Adding changes for Fleet v4.85.2 - #46689
Closed
georgekarrv wants to merge 1 commit into
Closed
Conversation
georgekarrv
requested review from
BCTBB,
ddribeiro,
rfairburn and
rynsatterlee
as code owners
June 2, 2026 21:31
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
WalkthroughThis PR performs coordinated version bumps for deployment and infrastructure components. The Fleet Helm chart version is incremented from v7.0.4 to v7.0.5 in Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
Prepares release-related metadata for Fleet v4.85.2, including infrastructure/provider versioning, Helm chart packaging, and changelog updates.
Changes:
- Bump GCP Terraform
google-betaprovider version in the lockfile. - Bump the Fleet Helm chart version.
- Rewrite the top of
CHANGELOG.mdto introduce4.85.2and adjust nearby entries.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| infrastructure/dogfood/terraform/gcp/.terraform.lock.hcl | Updates the pinned Terraform provider version for google-beta. |
| charts/fleet/Chart.yaml | Bumps the Helm chart version (and implicitly affects how deployments pick Fleet versions). |
| CHANGELOG.md | Replaces the top-of-file release notes with 4.85.2 and edits prior entries. |
Files not reviewed (1)
- infrastructure/dogfood/terraform/gcp/.terraform.lock.hcl: Language not supported
Comments suppressed due to low confidence (2)
infrastructure/dogfood/terraform/gcp/.terraform.lock.hcl:29
- The google-beta provider version was bumped, but the lockfile checksums were not regenerated. Terraform verifies these hashes; changing
versionwithout updating thehasheslist will causeterraform initto fail or rewrite the lockfile. Regenerate this file withterraform init(orterraform init -upgrade) and commit the updated hashes for the chosen version.
charts/fleet/Chart.yaml:11 - The Helm chart
versionwas bumped, butappVersionstill points atv4.86.0while this PR is preparingv4.85.2(and the changelog now starts at 4.85.2). This mismatch can cause Helm consumers to deploy an unexpected Fleet image/tag. AlignappVersion(and any default image tags, if defined elsewhere) with the intended Fleet release for this chart update.
version: v7.0.5
home: https://github.com/fleetdm/fleet
sources:
- https://github.com/fleetdm/fleet.git
appVersion: v4.86.0
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+1
to
+5
| ## Fleet 4.85.2 (Jun 02, 2026) | ||
|
|
||
| ### IT Admins | ||
|
|
||
| - Added ability to upload a custom org logo (light and dark variants) hosted directly by the Fleet instance; configurable via the UI, API, `fleetctl`, and GitOps. | ||
| - Added "Cancel setup if software fails" toggle for Windows setup experience; when enabled, Autopilot and OOBE enrollments display a failure screen and prompt a restart if any setup experience software fails to install. | ||
| - Added "Rotate password" button to the managed local admin account modal on the Host details page; password auto-rotates roughly one hour after being viewed, with activity logged for both manual and automatic rotations. | ||
| - Added support for configuring Platform SSO during macOS Setup Assistant (ADE) so end users can log in with their IdP credentials. | ||
| - Added ability to install VPP and in-house (`.ipa`) apps on Account-based User Enrolled iOS and iPadOS hosts, including self-service; setup experience software installs automatically on user enrollment. | ||
| - Added support for VPP apps from non-US Apple App Stores; the VPP settings page now shows the country for each token, and apps are fetched from the storefront matching the token's country. | ||
| - Added managed app configuration (XML) for iOS and iPadOS VPP and `.ipa` apps; configurable via the UI, API, and GitOps. | ||
| - Added Fleet Desktop app for end users' macOS Dock, with a red badge when the host is failing policies. | ||
| - Added clearing of labels, pending scripts, pending software installs, and pending MDM commands when an ABM host re-enrolls; added a "Preserve host activities on re-enrollment" option in Settings > Organization settings > Advanced options to retain historical activity and MDM command history. | ||
| - Provisioned a VPP client user per Managed Apple Account on first install, and associated VPP licenses to the user rather than the device, supporting Apple's up-to-5-devices-per-user licensing semantics. | ||
| - Added `include_all` label scope to policies, and `include_all` and `include_any` label scopes to reports, including support via GitOps and `fleetctl`. | ||
| - Added a "Custom" target dropdown when creating or updating reports under the premium tier. | ||
| - Added an "Include all" option to the "Custom" target dropdown on Policies for premium users only. | ||
| - Added permissions for the GitOps user to list software titles. | ||
| - Added support for setting `gitops_mode_enabled` and `repository_url` via GitOps. | ||
| - Added output to GitOps for scripts, indicating how many scripts would be applied (dry run) or were applied. | ||
| - Added activity entries for retried software installs and script runs from policy automations. | ||
| - Added an activity when hosts fail enrollment profile renewal. | ||
| - Added activities when users create, edit, or delete labels (`created_label`, `edited_label`, and `deleted_label`). | ||
| - Added "Hosts online", "Hosts enrolled", and "Vulnerability exposure" charts to the dashboard. | ||
| - Added an option to convert and return a PEM-encoded X.509 certificate instead of a PEM-encoded PKCS7 envelope from the Request a Certificate endpoint. | ||
| - Added a deprecation warning when using `setup_experience.software` or `macos_setup.software` keys in config. | ||
| - Released `fleetctl` as a `pkg` for macOS. | ||
| - Released `fleetctl` as an `msi` for Windows. | ||
| - Enabled wiping a host to cancel all of its upcoming activities. | ||
| - Updated the default automatic enrollment profile, and added the ability to download and view the applied default profile. | ||
| - Updated OS version reporting for iOS and iPadOS to include the Rapid Security Response suffix (e.g. `(a)`) when the device reports a `SupplementalOSVersionExtra` field via MDM. | ||
| - Updated fleetd and MDM enroll activities to display the serial number and preserve the osquery-provided display name. | ||
| - Required the `--host` flag for `fleetctl get mdm-commands`, and deprecated `GET /api/v1/fleet/commands` without a `host_identifier`. | ||
|
|
||
| ### Security Engineers | ||
|
|
||
| - Added automatic re-push of configuration profiles for SCEP and ACME certificates not proxied through Fleet before expiration; supports Okta conditional access (SCEP), Okta Verify (SCEP with static challenge), and hardware-attested ACME certificates. | ||
| - Added support for subject alternative name (SAN) attributes, including UPN, email (rfc822Name), and DNS, in Android certificate profiles, enabling Wi-Fi connectivity requiring SAN-based authentication. | ||
| - Added ingestion of MDM-delivered certificates (including hardware-bound ACME) via the `CertificateList` MDM command on macOS; ACME certificates now appear on the Host details page alongside osquery-ingested certificates, deduplicated by SHA-1 fingerprint. | ||
| - Added macOS 26 CIS Benchmark v1.0.0. | ||
| - Updated CIS Windows 11 Enterprise benchmark policies from v4.0.0 to v5.0.1, adding 17 new L1 policies and updating 42 existing policy titles. | ||
| - Added SVG support for custom organization logos, with strict server-side sanitization to reject scripts and other unsafe SVG content. | ||
| - Optimized OSV vulnerability scanning to query distinct software per OS version rather than per host, reducing redundant database queries for many hosts sharing the same packages. | ||
| - Improved vulnerability scanning performance by using a per-vendor product cache during CVE matching to optimize `translate_cpe_to_cve`. | ||
|
|
||
| ### Bug fixes and improvements | ||
| ### Bug fixes | ||
|
|
||
| - Updated Go to 1.26.3. | ||
| - Removed debug symbols from fleet and fleetctl executables to reduce binary size. | ||
| - Reduced database load from `GET /api/latest/fleet/device/{token}/desktop` and other Fleet Desktop endpoints when invalid or expired device auth tokens are presented, by resolving the token to a host ID with a single-table indexed lookup before running the multi-join host-details query. | ||
| - Improved Windows MDM performance when transferring large numbers of hosts between teams or applying bulk profile changes. These operations now return quickly and roll out profile updates to Windows hosts in the background, so host check-ins and other MDM activity are no longer slowed down while a large change is in progress. | ||
| - Added a Redis-backed cache for host lookups on the osquery and orbit authentication paths. Successful lookups are cached for 60s (±10% jitter) and invalidated on writes that mutate cached host fields. Reduces reader-side DB load at scale without changing the HTTP contract. Requires Redis 6.2 or later. | ||
| - Added a missing uninstall option on the host software library even when an installer has no matching software in the host's inventory. | ||
| - Improved Windows MDM profile removal performance by scoping the desired-state subquery. | ||
| - Improved Windows MDM profile removal performance by skipping redundant database writes for verified-remove ACKs. | ||
| - Consolidated non-variable templated Windows MDM profile command inserts from one per-profile to a single bulk insert. | ||
| - Added a periodic cron job to clean up the Windows MDM command queue, reducing write pressure during ACK transactions. | ||
| - Made host team assignment sticky across orbit and osquery re-enrollments. | ||
| - Improved errors returned from the API when running fleetctl commands by dropping path and status code. | ||
| - Improved validation of order parameters on list endpoints. | ||
| - Added the `orbit.debug_logging_on_enroll_duration` agent option to enable orbit debug logging for a specified time period after enrollment. | ||
| - Improved validation for invalid `order_key` values in `/api/v1/fleet/commands`, `/api/v1/fleet/mdm/commands`, and `/api/v1/fleet/mdm/apple/commands` endpoints. | ||
| - Improved the error message when the `name` key is omitted from a GitOps YAML file. | ||
| - Improved the error message when deleting a label used for targeting a software installation. | ||
| - Updated `fleetctl gitops` to warn when `labels:` is specified in no-team or unassigned files, where it is not supported. | ||
| - Updated the expired Fleet Premium license CLI banner to link to https://fleetdm.com/learn-more-about/downgrading instead of a stale FAQ anchor. | ||
| - Updated the Edit label page to reference "fleets" instead of "teams" when a label is associated with a fleet. | ||
| - Updated the setup experience Users card with a link to PSSO local account documentation. | ||
| - Updated empty state copy to be action-oriented. Headers describe the current state ("No hosts", "No policies for this fleet") instead of prompting action. Body text explains what to expect. CTA buttons are explicit ("Add policy", "Schedule a report") and permission-gated. | ||
| - Updated empty states on Hosts, Reports, Policies, and Software pages so search bars, filters, and dropdowns remain visible but disabled when empty, avoiding layout shift when the first item is added. Item count remains visible. | ||
| - Updated Settings, Fleets, Ticket destinations, Certificates, and Identity provider pages with consistent page descriptions and learn-more links. | ||
| - Updated empty state visuals to a fresher, consistent design. | ||
| - Updated timestamps with tooltips on the host Vitals component to always use `cursor: pointer`. | ||
| - Updated the version of the checkout action in the `fleetctl new` template to avoid Node warnings. | ||
| - Updated the MSI builder to skip packaging the unusable "dummy" secret value when building `fleetd-base.msi` for Autopilot installs. | ||
| - Scoped install commands for user-enrolled hosts to the host's Managed Apple Account (`clientUserIds`) instead of `serialNumbers`, so apps install on the correct user account on the device. | ||
| - Surfaced a clear host-level error when license association fails during install (for example, no licenses available or the user has reached the 5-device limit) instead of failing silently. | ||
| - Made `created_at` upper-bound filtering consistent on the list activities API. The endpoint now caps results at `now` by default whether or not `start_created_at` is provided, matching the documented behavior of `end_created_at`. | ||
| - Unified access to global and team policies in the UI by using the now-generic `GET /api/latest/fleet/policies/:id` endpoint. | ||
| - Wrapped `Get-ItemProperty` calls in try/catch blocks during registry enumeration to gracefully handle terminating exceptions (e.g. `System.InvalidCastException`) from malformed registry entries, logging the offending path instead of aborting. | ||
| - Replaced the cryptic "startTLS error: ..." flash with a prescriptive message when saving SMTP settings fails because SSL/TLS is disabled but STARTTLS is still enabled. Added a tooltip on the SSL/TLS checkbox pointing to the STARTTLS toggle in Advanced options. | ||
| - Removed a dead SQL condition in `hostVPPInstalls` that was misleading but harmless. Android VPP apps never produce `nano_command_results` entries (they use Google's Android Management API, not nanoMDM), so the previous `(hvsi.platform != 'android' OR ncr.id IS NULL)` guard was a tautology. Replaced with a clarifying comment. | ||
| - Fixed filtering on the `/api/v1/fleet/labels/:id/hosts` endpoint. | ||
| - Fixed the `usage_statistics` cron failing against fleetdm.com when a large number of near-identical network errors accumulated in the error store. | ||
| - Fixed `fleetctl gitops` failing with HTTP 500 on subsequent runs when a custom software icon's bytes were missing or had failed integrity in the icon store. The server now returns a 409 Conflict from the metadata-only icon update path, and the gitops client falls back to a full upload to recover the bytes automatically. | ||
| - Fixed SAML JIT provisioning so `FLEET_JIT_USER_ROLE_*` attributes with empty, whitespace-only, or missing values are treated as `null` and ignored instead of failing SSO login. | ||
| - Fixed an issue where GitOps controls with only certain keys would not be seen as set. | ||
| - Fixed recovery lock password not being retrievable for hosts transferred to a team with recovery lock disabled. | ||
| - Fixed Fleet's Docker image failing to start in Kubernetes with an `unknown userid` error, triggered by a fleetctl dependency side effect. | ||
| - Fixed a GitOps failure ("converting NULL to uint is unsupported") when moving labels from global to fleet scope, caused by deleted label associations with NULL `label_id` values in `mdm_configuration_profile_labels` and `mdm_declaration_labels`. | ||
| - Fixed `fleetctl gitops --dry-run` intermittently failing with "Resource Not Found" when a team's `software` config was empty. | ||
| - Fixed the MDM SSO callback returning a "missing profile" error for Android enrollment when Apple MDM is not configured. | ||
| - Fixed the team PATCH endpoint rejecting `mdm.enable_disk_encryption` on Fleet deployments where only Windows MDM is configured. Team-level BitLocker enforcement can now be toggled when either Apple MDM or Windows MDM is configured. | ||
| - Fixed an issue where the disk encryption table on the Controls > Disk encryption page did not support horizontal scrolling at narrow viewport widths. | ||
| - Fixed Linux total disk space being double-counted when a filesystem was bind-mounted at multiple paths (e.g. snap-confine's `/tmp/snap.rootfs_*`). | ||
| - Fixed `fleetctl gitops` rejecting `path:` values whose actual filenames contained glob metacharacters even when the file existed at that literal path. | ||
| - Fixed GitOps failing when it attempted to create a label and a consumer of that label (e.g. a profile) in the same run. | ||
| - Fixed `gitops --dry-run` to reject label specs with invalid `platform` values. | ||
| - Fixed the SSO invite acceptance flow by resolving the email from the invite token. | ||
| - Fixed batch script endpoints to return 404 Not Found instead of 200 when the batch execution ID does not exist: `/api/v1/fleet/scripts/batch/:id`, `/api/v1/fleet/scripts/batch/summary/:id`, and `/api/v1/fleet/scripts/batch/:id/cancel`. | ||
| - Fixed a class of silent SCEP managed-certificate renewal failures by recovering `host_mdm_managed_certificates` rows that previously got stuck after the cert ingest matcher missed linking a renewed certificate. | ||
| - Fixed the upcoming activity count on the host details page not updating after installing or uninstalling software. | ||
| - Fixed an issue where GitOps incorrectly rejected keys in Google Calendar API key JSON. | ||
| - Fixed 500 errors on `POST /api/v1/fleet/scim/Users` when the matched host was already mapped to a SCIM user. The host now gets reassigned to the newly-created SCIM user. | ||
| - Fixed an incorrect CPE match on the "slate" Homebrew program. | ||
| - Fixed a bug where applying GitOps to a script-only package by `hash_sha256` reference would wipe the install script, causing self-service installs to silently no-op. | ||
| - Fixed `fleetctl vulnerability-data-stream` to also download OSV (Ubuntu and RHEL) artifacts. | ||
| - Fixed a missing `deleted_policy` activity when a patch policy is removed by GitOps as a result of its underlying Fleet-maintained app installer being removed from the YAML. | ||
| - Fixed a nil-pointer panic in the Android Enterprise Pub/Sub endpoint that occurred when Google's Android Management API sent a device payload missing `hardwareInfo`, `softwareInfo`, or `memoryInfo`. | ||
| - Fixed an issue where, if a custom Apple MDM URL was set, SSO for end user auth would fail. | ||
| - Fixed slow load times and timeouts on the list MDM commands API (`GET /api/v1/fleet/commands`) on Fleet deployments with many Windows hosts. The endpoint now caps `per_page` at 1,000 (default 10) and `page` at 100. Requests above either limit return HTTP 400. To traverse beyond 100 pages, use cursor pagination via the `after` query parameter. | ||
| - Fixed GitOps dry-run to correctly detect the conflict when both `macos_manual_agent_install` and `macos_script` are configured under `setup_experience`. Previously, the dry-run would succeed while the actual GitOps run would fail. | ||
| - Fixed `fleetctl gitops apply` not clearing stale broken `mdm_configuration_profile_labels` rows after a referenced label was deleted, which caused profiles to remain enforced on hosts regardless of updated label targeting. | ||
| - Fixed `GET /api/v1/fleet/commands` returning a SQL error when called with `host_identifier` and the `after` cursor parameter, particularly with `order_key=command_uuid` or `order_key=hostname`. | ||
| - Fixed a UI bug where editing an existing global user to enable two-factor authentication failed with a 422 error. | ||
| - Fixed an issue where an old APNs cert would stay in memory until a restart, instead of correctly updating in place. | ||
| - Fixed a UI inconsistency with non-center-aligned Fleet premium messages on Fleet Free. | ||
| - Fixed a bug where duplicate software installers for Linux could be added. | ||
| - Fixed the "Back to host details" button on a report's details page navigating to the reports list instead of the host's details page after creating a report from a host. | ||
| - Fixed IdP host vitals (full name, department, groups) not populating on the host details page for macOS devices migrated from another MDM via the Tahoe (macOS 26+) end-user-authentication flow. | ||
| - Fixed `POST /api/v1/fleet/queries` returning HTTP 500 when `name` or `query` is JSON `null`. The endpoint now returns HTTP 400. | ||
| - Fixed `GET /api/latest/fleet/policies/:id` (and alias `GET /api/v1/fleet/global/policies/:id`) to return and properly populate team policies, and to perform an authorization check on team policies before returning. | ||
| - Fixed an issue where GitOps dry-run would not validate Apple config profile payload scope conflicts or the use of unknown Fleet variables in all types of profiles. | ||
| - Fixed Android hosts being auto-deleted by host expiry on every cleanup tick after re-enrolling, which previously caused an hourly enroll/delete loop while host expiry was enabled. | ||
| - Fixed an issue where replica lag could lead to devices not being assigned a setup experience profile on device sync from DEP. | ||
| - Fixed the Location and MDM status vitals on the My device page rendering as clickable links even though they had no associated modal, by rendering them as plain text in read-only contexts. | ||
| - Fixed the Export hosts button to always reflect the current sort, search, and filter state instead of potentially using stale values. | ||
| - Fixed a false-positive `update_conditional_access_bypass` activity that was created whenever any app config setting was changed while Okta conditional access was already configured with `bypass_disabled: true`. Also stopped the related side effect of clearing existing conditional access bypass records on those unrelated saves. | ||
| - Fixed UI elements in the script library not respecting GitOps mode when enabled. | ||
| - Fixed `POST /packs` with a JSON null name silently creating a pack with an empty name. The endpoint now returns a 400 Bad Request, matching the behavior for an empty-string name. | ||
| - Fixed stale "Selected hosts" on the Edit label page after a previous edit by invalidating the related query caches on success, and when navigating between manual labels by scoping the hosts cache per label and keying the form on the actual host set. | ||
| - Fixed subtle text alignment issues in the UI. | ||
| - Fixed a file descriptor leak in vulnerability processing where deleted `goval_dictionary` sqlite files were kept open until Fleet server restart. | ||
| - Fixed setup experience remaining stuck for up to 90 minutes after a software installer was edited or deleted while a host was installing it. | ||
| - Fixed the Policy details modal not closing when navigating back to the Host details page with the browser's back button. | ||
| - Fixed software titles list sorting to use display name instead of installer filename when a custom display name is set. | ||
| - Fixed the missing "Conditional access" section header on the Settings > Integrations > Conditional access page on Fleet Free. | ||
| - Fixed `fleetctl gitops` silently accepting labels with invalid parameter combinations (e.g. manual labels with query/criteria/platform). | ||
| - Fixed validation that rejected enabling end user authentication on Fleet deployments without Apple MDM configured. End user authentication covers macOS Setup Assistant, Windows MDM, and Linux Orbit enrollment, so the toggle now works on Windows-only and Linux-only fleets as long as the IdP is configured. | ||
| - Fixed an issue where the MDM solution name reported for a host could flip between values across osquery ingestions when the MDM server URL contained substrings matching multiple known MDM vendors. | ||
| - Fixed a bug where `enable_host_users` defaulted to `false` on a fresh Fleet install instead of the documented default `true`, causing the host details page to show "User collection has been disabled." | ||
| - Fixed the IdP "Department" host vital not populating for users whose IdP-to-SCIM mapping included enterprise extension attributes that Fleet does not store. | ||
| - Fixed the Actions dropdown in the Run script modal within the Host details page automatically closing after 2-3s. | ||
| - Fixed GitOps dry runs failing when a VPP app references a label that was added in the same run. | ||
| - Fixed a bug where enrolling an Android device on a Fleet instance with Apple MDM disabled produced a duplicate host record. | ||
| - Fixed Fleet-scoped users getting a 403 when viewing past activities on a host that has user-initiated activities (e.g. lock/wipe/run script/install software), and fixed missing permissions on host activity items for fleet-scoped users. | ||
| * Fixed a server out-of-memory crash that could occur when Apple's VPP (App and Book Management) API repeatedly returned transient errors (HTTP 500 with Retry-After, or error 9646) during VPP API operations (e.g., app installs, user registration, license seat releases). |
Comment on lines
+3
to
+5
| ### Bug fixes | ||
|
|
||
| - Updated Go to 1.26.3. | ||
| - Removed debug symbols from fleet and fleetctl executables to reduce binary size. | ||
| - Reduced database load from `GET /api/latest/fleet/device/{token}/desktop` and other Fleet Desktop endpoints when invalid or expired device auth tokens are presented, by resolving the token to a host ID with a single-table indexed lookup before running the multi-join host-details query. | ||
| - Improved Windows MDM performance when transferring large numbers of hosts between teams or applying bulk profile changes. These operations now return quickly and roll out profile updates to Windows hosts in the background, so host check-ins and other MDM activity are no longer slowed down while a large change is in progress. | ||
| - Added a Redis-backed cache for host lookups on the osquery and orbit authentication paths. Successful lookups are cached for 60s (±10% jitter) and invalidated on writes that mutate cached host fields. Reduces reader-side DB load at scale without changing the HTTP contract. Requires Redis 6.2 or later. | ||
| - Added a missing uninstall option on the host software library even when an installer has no matching software in the host's inventory. | ||
| - Improved Windows MDM profile removal performance by scoping the desired-state subquery. | ||
| - Improved Windows MDM profile removal performance by skipping redundant database writes for verified-remove ACKs. | ||
| - Consolidated non-variable templated Windows MDM profile command inserts from one per-profile to a single bulk insert. | ||
| - Added a periodic cron job to clean up the Windows MDM command queue, reducing write pressure during ACK transactions. | ||
| - Made host team assignment sticky across orbit and osquery re-enrollments. | ||
| - Improved errors returned from the API when running fleetctl commands by dropping path and status code. | ||
| - Improved validation of order parameters on list endpoints. | ||
| - Added the `orbit.debug_logging_on_enroll_duration` agent option to enable orbit debug logging for a specified time period after enrollment. | ||
| - Improved validation for invalid `order_key` values in `/api/v1/fleet/commands`, `/api/v1/fleet/mdm/commands`, and `/api/v1/fleet/mdm/apple/commands` endpoints. | ||
| - Improved the error message when the `name` key is omitted from a GitOps YAML file. | ||
| - Improved the error message when deleting a label used for targeting a software installation. | ||
| - Updated `fleetctl gitops` to warn when `labels:` is specified in no-team or unassigned files, where it is not supported. | ||
| - Updated the expired Fleet Premium license CLI banner to link to https://fleetdm.com/learn-more-about/downgrading instead of a stale FAQ anchor. | ||
| - Updated the Edit label page to reference "fleets" instead of "teams" when a label is associated with a fleet. | ||
| - Updated the setup experience Users card with a link to PSSO local account documentation. | ||
| - Updated empty state copy to be action-oriented. Headers describe the current state ("No hosts", "No policies for this fleet") instead of prompting action. Body text explains what to expect. CTA buttons are explicit ("Add policy", "Schedule a report") and permission-gated. | ||
| - Updated empty states on Hosts, Reports, Policies, and Software pages so search bars, filters, and dropdowns remain visible but disabled when empty, avoiding layout shift when the first item is added. Item count remains visible. | ||
| - Updated Settings, Fleets, Ticket destinations, Certificates, and Identity provider pages with consistent page descriptions and learn-more links. | ||
| - Updated empty state visuals to a fresher, consistent design. | ||
| - Updated timestamps with tooltips on the host Vitals component to always use `cursor: pointer`. | ||
| - Updated the version of the checkout action in the `fleetctl new` template to avoid Node warnings. | ||
| - Updated the MSI builder to skip packaging the unusable "dummy" secret value when building `fleetd-base.msi` for Autopilot installs. | ||
| - Scoped install commands for user-enrolled hosts to the host's Managed Apple Account (`clientUserIds`) instead of `serialNumbers`, so apps install on the correct user account on the device. | ||
| - Surfaced a clear host-level error when license association fails during install (for example, no licenses available or the user has reached the 5-device limit) instead of failing silently. | ||
| - Made `created_at` upper-bound filtering consistent on the list activities API. The endpoint now caps results at `now` by default whether or not `start_created_at` is provided, matching the documented behavior of `end_created_at`. | ||
| - Unified access to global and team policies in the UI by using the now-generic `GET /api/latest/fleet/policies/:id` endpoint. | ||
| - Wrapped `Get-ItemProperty` calls in try/catch blocks during registry enumeration to gracefully handle terminating exceptions (e.g. `System.InvalidCastException`) from malformed registry entries, logging the offending path instead of aborting. | ||
| - Replaced the cryptic "startTLS error: ..." flash with a prescriptive message when saving SMTP settings fails because SSL/TLS is disabled but STARTTLS is still enabled. Added a tooltip on the SSL/TLS checkbox pointing to the STARTTLS toggle in Advanced options. | ||
| - Removed a dead SQL condition in `hostVPPInstalls` that was misleading but harmless. Android VPP apps never produce `nano_command_results` entries (they use Google's Android Management API, not nanoMDM), so the previous `(hvsi.platform != 'android' OR ncr.id IS NULL)` guard was a tautology. Replaced with a clarifying comment. | ||
| - Fixed filtering on the `/api/v1/fleet/labels/:id/hosts` endpoint. | ||
| - Fixed the `usage_statistics` cron failing against fleetdm.com when a large number of near-identical network errors accumulated in the error store. | ||
| - Fixed `fleetctl gitops` failing with HTTP 500 on subsequent runs when a custom software icon's bytes were missing or had failed integrity in the icon store. The server now returns a 409 Conflict from the metadata-only icon update path, and the gitops client falls back to a full upload to recover the bytes automatically. | ||
| - Fixed SAML JIT provisioning so `FLEET_JIT_USER_ROLE_*` attributes with empty, whitespace-only, or missing values are treated as `null` and ignored instead of failing SSO login. | ||
| - Fixed an issue where GitOps controls with only certain keys would not be seen as set. | ||
| - Fixed recovery lock password not being retrievable for hosts transferred to a team with recovery lock disabled. | ||
| - Fixed Fleet's Docker image failing to start in Kubernetes with an `unknown userid` error, triggered by a fleetctl dependency side effect. | ||
| - Fixed a GitOps failure ("converting NULL to uint is unsupported") when moving labels from global to fleet scope, caused by deleted label associations with NULL `label_id` values in `mdm_configuration_profile_labels` and `mdm_declaration_labels`. | ||
| - Fixed `fleetctl gitops --dry-run` intermittently failing with "Resource Not Found" when a team's `software` config was empty. | ||
| - Fixed the MDM SSO callback returning a "missing profile" error for Android enrollment when Apple MDM is not configured. | ||
| - Fixed the team PATCH endpoint rejecting `mdm.enable_disk_encryption` on Fleet deployments where only Windows MDM is configured. Team-level BitLocker enforcement can now be toggled when either Apple MDM or Windows MDM is configured. | ||
| - Fixed an issue where the disk encryption table on the Controls > Disk encryption page did not support horizontal scrolling at narrow viewport widths. | ||
| - Fixed Linux total disk space being double-counted when a filesystem was bind-mounted at multiple paths (e.g. snap-confine's `/tmp/snap.rootfs_*`). | ||
| - Fixed `fleetctl gitops` rejecting `path:` values whose actual filenames contained glob metacharacters even when the file existed at that literal path. | ||
| - Fixed GitOps failing when it attempted to create a label and a consumer of that label (e.g. a profile) in the same run. | ||
| - Fixed `gitops --dry-run` to reject label specs with invalid `platform` values. | ||
| - Fixed the SSO invite acceptance flow by resolving the email from the invite token. | ||
| - Fixed batch script endpoints to return 404 Not Found instead of 200 when the batch execution ID does not exist: `/api/v1/fleet/scripts/batch/:id`, `/api/v1/fleet/scripts/batch/summary/:id`, and `/api/v1/fleet/scripts/batch/:id/cancel`. | ||
| - Fixed a class of silent SCEP managed-certificate renewal failures by recovering `host_mdm_managed_certificates` rows that previously got stuck after the cert ingest matcher missed linking a renewed certificate. | ||
| - Fixed the upcoming activity count on the host details page not updating after installing or uninstalling software. | ||
| - Fixed an issue where GitOps incorrectly rejected keys in Google Calendar API key JSON. | ||
| - Fixed 500 errors on `POST /api/v1/fleet/scim/Users` when the matched host was already mapped to a SCIM user. The host now gets reassigned to the newly-created SCIM user. | ||
| - Fixed an incorrect CPE match on the "slate" Homebrew program. | ||
| - Fixed a bug where applying GitOps to a script-only package by `hash_sha256` reference would wipe the install script, causing self-service installs to silently no-op. | ||
| - Fixed `fleetctl vulnerability-data-stream` to also download OSV (Ubuntu and RHEL) artifacts. | ||
| - Fixed a missing `deleted_policy` activity when a patch policy is removed by GitOps as a result of its underlying Fleet-maintained app installer being removed from the YAML. | ||
| - Fixed a nil-pointer panic in the Android Enterprise Pub/Sub endpoint that occurred when Google's Android Management API sent a device payload missing `hardwareInfo`, `softwareInfo`, or `memoryInfo`. | ||
| - Fixed an issue where, if a custom Apple MDM URL was set, SSO for end user auth would fail. | ||
| - Fixed slow load times and timeouts on the list MDM commands API (`GET /api/v1/fleet/commands`) on Fleet deployments with many Windows hosts. The endpoint now caps `per_page` at 1,000 (default 10) and `page` at 100. Requests above either limit return HTTP 400. To traverse beyond 100 pages, use cursor pagination via the `after` query parameter. | ||
| - Fixed GitOps dry-run to correctly detect the conflict when both `macos_manual_agent_install` and `macos_script` are configured under `setup_experience`. Previously, the dry-run would succeed while the actual GitOps run would fail. | ||
| - Fixed `fleetctl gitops apply` not clearing stale broken `mdm_configuration_profile_labels` rows after a referenced label was deleted, which caused profiles to remain enforced on hosts regardless of updated label targeting. | ||
| - Fixed `GET /api/v1/fleet/commands` returning a SQL error when called with `host_identifier` and the `after` cursor parameter, particularly with `order_key=command_uuid` or `order_key=hostname`. | ||
| - Fixed a UI bug where editing an existing global user to enable two-factor authentication failed with a 422 error. | ||
| - Fixed an issue where an old APNs cert would stay in memory until a restart, instead of correctly updating in place. | ||
| - Fixed a UI inconsistency with non-center-aligned Fleet premium messages on Fleet Free. | ||
| - Fixed a bug where duplicate software installers for Linux could be added. | ||
| - Fixed the "Back to host details" button on a report's details page navigating to the reports list instead of the host's details page after creating a report from a host. | ||
| - Fixed IdP host vitals (full name, department, groups) not populating on the host details page for macOS devices migrated from another MDM via the Tahoe (macOS 26+) end-user-authentication flow. | ||
| - Fixed `POST /api/v1/fleet/queries` returning HTTP 500 when `name` or `query` is JSON `null`. The endpoint now returns HTTP 400. | ||
| - Fixed `GET /api/latest/fleet/policies/:id` (and alias `GET /api/v1/fleet/global/policies/:id`) to return and properly populate team policies, and to perform an authorization check on team policies before returning. | ||
| - Fixed an issue where GitOps dry-run would not validate Apple config profile payload scope conflicts or the use of unknown Fleet variables in all types of profiles. | ||
| - Fixed Android hosts being auto-deleted by host expiry on every cleanup tick after re-enrolling, which previously caused an hourly enroll/delete loop while host expiry was enabled. | ||
| - Fixed an issue where replica lag could lead to devices not being assigned a setup experience profile on device sync from DEP. | ||
| - Fixed the Location and MDM status vitals on the My device page rendering as clickable links even though they had no associated modal, by rendering them as plain text in read-only contexts. | ||
| - Fixed the Export hosts button to always reflect the current sort, search, and filter state instead of potentially using stale values. | ||
| - Fixed a false-positive `update_conditional_access_bypass` activity that was created whenever any app config setting was changed while Okta conditional access was already configured with `bypass_disabled: true`. Also stopped the related side effect of clearing existing conditional access bypass records on those unrelated saves. | ||
| - Fixed UI elements in the script library not respecting GitOps mode when enabled. | ||
| - Fixed `POST /packs` with a JSON null name silently creating a pack with an empty name. The endpoint now returns a 400 Bad Request, matching the behavior for an empty-string name. | ||
| - Fixed stale "Selected hosts" on the Edit label page after a previous edit by invalidating the related query caches on success, and when navigating between manual labels by scoping the hosts cache per label and keying the form on the actual host set. | ||
| - Fixed subtle text alignment issues in the UI. | ||
| - Fixed a file descriptor leak in vulnerability processing where deleted `goval_dictionary` sqlite files were kept open until Fleet server restart. | ||
| - Fixed setup experience remaining stuck for up to 90 minutes after a software installer was edited or deleted while a host was installing it. | ||
| - Fixed the Policy details modal not closing when navigating back to the Host details page with the browser's back button. | ||
| - Fixed software titles list sorting to use display name instead of installer filename when a custom display name is set. | ||
| - Fixed the missing "Conditional access" section header on the Settings > Integrations > Conditional access page on Fleet Free. | ||
| - Fixed `fleetctl gitops` silently accepting labels with invalid parameter combinations (e.g. manual labels with query/criteria/platform). | ||
| - Fixed validation that rejected enabling end user authentication on Fleet deployments without Apple MDM configured. End user authentication covers macOS Setup Assistant, Windows MDM, and Linux Orbit enrollment, so the toggle now works on Windows-only and Linux-only fleets as long as the IdP is configured. | ||
| - Fixed an issue where the MDM solution name reported for a host could flip between values across osquery ingestions when the MDM server URL contained substrings matching multiple known MDM vendors. | ||
| - Fixed a bug where `enable_host_users` defaulted to `false` on a fresh Fleet install instead of the documented default `true`, causing the host details page to show "User collection has been disabled." | ||
| - Fixed the IdP "Department" host vital not populating for users whose IdP-to-SCIM mapping included enterprise extension attributes that Fleet does not store. | ||
| - Fixed the Actions dropdown in the Run script modal within the Host details page automatically closing after 2-3s. | ||
| - Fixed GitOps dry runs failing when a VPP app references a label that was added in the same run. | ||
| - Fixed a bug where enrolling an Android device on a Fleet instance with Apple MDM disabled produced a duplicate host record. | ||
| - Fixed Fleet-scoped users getting a 403 when viewing past activities on a host that has user-initiated activities (e.g. lock/wipe/run script/install software), and fixed missing permissions on host activity items for fleet-scoped users. | ||
| * Fixed a server out-of-memory crash that could occur when Apple's VPP (App and Book Management) API repeatedly returned transient errors (HTTP 500 with Retry-After, or error 9646) during VPP API operations (e.g., app installs, user registration, license seat releases). |
Comment on lines
11
to
+14
| - Fixed `fleetctl gitops` rejecting Android or Windows configuration profiles when editing an existing team, even when the corresponding MDM platform was configured. | ||
| - Implemented roaring bitmaps in historical data collection for improved performance. | ||
| - Implement roaring bitmaps in historical data collection for improved performance. | ||
| - Fixed dynamic SCEP certificate issuance failing with an "Invalid NDES admin credentials" error when the NDES Admin URL is fronted by Okta or another gateway that uses HTTP Basic auth instead of NTLM. | ||
| - Removed unneeded call to get tracked CVEs when reading CVE chart data. | ||
| - Remove unneeded call to get tracked CVEs when reading CVE chart data. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit