🏗️ New commits pushed to Fleet: - allenhouchins: Add macOS Fleet-maintained apps (F) (#47403) - getvictor: Defer Windows MDM profile removals via pending-delete retention (#47156) - rachaelshaw: Revert "[API] Add multiple custom packages for the same software title in the... - eashaw: Website: Update user routing in deliver-talk-to-us-submission action (#47457) - lukeheath: Drop contents: write to read in release workflows (#47236) - fleet-release: Update Fleet-maintained apps (#47460) - eashaw: Website: Update error handler in http config (#47467) - lukeheath: Website: Add dashboard vulnerability exposure article (#46485) - allenhouchins: Add macOS Fleet-maintained apps (M) (#47453) - allenhouchins: Add Codex as a macOS FMA (#47480) - allenhouchins: Enable macOS EndpointSecurity and FDE profile (#47448) - allenhouchins: Use JetBrains build numbers in FMA patch policies on Windows (#47484) - fleet-release: Update Fleet-maintained apps (#47485) - lucasmrod: Add changes for fleetd v1.56.3 (#47451) - GrayW: Linux disk encryption key escrow: Improve confirmation modal (#47097) - AdamBaali: Fix link format for Windows hardening PowerShell script (#47258) - MagnusHJensen: validate os updates and os profiles on dry-run for empty setup (#47408) - spalmesano0: Add link for Linux OS support to Fleet Desktop guide (#47455) - mostlikelee: Add Redis 8.x/Valkey CI test matrix and optional Valkey loadtests (#47180) - lucasmrod: Improve SAMLResponse validation in SSO callbacks (#47463) - MagnusHJensen: improve apple mdm ber parsing (#47498) - allenhouchins: Add macOS Fleet-maintained apps (T) (#47333) - BCTBB: Bumping the loadtest/osquery-perf module version to utilize increased ulimits... - rachaelshaw: Update

/server/api_endpoints/api_endpoints.yml

CODEOWNER (#47469) - lucasmrod: Docs updates for the new flag for SSO login rate limiting (#47509) - xpkoala: Add release QA issue template for fleetd (#47195) - rachaelshaw: Remove DRI for

api_endpoints.yml

from website config (#47529) - GrayW: Remove macos_setup reference (#47497) - lewisbarajas: Update go-to-market-operations.md - fixed a typo in the beginning of … (#47521) - akuthiala: Create bridging-the-it-security-divide.md (#47487) - allenhouchins: Unfreeze FMAs (#47525) - allenhouchins: Add macOS Fleet-maintained apps (L) (#47519) - eashaw: Website: update error handling in Github webhook (#47533) - nulmete: Policies: combine include/exclude label targeting + add labels_exclude_all (#... - akuthiala: Website: Add CIS benchmarks blog article (#47486) - cmagadia: Update leadership.md (#47517) - ksykulev: Throttle requests to AMAPI during profile reconcilation (#47223) - mostlikelee: Add vuln-triage Claude skill (#44246) - eashaw: Website: update testimonials on visibility and reporting page (#47542) - RachelElysia: Fleet UI: Unreleased bug fixes to command palette (AB vs ABM, Controls on Fle... - RachelElysia: Fleet UI: preserve raw software name for icon matching when display name over... - allenhouchins: Add macOS Fleet-maintained apps (A) (#47536) - getvictor: Windows MDM reconciler cleanup and remaining fixes (#47493) - eashaw: Website: Bring back homepage hero quote (#47554) - allenhouchins: Add macOS Fleet-maintained apps (N) (#47537) - fleet-release: Update Fleet-maintained apps (#47555) - allenhouchins: Add 12 Windows FMAs (#47558) - fleet-release: Update Fleet-maintained apps (#47570) - allenhouchins: Remove orphaned Fleet-maintained app files (#47576) - getvictor: Fixing Windows SCEP issues (#47255) - lucasmrod: Add fleet-user creation check (#47566) - nulmete: GitOps: combined include/exclude policy label targeting + labels_exclude_all ... - noahtalerman: Revise APNs certificate renewal instructions (#47353) - noahtalerman: Update enrollment instructions for ChromeOS hosts (#47226) - noahtalerman: GitOps mode is premium only (#47216) - noahtalerman: Seamless migration: Remove links for images (#46919)

- JordanMontgomery: Initial move of fleet desktop app (#47181) - fleet-release: Update Fleet-maintained apps (#47596) - danbgordon: Dbg add jamf switch wp landing page (#47534) - kilo-code-bot[bot]: Remove 'windows coming soon' from /software-management (#47556) - MagnusHJensen: update applebmapi tool with command flag and ability to fetch ADUE service di... - jkatz01: Show Fleet Premium message when viewing install details modal on Fleet Free (... - allenhouchins: Add more Windows FMAs (#47560) - jkatz01: Fix TestIntegrationsEnterprise/TestFMAVersionRollback failing because of FMA ... - eashaw: Website: Add CTA to article template (#47546) - RachelElysia: Fleet UI: Fix dark mode switch flicker on data tables (#47541) - RachelElysia: Fleet UI: Fix radix missing title/description logs (#47607) - eashaw: Website: add section to software-management page (#47616) - lucasmrod: Ignore openssl CVEs in fleetdm/bomutils and fleetdm/wix (#47587) - github-actions[bot]: Update versions of fleetd components in Fleet's TUF [automated] (#47631) - getvictor: Filter OTEL by environment (#47574) - MagnusHJensen: log as error in apple reconciler for mixed label modes (#47502) - eashaw: Website: Update get-territory-user-id helper (#47630) - rachaelshaw: Software API is no longer experimental (#47473) - mike-j-thomas: Add Mollie case study (#47494) - rachaelshaw: Fix policy

labels_include_any

documentation (#47643) - eashaw: Website: remove/compress large assets (#47644) - ksykulev: Throttling android software installs (#47461) - fleet-release: Update Fleet-maintained apps (#47645) - allenhouchins: Add SmartSVN icon and update icons map (#47648) - SuzyBeck: Update README.md (#47636) - eashaw: Website: add "Security & control" page (#47377) - getvictor: Updated TF to use OTEL deployment.environment best practice (#47651) - MagnusHJensen: BYOF: Add support for unique token ADUE (#47407) - nulmete: Fix macOS "Update new hosts to latest" staying enabled in GitOps after cleari... - allenhouchins: Add even more Windows FMAs (#47584) - JordanMontgomery: Add note about Apple-initiated OS updates (#47620) - fleet-release: Update Fleet-maintained apps (#47662) - allenhouchins: Add more Windows FMAs (A) (#47659) - nulmete: Reap sudo child processes in execuser on Linux to prevent zombies (#47664) - cdcme: Show .sh scripts in macOS setup experience (#47629) - noahtalerman: Update labeling process for new requests (#47669) - fleet-release: Update Fleet-maintained apps (#47668) - spalmesano0: Positive language checkboxes (#47603) - dantecatalfamo: Filter vulnerable software by cvss on my device page (#47372) - spalmesano0: Navigate back to the report details page after saving a report (#46754) - allenhouchins: Add Sonos as a macOS & Windows FMA (#47671) - fleet-release: Update Fleet-maintained apps (#47676) - RachelElysia: Fleet UI: Command palette keyboard will auto-expand sub-items, smooth scroll,... - RachelElysia: Self-service: Include failed installs in "Install all" (#47684) - jkatz01: Fix scrollbar showing up when not needed in report/policy results tables (#47... - eashaw: Website: update get-enriched helper (#47688) - noahtalerman:

mdm.allow_all_declarations

current supports all configuration declarations ... - georgekarrv: Adding changes for Fleet v4.86.2 (#47219) - spalmesano0: Show actual number of selected hosts (#46334) - RachelElysia: Fleet UI: My account theme radios stay in sync, fix gradient flash on no-op t... - allenhouchins: Paginate Fleet-maintained apps and filters (#47615) - kitzy: Add query to list users with secure token for FileVault access on macOS (#47466) - spalmesano0: Move tooltip for vulnerability support to "Not supported" (#47074) - raju249: Extract cron schedule registration out of runServeCmd (#47562) - mike-j-thomas: swap/update quotes (#47734) - MagnusHJensen: BYOF: API & GitOps support (#47506)

- MagnusHJensen: update docs for frontend route to match new spec (#47739) - nulmete: Gate all policy label inclusions/exclusions as premium-only (#47686) - MagnusHJensen: Join MDM for missing status for non osquery devices (#47672) - MagnusHJensen: BYOF: Frontend changes (#47523) - RachelElysia: Fleet UI: Empty state full-width fix, self-service row truncation (#47746) - cdcme: Fix self-service update button flashing (#47749) - georgekarrv: Adding initial tool - dibble the tapir for seeding data (#46122) - noahtalerman: Update documentation for running locally built fleetd (#47625) - ksykulev: Added FLEET_VAR_HOST to android configs (#47642) - ksykulev: Clear idp cookie after succesful SSO (#47569) - dependabot[bot]: Bump form-data from 4.0.5 to 4.0.6 (#47710) - dependabot[bot]: Bump dompurify from 3.4.2 to 3.4.9 (#47709) - MagnusHJensen: fix gitops relative paths for unassigned and org_settings (#47512) - juan-fdz-hawa: Prevent in-flight carves from being wrongly expired by S3 cleanup - getvictor: Orbit re-enroll improvements (#47652) - nulmete: Add daemon_reachable column to santa_status table (#47751) - fleet-release: Update Fleet-maintained apps (#47774) - RachelElysia: Self-service categories: bug fixes on empty state, fleet-free layout, dropped... - fleet-release: Update Fleet-maintained apps (#47781) - jkatz01: Pin Fleet-maintained apps - migration (#47778) - georgekarrv: Patch openssl in fleet-docker image to resolve CVE-2026-34182 (#47719) - dependabot[bot]: Bump hono from 4.12.22 to 4.12.25 in /tools/fleet-slackbot (#47766) - allenhouchins: Add Spokenly app support (#47795) - Brajim20: Add 4.87.0 baseline loadtest results (#47794) - spalmesano0: Use "Example payload" for all payload example buttons and always enable examp... - spalmesano0: Remove comments from Agent options in the UI (#44715) - lukeheath: Add daily Trivy scan of fleetdm/fleet built from main (#47518) - fleet-release: Update Fleet-maintained apps (#47800) - chrstphr84: Loadtest: add 4.86->4.87 migration metrics run (#47803) - spalmesano0: Display instructions needed for SSO-enabled accounts with

fleetctl

(#46768) - mike-j-thomas: image fix on security and control page (#47737) - getvictor: Always display Windows ESP error when software install fails (#47522) - eashaw: Website: update 404 page (#47726) - spalmesano0: Clarify MDM status tooltips (#47675) - fleet-release: Update Fleet-maintained apps (#47819) - MagnusHJensen: filter OS versions platforms (#47742) - lucasmrod: Add self-heal mechanism in case of corruption in osquery or Fleet Desktop exe... - noahtalerman: Better error message: Missing private key when adding a custom variable (#47785) - noahtalerman: Product Design rituals: Remove 'Bug bash' (#47827) - getvictor: Don't require end user auth on orbit re-enrollment (#46300) (#47740) Read more: https://github.com/fleetdm/fleet/commits/main