<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #NA
Found this while just browsing the codebase and testing some gitops
stuff.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed GitOps controls detection to correctly identify when controls
are set with specific configurations, including BitLocker PIN
requirements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Updated Cisco Jabber Windows to version 15.2.2.60904
* Updated ClickUp Desktop macOS to version 3.5.208
* Updated Raycast macOS to version 1.104.16
* Updated Thunderbird on macOS to version 150.0.2
* Updated Thunderbird on Windows to version 150.0.2
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Turns out his experience was for when he was at a customer that needs us
to get permissions to post. Taking down for now.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed a testimonial section from a landing page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#38437
The list activities endpoint applied an implicit `created_at <= now` cap
only when `start_created_at` was set, leaving the upper bound unbounded
in every other case, this was changed so that we now apply that cap
unconditionally and override only when the caller passes an explicit
`end_created_at` (as peer the REST docs).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44826
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Windows MSI builds now correctly exclude placeholder secret values
during installation, preventing unnecessary dummy configuration files
from being created.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Changes:
- Added a new Github workflow that runs on branches that change the
website's dependencies (website/package-lock.json or
website/package.json), and fails for 72 hours after a change to those
files have been made. After 72 hours, if the workflow has not run again
on a pull request, the workflow can be rerun to give a PR a passing
status.
- Updated the website handbook page to document this process.
@lukeheath After this is merged, I will need help setting up a branch
protection rule to require a passing status from this workflow to merge
pull requests that change the website's dependencies
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added an automated workflow to enforce a wait period before website
dependency updates can proceed, preventing premature merges.
* Added scheduled and manual re-triggering for recent failed workflow
runs to ensure dependency checks are retried without manual
intervention.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Prevents `terraform destroy` from running against load test
infrastructure, for a given workspace, if an identical osquery perf
workspace exists.
- Adds a check to the osquery perf workflow, to fail fast, if the
specified load test infrastructure workspace is not detected.
- Adds ability for users to configure the osquery perf (increment -
`input.loadtest_containers_increment`) batch size that get deployed to
an environment during every loop. Default: 4.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a configurable load-test container increment input (default: 4)
to control scaling increments.
* **Improvements**
* Prevented destructive runs when an existing infra workspace matches
the requested name.
* Tightened workspace-existence checks to require exact name matching.
* **Chores**
* Default load-test increment reduced from 8 to 4 and input validated as
a positive integer.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Updated image of Oscar Taracena to one he sent me (instead of one I got
off the internet).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the testimonial author image asset on the Linux management
landing page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45042
# Details
On Dogfood, we have v4.85.0 server running but we run our GitOps with
the currently published fleetctl (4.84). This mismatch caused us to
disable (and therefore wipe out data for) both of our historical chart
datasets. This PR patches the "update app config" code so that when in
"overwrite mode" (i.e. GitOps), it checks for empty `historical_data`
keys in the incoming JSON and replaces them with the default values
(currently `true`, i.e. "collect the data"). Tested manually (see
testing below).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
## Testing
- [X] Added/updated automated tests
- [X] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [X] QA'd all new/changed functionality manually
- [X] reproduced issue on both current fleet v4.85 and main branch
servers, using fleetctl v4.84
- [X] on this branch, ran fleetctl v4.84 w/out `historical_data` in
gitops and verified that charts were enabled.
- [X] on branch applied to 4.85, ran fleetctl v4.84 w/out
`historical_data` in gitops and verified that charts were enabled.
- [X] disabled one chart in the UI, and verified that updating unrelated
app config in the UI did not affect that config (PATCH still works)
For unreleased bug fixes in a release candidate, one of:
- [X] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Fixed GitOps configuration handling for historical data settings to
properly apply default values when fields are omitted by clients. This
ensures that previous configuration settings are preserved correctly in
overwrite mode, preventing incorrect defaults from being inadvertently
persisted when managing configurations with older clients.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#44818
## Summary
- Show tier-specific description on the Variables page: Premium users
see "Manage custom variables that will be available in scripts and
profiles across all fleets." while Free users see "Manage custom
variables that will be available in scripts and profiles."
- Uses existing `isPremiumTier` from `AppContext`, consistent with the
rest of the ManageControlsPage components.
## Changes
- `frontend/pages/ManageControlsPage/Variables/Variables.tsx`: Added
`isPremiumTier` to the `AppContext` destructuring and conditionally
render the description text based on tier.
---
Built for [Rachael
Shaw](https://fleetdm.slack.com/archives/D0AFC5BRFHD/p1778192832326539?thread_ts=1777406096.224979&cid=D0AFC5BRFHD)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Added an optional HTTP-level pre-auth middleware (enabled using the
FLEET_OSQUERY_ALLOW_BODY_AUTH_FALLBACK server config) that validates
incoming osquery requests based on `Authorization: NodeKey <node_key>`
header.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the macOS application manifest with a new version entry and
updated installer configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Postman Windows installer metadata to version 12.9.7 with new
installation package details
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Chores
* Updated version records for maintained applications: Cursor macOS
(3.3.27), Firefox Windows (150.0.2), Google Drive macOS (125.0), Ollama
macOS (0.23.2), and Postman macOS (12.9.7). Version verification
metadata and installation parameters have been synchronized to reflect
the latest releases, ensuring accurate system monitoring and
compatibility checks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
---------
Co-authored-by: Isabell Reedy <113355639+ireedy@users.noreply.github.com>
## Summary
- Replace "carry Yubikeys" with "use Okta Verify with FastPass" in the
Security section of `handbook/company/communications.md` (line 38) to
reflect the current authentication method used by Fleeties.
- The link target (`#hardware-security-keys`) and the rest of the
sentence remain unchanged.
---
Built for [Andrea
Pepper](https://fleetdm.slack.com/archives/D0AENPQMD2S/p1778187814061669?thread_ts=1776965257.297969&cid=D0AENPQMD2S)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Remove the entire "Hardware security keys" section from
`handbook/it/security.md`, including the "Are they YubiKeys or security
keys?" subsection and all related FAQ entries (7 items covering YubiKey
usage, setup, and recovery).
- Update the 2FA comparison table to reference **Okta Verify with
FastPass** instead of YubiKeys as the most secure authentication method.
## Context
Fleet is transitioning from hardware security keys (YubiKeys) to Okta
Verify with FastPass for phishing-resistant authentication. This PR
removes the now-outdated YubiKey documentation. A replacement section
with Okta Verify + FastPass setup instructions will land in a separate
PR.
## Changes
- **Removed**: `### Hardware security keys` section and all subsections
(setup instructions, goals, FAQ)
- **Updated**: 2FA table row from "Hardware security keys / YubiKeys" →
"Okta Verify with FastPass"
---
Built for [Andrea
Pepper](https://fleetdm.slack.com/archives/D0AENPQMD2S/p1778188035759309?thread_ts=1776965257.297969&cid=D0AENPQMD2S)
by [Kilo for Slack](https://kilo.ai/slack)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44980
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually (Not, outside of tests
due to exercising replica lag is difficult)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Improved reliability of device profile assignment by ensuring all
devices receive profiles consistently, even when replica lag affects
device synchronization from Device Enrollment Program services.
* **Tests**
* Added test coverage validating device profile assignment behavior
under replica lag scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Creates a guide that's specific to getting started with managing Google
Chrome with Fleet.
The information on
https://fleetdm.com/guides/creating-windows-csps#ingesting-custom-admx-templates-admxinstall
is fantastic, but a customer will not be searching for "admx" if they're
trying to deploy a config profile for Google Chrome.
This guide is specific enough to solve a problem, while demonstrating
the method required for doing this for other applications.
- Please let me know if I've got this in the right place or if any
changes/improvements are required
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44376
I opted for an in-memory cache here, as it's not a critical cache piece,
we are fine with the cache being different times on different containers
(just means some might rotate to the correct cert faster than 5
minutes).
It's also a small piece of work, rather than pulling in redis etc.
Verified that it now logs, if the cert is stale after a 5 minute
in-memory cache.
```
ts=2026-05-07T11:30:08Z level=info msg="push certificate is stale after re-checking" topic=com.apple.mgmt.External.34c4a9b0-6501-4ce6-afc6-32eac6420ee7 staleToken="\x90C\xe4K\xc6a\x97\xb5?\x1b\x9a\x04'\xe7b\x8d" newHash=".fP\xc7O7\xab\xab\x9d\x92\xd5#\xe4u\xe0\xf6"
ts=2026-05-07T11:30:08Z level=info component=apple-mdm-push msg="retrieved push cert" topic=com.apple.mgmt.External.34c4a9b0-6501-4ce6-afc6-32eac6420ee7
```
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* APNs push certificates now refresh in-memory when rotated; staleness
is detected using certificate checksums with a short grace window.
* **Tests**
* Added tests for certificate retrieval, staleness detection/refresh
behavior, and push-cert storage error handling.
* **Documentation**
* Updated docs to describe the APNs push-certificate refresh and
staleness behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- New buttons from https://github.com/fleetdm/fleet/pull/45001 break the
responsive website layout.
- Commented out until Eric can fix properly.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed call-to-action links from feature sections on the homepage.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes#44950
## Local reproduction
Reproduced locally using a MySQL integration test against the local test
database. The test simulates the exact GitOps scenario from the issue:
1. Create a label and associate it with an MDM profile
2. Delete the label (FK `ON DELETE SET NULL` sets `label_id = NULL`)
3. Create a new label with the **same name** (simulates moving from
global to fleet scope)
4. Call `batchSetProfileLabelAssociationsDB` with the profile
referencing the new label
**Before fix** (code from `main`, unfixed):
```
$ MYSQL_TEST=1 go test -run "TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated" -v -count=1 ./server/datastore/mysql/...
=== RUN TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_darwin
Error: selecting existing profile labels: sql: Scan error on column index 1, name "label_id": converting NULL to uint is unsupported
=== RUN TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_windows
Error: selecting existing profile labels: sql: Scan error on column index 1, name "label_id": converting NULL to uint is unsupported
--- FAIL: TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_darwin (0.02s)
--- FAIL: TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_windows (0.02s)
FAIL
```
**After fix:**
```
$ MYSQL_TEST=1 go test -run "TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated" -v -count=1 ./server/datastore/mysql/...
=== RUN TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_windows
=== RUN TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_darwin
--- PASS: TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_windows (0.03s)
--- PASS: TestMDMShared/TestBatchSetProfileLabelAssociations/same_label_name_recreated_after_deletion_darwin (0.03s)
PASS
ok github.com/fleetdm/fleet/v4/server/datastore/mysql 2.761s
```
## Code changes
When a label is deleted, MySQL's `ON DELETE SET NULL` foreign key
constraint automatically sets `label_id = NULL` in the profile-label
association row. The Go code then crashes trying to scan that NULL into
a `uint` field.
- **`server/datastore/mysql/mdm.go`** — Added `COALESCE(label_id, 0)` to
the SELECT in `batchSetProfileLabelAssociationsDB`, so that NULL
`label_id` values are returned as 0 instead of causing a scan error when
Go tries to read NULL into a `uint`.
- **`server/datastore/mysql/apple_mdm.go`** — Same `COALESCE(label_id,
0)` fix in `batchSetDeclarationLabelAssociationsDB`. Also added `OR
label_id IS NULL` to the DELETE statement to clean up broken rows,
matching the profile labels behavior from #42637.
Other queries in the same codebase (e.g.,
`listProfileLabelsForProfiles`) already use `COALESCE(label_id, 0)` —
these two were missed.
## Testing
- `same_label_name_recreated_after_deletion_{darwin,windows}` —
reproduces the exact bug: associates a profile with a label, deletes the
label (NULL label_id), creates a new label with the same name, and
verifies `batchSetProfileLabelAssociationsDB` succeeds, the broken row
is cleaned up, and the correct label association exists
- Full MDM test suite passes: `MYSQL_TEST=1 go test -run "TestMDM"
./server/datastore/mysql/...` (76s)
- `make lint-go-incremental` passes
**Related issue:** Resolves#44391
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
I tested this locally
number of ubuntu hosts: 6,252
average software per host: 2,302
distinct software items: 61,213
host_software rows: 14.4M
generates software_cve rows 305,826
OS sub-versions: 25
The time before my optimization **10m53s** down to **4m26s** the
optimization.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Optimized OSV vulnerability scanning to aggregate work by OS version
and batch lookups, reducing redundant queries for faster scans.
* **Refactor**
* Restructured scanning flow to process OS versions in batched chunks
with clearer logging and early exits when no work is required.
* **Tests**
* Added tests for querying, batching, source filtering, deduplication,
and empty-input behaviors.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
**Related issue:** Resolves#44391
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added release notes documenting vulnerability scanning performance
improvements
* **Refactor**
* Optimized vulnerability scanning performance through enhanced CVE
product matching efficiency
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Make it match
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated messaging on the observability page's hero section headline
from "Open orchestration" to "Real-time reporting"
* Updated the bottom call-to-action headline similarly to "Real-time
reporting"
* Changed secondary call-to-action text to emphasize faster insights
("Find things out in seconds")
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
50% of Fleet customers don't use IaC, and have huge fleets. It's not
that ClickOps doesn't scale-- it's that there's another way.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the "There is another way" section header on the
Infrastructure as Code page with revised wording.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Mike T to review
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Updated homepage hero with new CTAs: "Try it yourself" and "Join a
workshop"
* Added "Explore device management" and "More about visibility"
call-to-action buttons
* Enhanced marketing messaging highlighting multi-OS support and
flexible deployment options
* Reordered comparison table dropdown options for better navigation
* Updated CTAs from "Get a demo" to "See case studies" for case study
access
* Refreshed banner heading to emphasize high-agency device management
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Updated Claude desktop macOS to version 1.6608.0
* Updated Dialpad macOS to version 2605.0.2
* Updated Tor Browser macOS to version 15.0.13
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
## Summary
- Adds a customer testimonial from Oscar Taracena (Technical Operation
Engineer, Anduril Industries) to the `/linux-management` landing page
- Both testimonials (Oscar Taracena and Roger Cantrell) are now styled
to match the Dan Jackson testimonial format on the
`/infrastructure-as-code` page, including:
- Company logo displayed above the quote text (Anduril Industries logo
for Oscar, Nutanix logo for Roger)
- Horizontal author layout with `name-and-title` wrapper
- Updated CSS for `quote-image`, `name-and-title`, row-based
`quote-author-info`, and matching font sizes
## Changes
- `website/views/pages/landing-pages/linux-management.ejs` — Updated
both testimonial sections to include company logos and use the
`name-and-title` wrapper structure
- `website/assets/styles/pages/landing-pages/linux-management.less` —
Added `quote-image` and `name-and-title` styles, changed author info to
horizontal row layout, aligned font sizes with infrastructure-as-code
page
- `website/assets/images/logo-anduril-104x40@2x.png` — Added Anduril
Industries logo (sourced from official company logo)
-
`website/assets/images/testimonial-author-oscar-taracena-100x100@2x.png`
— Added Oscar's headshot image
---
Built for [Daniel
Gordon](https://fleetdm.slack.com/archives/D0AHXRWHZD1/p1778186427565669?thread_ts=1778183252.605929&cid=D0AHXRWHZD1)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Updates the "GitOps mode" indicator in the top navigation bar to
become a clickable link that navigates to
`/settings/integrations/change-management` when the current user is a
global admin.
- For non-global-admin users, the indicator remains as a non-clickable
text badge (unchanged behavior).
## Changes
- **`frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx`**: Added
`isGlobalAdmin` prop to `GitOpsModeIndicator` component. When true,
wraps the indicator content in a `<Link>` to
`PATHS.ADMIN_INTEGRATIONS_CHANGE_MANAGEMENT`. Otherwise, renders the
content as-is.
- **`frontend/components/top_nav/SiteTopNav/_styles.scss`**: Added
`.gitops-mode-indicator__link` styles to ensure the link has no default
link styling (no underline, inherited color) and shows a pointer cursor.
Built for [Rachael
Shaw](https://fleetdm.slack.com/archives/D0AFC5BRFHD/p1777410934139609?thread_ts=1777406096.224979&cid=D0AFC5BRFHD)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44958
# Details
Fixes two issues on the checkerboard:
1. Ensures that the chart shows data going back 30 calendar days (not
720 hours) if it has it
2. Leaves `0` values out of the chart color band calculations in
"relative" color mode
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
**Before**
Colors clustered in top 3 levels, empty boxes in first column:
<img width="705" height="416" alt="image"
src="https://github.com/user-attachments/assets/b867a1a9-4c52-4b96-92fd-04e7848c6295"
/>
**After**
Colors spread over all levels, no empty boxes in first column:
<img width="707" height="412" alt="image"
src="https://github.com/user-attachments/assets/c67e11c5-6dd8-4e66-9c32-9d9213ccb24f"
/>
For unreleased bug fixes in a release candidate, one of:
- [X] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Charts request an extra day to ensure full calendar-day coverage
across timezones.
* Checkerboard visualization excludes empty/no-data slots from relative
color scaling so color ramps reflect non-zero data.
* Calendar view trims leading partial days so the displayed window
matches the selected range.
* **New Features**
* Chart date-range selection expanded to support any value from 1–31
days.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Andrew Mellor
