changing the name in git.
Reference:
https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#:~:text=When%20renaming%20a,g.%20software%20packages
> When renaming a fleet, first update the name in the UI, then update
your YAML.
# Checklist for submitter
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated deprecation warning message for legacy configuration files to
provide clearer migration instructions, guiding users to update fleet
names and rename files to align with new naming conventions.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45486)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42219Resolves#42224
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced Windows MDM profile validation: uploads that are non-XML,
empty, or lack required SyncML top-level elements are rejected; LocURI
values that are empty, start with `/`, contain `..` path traversal, or
are otherwise malformed are now rejected (whitespace-trimmed),
preventing later device deployment failures.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46029?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Following the pattern we have for Clay updating historical events with
the campaign name, this updates the historical event to include the
campaign name for website events.
After the contact is created/updated, we now include the campaign name
as a parameter for the historical event to update/populate the existing
field on the sfdc historical event object.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Historical events for signups, newsletter subscriptions, contact/quote
requests, whitepaper downloads, workshop requests, and page views now
include campaign association to improve marketing analytics.
* **Bug Fixes / Reliability**
* Webhooks now fall back to the most recent campaign when none is
provided.
* **Chores**
* Backend responses now expose a mostRecentCampaign field to support
campaign attribution.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45750?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
Not seeing referrer data in SFDC, making this code consistent to
troubleshoot
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Standardized referrer attribution so referrer URLs are consistently
captured from attribution data and applied for both new and existing
contacts in the Salesforce integration, improving accuracy of marketing
attribution and recent referrer tracking.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46096?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
## Summary
- Adds 16px gap between the "AUTONOMOUS ENDPOINT MANAGEMENT" kicker (h4)
and the headline (h1) to increase whitespace between them
- Adds negative margin-bottom on the hero section to reduce the
excessive whitespace below the subtitle paragraph ("Humans approve every
change.") at all responsive breakpoints
Fixes spacing issues visible on mobile where there was too little space
after the kicker title and too much empty space below the hero text.
## Changes
-
`website/assets/styles/pages/landing-pages/autonomous-endpoint-management.less`
- Added `display: flex; flex-direction: column; gap: 16px;` to
`[purpose='page-hero-headings']`
- Added `margin-bottom: -80px` to `[purpose='landing-page-hero']`
(desktop)
- Added `margin-bottom: -40px` at 991px and 768px breakpoints
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1779395766217859?thread_ts=1779227314.466229&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
Closes: https://github.com/fleetdm/fleet/issues/45689
Changes:
- Updated the layout and content of the Linux management page to match
the latest wireframes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added comprehensive FAQ accordion (10 items) and a “Couldn’t find an
answer?” prompt.
* New content sections: distro checklist, feature rows (visibility,
control, IaC, lightweight deployment), testimonial/brand logos, and an
AI workflow.
* Updated hero copy and reinforced primary/secondary CTAs (contact and
workshop).
* **Style**
* Redesigned page layout with improved spacing, left-aligned hero, and
updated typography.
* Reworked responsive behavior across breakpoints; adjusted CTA/button
sizing and mobile spacing.
* Refined logo grid, quote layouts, and bottom call-to-action
presentation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46090?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Fixes#46079.
Migration `20260518194422_AddEncodingTypeToHostSCDData` was
cherry-picked into the 4.85.1 patch release. Customers upgrading from
4.85.1 → 4.86.0 then saw `WARNING: Your Fleet database is missing
required migrations` for 11 migrations that landed on `main` with
earlier timestamps but never shipped in 4.85.1.
This PR renumbers those 11 migrations to run after `20260518194422` and
regenerates `schema.sql`:
| Old timestamp | New timestamp | Name |
|---|---|---|
| 20260427134220 | 20260522195224 |
AddPreserveHostActivitiesOnReenrollmentToAppConfig |
| 20260428125634 | 20260522195225 |
AddManagedLocalAccountRotationColumns |
| 20260429180725 | 20260522195226 | CreateTableAppConfigurations |
| 20260430103635 | 20260522195227 | AddRequireAllToPolicyAndQueryLabels
|
| 20260506132626 | 20260522195229 | AddVPPCountryCode |
| 20260506171058 | 20260522195230 |
AddSubjectAlternativeNameToCertificateTemplates |
| 20260512143542 | 20260522195231 | AddOrbitDebugUntilToHosts |
| 20260512173249 | 20260522195232 | CreateTableVPPClientUsers |
| 20260512173250 | 20260522195233 | AddManagedAppleIDToHostMDM |
| 20260518124441 | 20260522195234 |
AllowNullTypeOnHostMDMManagedCertificates |
| 20260518150028 | 20260522195235 | AddOriginToHostCertificates |
This will be cherry-picked into `rc-minor-fleet-v4.86.0` once merged.
## Test plan
- [x] `go build ./...` passes
- [x] All 11 migrations run cleanly in order during `make
dump-test-schema`
- [x] No references to the old timestamps remain in the repo
- [ ] Spin up 4.85.1, run migrations, then run the 4.86.0 binary built
from this branch and confirm no `missing required migrations` warning
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Reorganized database migration sequencing to ensure consistent schema
updates during deployment.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46097?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Fixed an error in the build-static-content script that was preventing
a validation error related to article images stored outside the website
folder from being logged.
- Moved an image used in the enroll hosts guide to the
website/assets/images/articles folder, and updated the name to match
website conventions.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the overall stability and reliability of the article markdown
build process with enhanced error handling for image link processing.
The build system now gracefully manages edge cases when processing
various image link patterns and formats, preventing unexpected build
failures that could previously occur during content compilation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46093?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
Adds a missing `is_active=1` check to get the actual active installer
for the software automation's installer.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- I tested by pinning the version of the app to the older one, then
unpinning and back and checked that the policy is associated to the
correct installer with the query below.
- I did not manually test updating to a new FMA version. It's possible
to do that easily by creating a new branch with a newer version and
referring FLEET_DEV_MAINTAINED_APPS_BASE_URL to it.
```
SELECT
si.id,
si.team_id,
si.title_id,
si.filename,
si.version,
si.storage_id,
si.uploaded_at,
si.updated_at,
si.url,
si.fleet_maintained_app_id,
si.install_during_setup,
si.is_active,
si.patch_query,
si.http_etag,
p.patch_software_title_id,
p.software_installer_id,
p.query
FROM software_installers si
LEFT JOIN policies p on si.id = p.software_installer_id
WHERE filename LIKE "%<app name>%" AND platform = "darwin" AND
global_or_team_id = <team id>;
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Patch policies using software install automations now correctly
prioritize active installers, ensuring deployment uses the latest
appropriate version rather than inactive or outdated alternatives.
* **Tests**
* Added test scenarios to validate policy installer version selection
and active status during automation evaluation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46087?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45862
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- Already added in the previous PR.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved detection and reporting of enrollment errors sent by the
server, ensuring error messages surface reliably.
* Prevented streaming leaks by stopping background work when a client
disconnects.
* **Documentation / Protocol**
* Made server-to-client streaming more spec-compliant (framing,
heartbeats) for more robust Android Enterprise enrollment communication.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45988?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Luke Heath
