**Related issue:** Resolves#43091
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [ ] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Was able to reproduce by enrolling a Ubuntu 25.10 host and mounting /
onto a different path like this:
```bash
sudo mkdir -p /tmp/snap.rootfs_TESTING
sudo mount --bind / /tmp/snap.rootfs_TESTING
```
Then, refetched vitals and saw the total disk space doubled:
<img width="211" height="108" alt="Screenshot 2026-05-07 at 9 40 12 PM"
src="https://github.com/user-attachments/assets/81cad4af-f146-4ea9-84e3-ee56eb426d8a"
/>
With the fix applied on this branch, refetched again and saw the correct
total disk space:
<img width="251" height="118" alt="Screenshot 2026-05-07 at 9 31 15 PM"
src="https://github.com/user-attachments/assets/cbb6f91b-320a-4d48-8583-f5fdf5a4fcd9"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
- Resolved inaccurate total disk space reporting on Linux systems where
the same filesystem is bind-mounted at multiple paths.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43027
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Endpoints for fleet script batch executions now return HTTP 404 for
nonexistent batch execution resources.
* **Tests**
* Added tests to verify 404 behavior for missing batch execution
resources and related error handling.
* **Tools**
* Added a command-line load-test seeding/teardown utility to create and
remove configuration profiles and related test data.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45348)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#45220 (one of several PRs)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added a dedicated maintained-apps test helper and updated integration
tests to use it, consolidating sync test setup and improving reliability
of maintained-apps scenarios.
* Updated several tests to use improved test utilities and helper
variants for SQL test helpers and request fixtures.
* **Chores**
* Adjusted CI lint checks to exclude the new test helper location from
specific env-var override validations.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45494)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated landing page copy to position automated patching as inevitable
and emphasize predictable, weekend-capable, policy-driven updates.
* Reframed problem/solution messaging to highlight the costs of manual
packaging and promote catalog maintenance plus automated installations
with exception handling.
* Clarified patch-policy wording to state the product watches apps so
customers don’t need to write or update code.
* Removed one proof item and simplified platform/integrations
presentation.
* **Style**
* Adjusted proof-strip layout to a two-column grid for improved visual
balance.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45544)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Updated internal test utilities and helpers to improve test
infrastructure reliability.
* **Refactor**
* Improved code formatting consistency in test configurations.
---
**Note:** This release contains internal testing and maintenance updates
with no user-facing changes.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45551)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44967
Video demo: https://www.youtube.com/watch?v=AnwAXPS9Ys0
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Android SCEP enrollment now supports Subject Alternative Name (SAN)
attributes on certificate templates (DNS, email, URI, IP, and Microsoft
UPN); SAN is optional and forwarded when present.
* **Tests**
* Added unit and integration tests for SAN parsing, CSR generation, and
end-to-end enrollment verification.
* **Documentation**
* Added a change note describing SAN support and CSR behavior.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44968)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45497
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
not user-facing
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
Kinda hard to test outside of a release, but the sibling .msi upload job
works using the same action SHA.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated pinned GitHub Action digests used in CI to newer commits for
improved security and build reliability.
* Reformatted a CI step parameter across multiple YAML lines (no
functional change) to improve readability and maintainability.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45498)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/confidential/issues/15767
Changes:
- Updated the layout of release notes, guides, blog posts, and
announcement articles on mobile devices
- Updated the mobile navigation menu to have a search bar on release
notes, guides, blog posts, and announcement articles.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Mobile search added to article, release, guide, and announcement
pages; mobile menu exposes DocSearch.
* Search behavior updated to target article content more precisely
across desktop and mobile.
* **Style**
* Updated mobile header and search styling for improved usability.
* Improved responsive layout: breadcrumbs, sidebar, subtopics, and
article title spacing adjusted for small screens.
* Added mobile-specific "Suggest an edit" placement and refined element
visibility.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45416)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Bumped installer metadata (version, download URLs, checksums, patch
checks) for multiple maintained apps to new releases.
* Adjusted Homebrew ingester logic to handle Camtasia year-prefixed
versions.
* **Bug Fixes**
* macOS uninstall cleanup updated for Camtasia to remove an additional
shared-filelist and preserve user files by moving them to Trash.
* Windows Docker install/uninstall improved: per-user silent install,
registry polling for completion, and more robust registry lookup/error
handling.
* **Tests**
* Added unit tests for Camtasia version transformation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45503)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
## Summary
- Adds a new FAQ entry to `docs/Get started/FAQ.md` explaining that EDR
products (e.g., SentinelOne, CrowdStrike) may occasionally flag the
fleetd agent (orbit) after updates
- Describes the osquery v5.23.0 change that performs temporary keychain
file copies to prevent corruption when querying the `certificates`
table, which can trigger EDR heuristic alerts
- Notes that Fleet is working with EDR vendors to resolve false-positive
classifications and advises customers can safely allowlist the orbit
binary
---
Built for [Mike
McNeil](https://fleetdm.slack.com/archives/C062D0THVV1/p1778015225672909?thread_ts=1778005844.853449&cid=C062D0THVV1)
by [Kilo for Slack](https://kilo.ai/slack)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Added FAQ section addressing EDR flagging of Fleet, including reasons,
safety, and allowlisting options.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
Adds unit tests for previously-uncovered parser helpers in
`server/mdm/microsoft/wstep_csr.go`:
- `parseBase128Int` — single/multi-byte values, non-minimal encoding
(leading `0x80`), truncation, 5-byte cap, `MaxInt32` overflow
- `parseTagAndLength` — short/long-form length, indefinite-length
rejection, non-minimal length and tag, shift overflow
- `parseSANExtension` — DNS, email, URI, IPv4, IPv6, plus malformed IP
length and non-IA5 DNS
- `domainToReverseLabels` — trailing dots, empty middle labels, single
labels
ASN.1 fixtures are built with `cryptobyte.Builder` to match the source
file's existing toolchain — no new dependencies. Pure-Go tests, run in
the `fast` bundle without Docker.
**Related issue:** Refs #33373
# Checklist for submitter
- [x] Added/updated automated tests
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added comprehensive test coverage for certificate Subject Alternative
Name (SAN) parsing: domain label reversal, base‑128 integer decoding
with error classification, ASN.1 tag/length validation and boundary
cases, end‑to‑end parsing of multiple SAN name types (DNS, email,
IPv4/IPv6, URI), and numerous malformed/input edge‑case checks.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45457)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44422
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* The CLI command to list MDM commands now requires a --host flag;
calling it without a host will error.
* The API endpoint for listing commands now requires a host_identifier
parameter; requests without it are deprecated.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45476)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43973
Fixes a few bugs regarding managed app configurations. Includes a few
cherry-picks for commits that were supposed to be merged, but got
overwritten by subsequent PRs that didn't get pushed properly while
working with the github stack.
Also includes some more integration test cases.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved error handling for VPP managed app configurations that
reference unresolvable Fleet variables.
* **Bug Fixes**
* Fixed cleanup of VPP app configuration data during team deletion.
* In-house app configurations now apply only to their specific installer
instead of sibling installers.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45452)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/43242
Changes:
- Added /download, a page that has links to download the fleetctl
installers included in the latest release
- Updated the build-static-content script to send a request to GitHub to
get the download URLs of the latest released fleetctl installers.
- Update the parallax-city component to support a new prop that removes
the component's background when set.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a dedicated /download page with platform-specific installer
links, FAQ accordion, and copy-to-clipboard for code snippets (copy
buttons removed if unsupported).
* Added shortlink redirect from /downloads → /download.
* Sitemap now includes /download for better discoverability.
* **Style**
* New page styles and component styles, plus an option to render the
parallax city without a background.
* **Chores**
* Build now fetches and populates installer URLs automatically; the
download route is publicly accessible.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45504)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45491
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Deterministic MDM solution name reporting for osquery ingestions when
server URLs match multiple vendor substrings; resolves ambiguous matches
(e.g., jumpcloud.awmdm.com) and normalizes case.
* **Tests**
* Added unit tests covering empty/unknown inputs, multiple vendor
hostnames, case-insensitive URLs, and ambiguous-match resolution.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45496)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Gray Williams
