Skip to content

Adding changes for Fleet v4.85.0 (#44228) - #45545

Merged
lukeheath merged 3 commits into
mainfrom
merge-4.85.0-main
May 15, 2026
Merged

Adding changes for Fleet v4.85.0 (#44228)#45545
lukeheath merged 3 commits into
mainfrom
merge-4.85.0-main

Conversation

@lukeheath

@lukeheath lukeheath commented May 14, 2026

Copy link
Copy Markdown
Member

Summary by CodeRabbit

  • New Features

    • Added policy details page with read-only view for restricted users.
    • Introduced API-only user management with configurable endpoint access.
    • Added support for Fleet variables in Apple declaration profiles.
    • Enabled conditional HTTP caching for GitOps software downloads.
    • Added Android Wi-Fi profile dependency handling for certificates.
  • Bug Fixes

    • Fixed pagination infinite loop on software table.
    • Fixed stale host activities appearing in activity feed.
    • Fixed team transfer race condition reverting host assignments.
    • Fixed policy rename failures in GitOps mode.
    • Improved iOS/iPadOS MDM profile handling reliability.
  • Improvements

    • Reduced database write volume for unchanged host data.
    • Enhanced enroll button layout on mobile devices.
    • Improved REST API endpoint standardization.
    • Optimized app manifest delivery via CDN.
    • Upgraded to TypeScript 6.0 and Go 1.26.2.

Review Change Stack

@lukeheath
lukeheath marked this pull request as ready for review May 14, 2026 22:23
Copilot AI review requested due to automatic review settings May 14, 2026 22:23

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

Tip: disable this comment in your organization's Code Review settings.

@coderabbitai

coderabbitai Bot commented May 14, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7f393acc-2c76-427d-8517-324cc29eeda6

📥 Commits

Reviewing files that changed from the base of the PR and between 267d626 and 15a7d3d.

⛔ Files ignored due to path filters (1)
  • CHANGELOG.md is excluded by !**/*.md
📒 Files selected for processing (66)
  • changes/33557-inconsistent-team-name-conflicts
  • changes/35171-macos-15-cis-2.0.0
  • changes/35172-macos-14-cis-3.0
  • changes/38348-allow-saving-invalid-sql
  • changes/38647-remove-duplicate-disk-encryption-activity
  • changes/39570-clear-passcode
  • changes/40322-fix-ddm-pending-issues
  • changes/40322-make-ddm-name-check-case-insensitive
  • changes/40702-simplif-os-modal
  • changes/40856-eula-upload-updated-to-default-max-request-body-size-and-error
  • changes/40952-fallback-team-script-execution-timeout-to-global
  • changes/41147-update-input-action-buttons
  • changes/41167-skip-bootstrap-clear-on-cert-renewal
  • changes/41381-eua-ms-installer
  • changes/41568-enroll-page-enroll-button-update-to-full-width-for-larger-res-mobiles
  • changes/41676-update-APNS-cert-invalid-domain-error-message
  • changes/41753-policy-details-page
  • changes/42103-accept-89-on-profile-removal
  • changes/42240-add-gitops-stats
  • changes/42290-wipe-activity
  • changes/42405-android-onc-after-cert
  • changes/42427-cleanup-stale-mdm-profiles
  • changes/42440-renew-ab-tokens-gitopsmode-dropdown-fix
  • changes/42494-android-pubsub-panic-deleted-host
  • changes/42545-skip-noop-host-writes
  • changes/42545-windows-profile-delete-batching
  • changes/42568-host-policy-empty-state
  • changes/42675-conditional-download-cache
  • changes/42751-r2-fma
  • changes/42879-api-only-user-management-ui
  • changes/42881-api-endpoints-initial-models
  • changes/42882-42880-42884-allow-creation-of-api-only-users
  • changes/42883-api-endpoint-for-listing-rest-api-endpoints
  • changes/42885-api-only-endpoints-middleware
  • changes/42979-fix-for-multi-team-user
  • changes/43070-fix-exceptions-padding
  • changes/43114-pagination-bug
  • changes/43142-script-package-icon-gitops
  • changes/43162-software-table-bookmarkable-page
  • changes/43222-support-fleet-variables-in-ddm
  • changes/43228-dont-send-account-configuration-for-non-mac
  • changes/43311-script-only-pkg-gitops
  • changes/43341-gitops-mode-wonkiness
  • changes/43342-improved-button-link-styling
  • changes/43389-patch-policy-gitops-bugs
  • changes/43484-msi-docker-on-arm64
  • changes/43591-fix-stale-host-activities
  • changes/43738-duplicate-installers
  • changes/43910-implement-chart-module
  • changes/43955-gitops-escape-json-in-vars
  • changes/43978-fma-sync-bundle-identifier-index
  • changes/44071-team-transfer-race-with-update-host
  • changes/44127-remove-unused-windows_updates
  • changes/44198-ios-refetch-defensive-decoding
  • changes/docs-read-replica-config-clarity
  • changes/input-field-to-ts
  • changes/issue-40809-bitlocker-loop
  • changes/ts6
  • changes/turn-off-prom-in-dev-mode
  • changes/update-go-1.26.2
  • charts/fleet/Chart.yaml
  • charts/fleet/values.yaml
  • infrastructure/dogfood/terraform/aws/variables.tf
  • infrastructure/dogfood/terraform/gcp/variables.tf
  • tools/fleetctl-npm/package.json
  • tools/github-manage/cmd/gm/releases.go
💤 Files with no reviewable changes (60)
  • changes/40952-fallback-team-script-execution-timeout-to-global
  • changes/43978-fma-sync-bundle-identifier-index
  • changes/43341-gitops-mode-wonkiness
  • changes/41676-update-APNS-cert-invalid-domain-error-message
  • changes/43070-fix-exceptions-padding
  • changes/42545-windows-profile-delete-batching
  • changes/35172-macos-14-cis-3.0
  • changes/38647-remove-duplicate-disk-encryption-activity
  • changes/41568-enroll-page-enroll-button-update-to-full-width-for-larger-res-mobiles
  • changes/43114-pagination-bug
  • changes/43910-implement-chart-module
  • changes/40702-simplif-os-modal
  • changes/41381-eua-ms-installer
  • changes/41147-update-input-action-buttons
  • changes/43222-support-fleet-variables-in-ddm
  • changes/42883-api-endpoint-for-listing-rest-api-endpoints
  • changes/43342-improved-button-link-styling
  • changes/42568-host-policy-empty-state
  • changes/42751-r2-fma
  • changes/42405-android-onc-after-cert
  • changes/42240-add-gitops-stats
  • changes/43484-msi-docker-on-arm64
  • changes/docs-read-replica-config-clarity
  • changes/42882-42880-42884-allow-creation-of-api-only-users
  • changes/35171-macos-15-cis-2.0.0
  • changes/43142-script-package-icon-gitops
  • changes/43162-software-table-bookmarkable-page
  • changes/40322-make-ddm-name-check-case-insensitive
  • changes/42879-api-only-user-management-ui
  • changes/44127-remove-unused-windows_updates
  • changes/44198-ios-refetch-defensive-decoding
  • changes/42675-conditional-download-cache
  • changes/42103-accept-89-on-profile-removal
  • changes/42545-skip-noop-host-writes
  • changes/43311-script-only-pkg-gitops
  • changes/33557-inconsistent-team-name-conflicts
  • changes/41753-policy-details-page
  • changes/43738-duplicate-installers
  • changes/44071-team-transfer-race-with-update-host
  • changes/turn-off-prom-in-dev-mode
  • changes/ts6
  • changes/39570-clear-passcode
  • changes/40856-eula-upload-updated-to-default-max-request-body-size-and-error
  • changes/43389-patch-policy-gitops-bugs
  • changes/42885-api-only-endpoints-middleware
  • changes/update-go-1.26.2
  • changes/42427-cleanup-stale-mdm-profiles
  • changes/43955-gitops-escape-json-in-vars
  • changes/issue-40809-bitlocker-loop
  • changes/input-field-to-ts
  • changes/42494-android-pubsub-panic-deleted-host
  • changes/42881-api-endpoints-initial-models
  • changes/41167-skip-bootstrap-clear-on-cert-renewal
  • changes/42440-renew-ab-tokens-gitopsmode-dropdown-fix
  • changes/42290-wipe-activity
  • changes/40322-fix-ddm-pending-issues
  • changes/42979-fix-for-multi-team-user
  • changes/43591-fix-stale-host-activities
  • changes/38348-allow-saving-invalid-sql
  • changes/43228-dont-send-account-configuration-for-non-mac

Walkthrough

This PR cuts a release for Fleet v4.85.0 by bumping version identifiers across deployment and tooling artifacts. The Helm chart version increments to v7.0.2 while the application version advances to v4.85.0. Container image tags in Helm values and Terraform variables for AWS and GCP dogfood infrastructure are updated to v4.85.0. The npm fleetctl package version is bumped accordingly, and release management documentation examples are updated to reference the new version.

Possibly related issues

  • fleetdm/fleet#42405: PR includes support for Android ONC profile deferral until certificate installation completes.

  • fleetdm/fleet#38044: PR adds API-only user management endpoints and middleware enforcement.

  • fleetdm/fleet#45022: PR defers Android profiles until referenced certificates are installed on team transfers.

Possibly related PRs

  • fleetdm/fleet#44886: Both PRs update release-version plumbing across Helm charts, infrastructure variables, and npm packages for different patch versions.

  • fleetdm/fleet#45472: Both PRs refine SQL validation behavior; main PR relaxes policy persistence constraints while this PR bumps node-sql-parser to fix false syntax-error detection.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Description check ⚠️ Warning The pull request description is empty; the author did not provide any description content. Add a pull request description explaining what changes are included, which files were modified, and why this release is necessary.
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and specifically describes the primary change: adding changes files for Fleet v4.85.0 release.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch merge-4.85.0-main

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Prepares Fleet v4.85.0 release metadata by bumping deployable version references, adding the 4.85.0 changelog section, and removing release-note fragments that were folded into the changelog.

Changes:

  • Bumped Fleet image/package/chart references to v4.85.0.
  • Added the Fleet 4.85.0 changelog section.
  • Removed many consumed changes/ fragments for release-note generation.

Reviewed changes

Copilot reviewed 7 out of 67 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
tools/github-manage/cmd/gm/releases.go Updates release forecast example milestone to 4.85.0.
tools/fleetctl-npm/package.json Bumps fleetctl npm package version.
infrastructure/dogfood/terraform/gcp/variables.tf Bumps dogfood GCP Fleet image.
infrastructure/dogfood/terraform/aws/variables.tf Bumps dogfood AWS Fleet image.
charts/fleet/values.yaml Bumps Helm default image tag.
charts/fleet/Chart.yaml Bumps Helm chart and app versions.
CHANGELOG.md Adds Fleet 4.85.0 release notes.
changes/update-go-1.26.2 Removes consumed change fragment.
changes/turn-off-prom-in-dev-mode Removes consumed change fragment.
changes/ts6 Removes consumed change fragment.
changes/issue-40809-bitlocker-loop Removes consumed change fragment.
changes/input-field-to-ts Removes consumed change fragment.
changes/docs-read-replica-config-clarity Removes consumed change fragment.
changes/44198-ios-refetch-defensive-decoding Removes consumed change fragment.
changes/44127-remove-unused-windows_updates Removes consumed change fragment.
changes/44071-team-transfer-race-with-update-host Removes consumed change fragment.
changes/43978-fma-sync-bundle-identifier-index Removes consumed change fragment.
changes/43955-gitops-escape-json-in-vars Removes consumed change fragment.
changes/43910-implement-chart-module Removes consumed change fragment.
changes/43738-duplicate-installers Removes consumed change fragment.
changes/43591-fix-stale-host-activities Removes consumed change fragment.
changes/43484-msi-docker-on-arm64 Removes consumed change fragment.
changes/43389-patch-policy-gitops-bugs Removes consumed change fragment.
changes/43342-improved-button-link-styling Removes consumed change fragment.
changes/43341-gitops-mode-wonkiness Removes consumed change fragment.
changes/43311-script-only-pkg-gitops Removes consumed change fragment.
changes/43228-dont-send-account-configuration-for-non-mac Removes consumed change fragment.
changes/43222-support-fleet-variables-in-ddm Removes consumed change fragment.
changes/43162-software-table-bookmarkable-page Removes consumed change fragment.
changes/43142-script-package-icon-gitops Removes consumed change fragment.
changes/43114-pagination-bug Removes consumed change fragment.
changes/43070-fix-exceptions-padding Removes consumed change fragment.
changes/42979-fix-for-multi-team-user Removes consumed change fragment.
changes/42885-api-only-endpoints-middleware Removes consumed change fragment.
changes/42883-api-endpoint-for-listing-rest-api-endpoints Removes consumed change fragment.
changes/42882-42880-42884-allow-creation-of-api-only-users Removes consumed change fragment.
changes/42881-api-endpoints-initial-models Removes consumed change fragment.
changes/42879-api-only-user-management-ui Removes consumed change fragment.
changes/42751-r2-fma Removes consumed change fragment.
changes/42675-conditional-download-cache Removes consumed change fragment.
changes/42568-host-policy-empty-state Removes consumed change fragment.
changes/42545-windows-profile-delete-batching Removes consumed change fragment.
changes/42545-skip-noop-host-writes Removes consumed change fragment.
changes/42494-android-pubsub-panic-deleted-host Removes consumed change fragment.
changes/42440-renew-ab-tokens-gitopsmode-dropdown-fix Removes consumed change fragment.
changes/42427-cleanup-stale-mdm-profiles Removes consumed change fragment.
changes/42405-android-onc-after-cert Removes consumed change fragment.
changes/42290-wipe-activity Removes consumed change fragment.
changes/42240-add-gitops-stats Removes consumed change fragment.
changes/42103-accept-89-on-profile-removal Removes consumed change fragment.
changes/41753-policy-details-page Removes consumed change fragment.
changes/41676-update-APNS-cert-invalid-domain-error-message Removes consumed change fragment.
changes/41568-enroll-page-enroll-button-update-to-full-width-for-larger-res-mobiles Removes consumed change fragment.
changes/41381-eua-ms-installer Removes consumed change fragment.
changes/41167-skip-bootstrap-clear-on-cert-renewal Removes consumed change fragment.
changes/41147-update-input-action-buttons Removes consumed change fragment.
changes/40952-fallback-team-script-execution-timeout-to-global Removes consumed change fragment.
changes/40856-eula-upload-updated-to-default-max-request-body-size-and-error Removes consumed change fragment.
changes/40702-simplif-os-modal Removes consumed change fragment.
changes/40322-make-ddm-name-check-case-insensitive Removes consumed change fragment.
changes/40322-fix-ddm-pending-issues Removes consumed change fragment.
changes/39570-clear-passcode Removes consumed change fragment.
changes/38647-remove-duplicate-disk-encryption-activity Removes consumed change fragment.
changes/38348-allow-saving-invalid-sql Removes consumed change fragment.
changes/35172-macos-14-cis-3.0 Removes consumed change fragment.
changes/35171-macos-15-cis-2.0.0 Removes consumed change fragment.
changes/33557-inconsistent-team-name-conflicts Removes consumed change fragment.
Comments suppressed due to low confidence (9)

CHANGELOG.md:12

  • This Fleet-maintained apps manifest-location change is already documented in the 4.84.0 section of this changelog (line 132). It should not be repeated as a 4.85.0 change unless there is a new 4.85-specific behavior to describe.
- Switched Fleet-maintained apps serving location from GitHub to https://maintained-apps.fleetdm.com/manifests. If this site is inaccessible, Fleet will fall back to the previous GitHub-hosted copies of manifest files.

CHANGELOG.md:64

  • This wipe/certificate-renewal fix is already listed in the 4.84.2 section of this changelog (line 103). Repeating it in 4.85.0 will mislead readers about when the fix shipped.
- Fixed an issue where trying to wipe a device after its certificate was renewed could fail due to a missing bootstrap token. _Note: The device might still have wiped._

CHANGELOG.md:66

  • This Apple MDM DeviceInformation panic fix is already listed in the 4.84.2 section of this changelog (line 106). Remove the duplicate 4.85.0 entry or replace it with a genuinely new change.
- Fixed a server panic when an Apple MDM `DeviceInformation` refetch response omitted `DeviceName` or other expected fields.

CHANGELOG.md:69

  • This duplicate-installer GitOps fix is already recorded in the 4.84.2 section of this changelog (line 100). Listing it again under 4.85.0 makes the release notes duplicate a previously shipped fix.
- Fixed a bug where custom package installers were not removed when adding an FMA for the same title via GitOps, which caused setup experience to install duplicate software.

CHANGELOG.md:71

  • This script-only package GitOps fix is already recorded in the 4.84.2 section of this changelog (line 101). It should be removed from the 4.85.0 notes unless there was an additional 4.85-specific fix.
- Fixed a bug where host environment variables in script-only packages would cause GitOps to fail.

CHANGELOG.md:42

  • This Go 1.26.3 entry appears to have been consumed from changes/update-go-1.26.3, but that change fragment still exists. The release workflow documents that consumed changes/ entries should be staged for deletion, otherwise this note can be generated again in the next release.
- Updated Go to 1.26.3.

CHANGELOG.md:23

  • This dashboard chart entry corresponds to change fragments that still remain in changes/ (43769-added-charts-to-dashboard and 44124-add-vulnerabilities-chart). Since it has been incorporated into this release note, those fragments should be deleted to prevent the same entries from reappearing in a later changelog.
- Added "Hosts online", "Vulnerability exposure", and "Hosts enrolled" charts to the dashboard.

CHANGELOG.md:81

  • This software-table page-number fix already appears in the 4.83.1 section of this changelog (line 239). Repeating it under 4.85.0 duplicates a previously shipped fix.
- Fixed software table page number to be bookmarkable.

CHANGELOG.md:82

  • This software-table pagination-loop fix already appears in the 4.83.1 section of this changelog (line 238). Remove the duplicate 4.85.0 entry or replace it with a new 4.85-specific change.
- Fixed an infinite page loop pagination bug on the software table page that occurred when viewing a subsequent page and then using the software filter dropdown.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread CHANGELOG.md
- Implemented Clear Passcode feature for iOS and iPadOS.
- Added support for Fleet variables in Apple's declaration profiles (DDM).
- Added support for passing end-user authentication context to the Fleet MSI installer during Windows MDM enrollment, so end users are not prompted to authenticate twice when EUA is enabled.
- Switched to Docker as the default WiX runtime on macOS (including Apple Silicon) when generating `.msi` packages via `fleetctl package`. Wine is no longer required on macOS for the default path.
@codecov

codecov Bot commented May 14, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.74%. Comparing base (2a58bbe) to head (0428ad4).

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #45545      +/-   ##
==========================================
+ Coverage   66.70%   66.74%   +0.04%     
==========================================
  Files        2736     2741       +5     
  Lines      218803   219195     +392     
  Branches    10820    10829       +9     
==========================================
+ Hits       145947   146301     +354     
- Misses      59633    59656      +23     
- Partials    13223    13238      +15     
Flag Coverage Δ
backend 68.59% <ø> (+0.03%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@lukeheath
lukeheath merged commit 79a7048 into main May 15, 2026
51 of 52 checks passed
@lukeheath
lukeheath deleted the merge-4.85.0-main branch May 15, 2026 13:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants