🏗️ New commits pushed to Fleet: - akuthiala: Update software-management.ejs (#44812) - mikermcneil: Handbook: Values: Expand “public by default” (#44814) - MagnusHJensen: CSAH: clear state on ABM re-enrollment (#44722) - lucasmrod: Changes to ease testing while releasing fleetd to TUF (#44738) - lucasmrod: Update osquery schemas and flags to 5.23.0 (#44758) - nulmete: Add SVG support for custom organization logos (#44748) - ireedy: Update receive-from-github.js (#43597) - noahtalerman: Hiring a Product Designer: CTO before CEO (#44823) - noahtalerman: Hiring a Product Designer: Add reference checks (#44825) - nulmete: Dark mode tweaks: error pages text contrast, dropdown borders, table corners ... - harrisonravazzolo: Adding Cavalry as a macOS FMA (#44815) - noahtalerman: Apple Business rename: Copy tweak and URL change (#44829) - fleet-release: Update Fleet-maintained apps (#44835) - sovr: Fix Typo - Update leadership.md (#44834) - allenhouchins: Use bash shebang in generated scripts (#44836) - fleet-release: Update Fleet-maintained apps (#44840) - marko-lisica: Support VPP apps from non-US App Store regions (#44368) - mikermcneil: Website: Small FAQ updates on /pricing (#44808) - RachelElysia: Fleet UI: Controls > Setup experience descriptions cleanup (#44824) - RachelElysia: Fleet UI: Fix 403, 404, 500 clouds in dark mode (#44842) - allenhouchins: Always start token rotation (#39533) - fleet-release: Update Fleet-maintained apps (#44845) - sharon-fdm: Improve error message when referencing a bad label for a configuration profil... - allenhouchins: Switch scripts to bash and update refs (#44853) - allenhouchins: Enable Apple hardware attestation for workstations (#44860) - johnjeremiah: Changing default setting in active campaign (#44862) - lukeheath: Add CODEOWNERS entry for openspec directory (#44866) - getvictor: Setup experience for Windows. (#44306) - dependabot[bot]: Bump axios from 1.15.0 to 1.15.2 (#44744) - getvictor: Add support for SAN in Android certificate templates. (#44690) - MagnusHJensen: Check device auth token individual before querying host tables on auth (#44817) - kilo-code-bot[bot]: Add Field Event Follow-Up process to Sales handbook (#44660) - Claude: [WIP] Fix denial of service vulnerability in jsonparser (#44702) - eashaw: Website: Update validation errors in build static content script (#44883) - sgress454: Allow disabling chart datasets: frontend (#44797) - allenhouchins: Run ingest workflow every 4 hours (#44851) - fleet-release: Update Fleet-maintained apps (#44890) - irenareedy: Update cybersecurity-company-1.md (#44774) - shc-sync: Remove duplicate 'and' in config section (#44893) - spalmesano0: Fix broken link for mdm.enable​_custom​_os​_updates​_and​_filevault (#44785) - lukeheath: Update guidelines on reviewing AI-generated code (#44841) - fleet-release: Update Fleet-maintained apps (#44900) - MagnusHJensen: add script output to GitOps (#44728) - JordanMontgomery: 43887 MLAPR backend (#44726) - JordanMontgomery: 43890 MLAPR frontend (#44739) - spalmesano0: Fix broken links for setup_experience (#44903) - fleet-release: Update Fleet-maintained apps (#44914) - juan-fdz-hawa: Fix IdP department host vital missing when SCIM PATCH carries extra attrs (#4... - kilo-code-bot[bot]: Handbook: Design system updates are up to Mike T (#44868) - johnjeremiah: Add Primo link to their logo (#44730) - fleet-release: Update Fleet-maintained apps (#44921) - danbgordon: update linux page with whitepaper cta (#44915) - sgress454: Allow disabling chart datasets: backend (#44769) - sgress454: Update chart styles / fix bugs (#44813) - nulmete: Clear stale broken label rows on profile batch upsert (#44847) - andymFleet: 42218 updated ios version number to include supplemental extra (#44727) - juan-fdz-hawa: Clarify SMTP TLS error and surface STARTTLS toggle (#34104) - dependabot[bot]: Bump github.com/apache/thrift from 0.22.0 to 0.23.0 (#44889)

- allenhouchins: Create

fleetctl

pkg asset every release (#35089) - mikermcneil: Update device-management.ejs (#44941) - lucasmrod: Ignore critical CVE in fleetdm/fleetctl docker image (#44939) - kilo-code-bot[bot]: Show 'Fleet will try again.' in host activity feed for NotNow MDM commands (#... - kilo-code-bot[bot]: Handbook: Add "Mark an account as a Top target" section to GTM operations (#4... - lukeheath: Add temporary workflow to clear legacy Trivy alerts (#44942) - noahtalerman:

tools/

directory: Rename "queries" => "reports" and "teams" => "fleets" (#4... - shc-sync: Fix broken link for Sean Hannon in CS README.md (#44895) - justinehg: Update README.md (#44926) - lukeheath: Change runner from ubuntu-latest to ubuntu-16core (#44944) - juan-fdz-hawa: Fix SSO invite acceptance error when accepting invitation (#34103) - eashaw: Website: remove stripe script tag, update customer dashboard (#44159) - danbgordon: update asset to french version (#44913) - mostlikelee: Recover stuck SCEP managed-cert state via matcher extension (#44691) - allenhouchins: Disable auto-updates for new macOS hosts (#44957) - eashaw: Website: update default consent mode set in website header (#44952) - getvictor: Android cert SAN frontend (#44809) - allenhouchins: Update fleet-desktop checksums (#44961) - georgekarrv: Adding changes for Fleet v4.84.3 (#44886) - fleet-release: Update Fleet-maintained apps (#44962) - kitzy: Fix typos in using-bioutil-cmd.md (#44951) - danbgordon: fix LP long title and chapter numbering (en and fr versions) (#44966) - fleet-release: Update Fleet-maintained apps (#44977) - sgress454: Fix relative spread + calendar dates on checkerboard (#44959) - kilo-code-bot[bot]: Make GitOps mode indicator link to change management settings for global admi... - kilo-code-bot[bot]: Add Oscar Taracena testimonial to linux-management landing page (#44972) - fleet-release: Update Fleet-maintained apps (#44996) - mikermcneil: Website: Update homepage.ejs (#45001) - mikermcneil: Website: Update observability.ejs (#45000) - mikermcneil: Website: Update infrastructure-as-code.ejs (#44999) - ksykulev: Optimize OSV vulnerability scanning (#44684) - ksykulev: Creating product index to speed up vulnerability scanning (#44910) - eashaw: Website: update logo carousel component & assets (#45002) - sharon-fdm: Fix GitOps failure when moving labels from global to fleet scope (#44983) - mike-j-thomas: home-page-button-fix (#45004) - kilo-code-bot[bot]: testimonials.yml: patch management (#44717) - MagnusHJensen: check push cert staleness after 5 minutes of in-memory cache time (#44919) - GrayW: Create managing-chrome-with-fleet.md (#44578) - spalmesano0: Update note about Google Workspace privileges (#44878) - RachelElysia: Fleet UI: Update empty states for host-related modals (#44940) - RachelElysia: Fleet UI: Host details page empty states (#44884) - RachelElysia: Fleet UI: Manage host page empty state updates (#44880) - kilo-code-bot[bot]: Remove Hardware security keys section from IT security handbook (#44984) - MagnusHJensen: always assign profile to missing devices due to replica lag (#45008) - kilo-code-bot[bot]: Update communications.md: replace Yubikeys with Okta Verify with FastPass (#4... - kilo-code-bot[bot]: Remove YubiKeys from open-positions responsibility line (#44981) - rfoo2015: Update communications.md (#44988) - fleet-release: Update Fleet-maintained apps (#45010) - getvictor: osquery_perf: add Windows-specific disk encryption query handling. (#44998) - lukeheath: Trivy: skip SARIF upload on PR/push, add legacy category dismissal (#44987) - dependabot[bot]: Bump axios from 1.15.0 to 1.15.2 in /tools/fleetctl-npm (#44871) - fleet-release: Update Fleet-maintained apps (#45016) - juan-fdz-hawa: Fixes flaky test (#37026) - fleet-release: Update Fleet-maintained apps (#45026) - juan-fdz-hawa: Improve auth around osquery endpoints (#44209)

- lukeheath: Fix batch of unreleased dark-mode and UI bugs (#44978) - kilo-code-bot[bot]: Clarify custom variables are global for Fleet Premium users (#44991) - mike-j-thomas: Update writing.md (#45006) - sgress454: Don't wipe out dataset collection config when not provided in GitOps (#45049) - danbgordon: update customer image on quote (#45057) - BCTBB: Load test - Workflow guardrails and osquery perf updates (#45044) - eashaw: Add workflow to prevent quick changes to website dependencies, update website... - mostlikelee: Lower CVE-2025-0938 spot-check threshold to 1 (#45056) - JordanMontgomery: Don't write the secret.txt when the secret is the dummy placeholder value (#4... - juan-fdz-hawa: Make activity list end-date filter consistent (#38437) - RachelElysia: Fleet UI: Fix export button dependencies (#45020) - RachelElysia: Fleet UI: Empty state followups (#45039) - RachelElysia: FE: Remove unused route params (#45025) - getvictor: Fixing frontend issue displaying pending details. (#45068) - danbgordon: remove incorrect customer testimonial (#45070) - fleet-release: Update Fleet-maintained apps (#45071) - MagnusHJensen: Fix gitops controls set criteria (#45007) - andymFleet: Revise seeding data documentation structure and expanded hosts overview (#44642) - fleet-release: Update Fleet-maintained apps (#45074) - noahtalerman: Custom variables changes: Currently, only Apple profiles are resent (#44850) - noahtalerman: Rename 'Custom OS settings' to 'Configuration profiles' (#44754) - danbgordon: add YT feature videos to release blog highlights (#45061) - eashaw: Website: update errors logged in build-static-content script (#45081) - dependabot[bot]: Bump fast-uri from 3.1.0 to 3.1.2 (#45063) - dependabot[bot]: Bump @babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.4 (#45084) - kilo-code-bot[bot]: Update virtual persona for email automation section in marketing ops handbook... - akuthiala: Ak test claude to create on-premise page (#44019) - MagnusHJensen: Remove Martin from product groups page (#45075) - eashaw: Website: bring back CTA buttons on homepage (#45089) - jkatz01: Fix missing deleted_policy activity for auto-cleaned patch policies (#45045) - fleet-release: Update Fleet-maintained apps (#45098) - fleet-release: Update Fleet-maintained apps (#45103) - akuthiala: Add assets to marketing handbook pages (#45104) - fleet-release: Update Fleet-maintained apps (#45120) - kilo-code-bot[bot]: Rename 'Resources / blog' nav item to 'Releases / news' (#45121) - kilo-code-bot[bot]: Update /replace-jamf secondary CTA to match homepage hero (#45122) - kilo-code-bot[bot]: Update secondary CTAs on /device-management and /linux-management to match ho... - lucasmrod: Fix get policy by id endpoint and unify access in UI (#45048) - noahtalerman: Dashboard charts: Tweak tooltips (#45079) Read more: https://github.com/fleetdm/fleet/commits/main