🏗️ New commits pushed to Fleet: - Leanngove: Revise user story handling post-design review (#48457) - noahtalerman: Two Product Designers for #g-power-to-pc (#48456) - noahtalerman: Foreign vitals mapping: Update SCIM integration instructions (#48413) - eashaw: Website: update report details page (#48462) - noahtalerman: Zay is DRI of usage statistics (#48425) - nulmete: Fix IdP name overflowing button in login page (#48426) - dantecatalfamo: Add host '921' to read-only device excluded list (#48436) - noahtalerman: Add "DRIs" to managed Chrome bookmarks (#48424) - juan-fdz-hawa: Fix API endpoint validation for prefix-mounted SCIM routes - nulmete: Add Cache-Control to static assets served under /assets/ (#48409) - raju249: Boot-test runServeCmd end to end (serve.go ~7% to ~64% coverage) (#48261) - nulmete: fix(fleet-mcp): security hardening for the MCP server (#47908) - eashaw: Regenerate expired dev license (#48484) - getvictor: Clarify 2 ways to enroll into Windows MDM (#48435) - fleet-release: Update Fleet-maintained apps (#48476) - lucasmrod: Bump Render blueprint MySQL to 8.0.44 (#47488) (#48481) - lucasmrod: Fix IP blocking in tests (#48492) - georgekarrv: Adding changes for Fleet v4.87.1 (#48291) - nulmete: feat(fleet-mcp): add inventory tools (get_software, get_host_users) (#48092) - juan-fdz-hawa: Small UI tweaks for the Policy details page - georgekarrv: Adding PR check skip for minor releases, QA issue create, switch version chan... - mikermcneil: Handbook: Add leave-behind deck (#48510) - georgekarrv: Include new tools in update-go and fix dibble (#48461) - cdcme: Update story speccing skill (#48403) - spalmesano0: Add public IP address to host search (#46809) - RachelElysia: Fleet UI: Stop clipping action dropdown menus inside scrollable tables (#48430) - marcusallen97: Fix macOS 26 broken CIS benchmark policy queries (#48282) - allenhouchins: Fix article title casing in metadata (#48518) - getvictor: Fix orbit nudge test mdm connection fidelity (#48423) - getvictor: Limit lint concurrency to half CPUs (#48471) - getvictor: Improved GitOps consistency for Windows BatchSetMDMProfiles (#48467) - eashaw: Website: Fix build script error in go-to-market-operations.md (#48519) - eashaw: Website: Update form-data version in package-lock.json (#48095) - eashaw: Website: Fix bottom banner on two landing pages, update routes for pages in t... - noahtalerman: Update favicon size on Fleet product (#48433) - noahtalerman: Remove redundant premium checkbox (#48489) - fleet-release: Update Fleet-maintained apps (#48533) - kilo-code-bot[bot]: Website: Replace whitepaper CTAs with 'Get a demo' on infrastructure-as-code ... - karmine05: fix(fleet-mcp): teams filter + policy SQL retrieval (#45542) - fleet-release: Update Fleet-maintained apps (#48540) - noahtalerman: Update Chrome managed bookmarks (#48547) - lucasmrod: Reduce MySQL reader load on GET /hosts with device_mapping + search query (#4... - marko-lisica: Improve push-reference-docs skill: handle diverged docs branches on retarget ... - fleet-release: Update Fleet-maintained apps (#48548) - lucasmrod: Associate all matching hosts with a SCIM/IdP user (not just the first) (#48351) - fleet-release: Update Fleet-maintained apps (#48551) - lucasmrod: Add VEX exclusions for wix and fleetctl image scans (#48550) - AndreyKizimenko: Update Release QA issue template (#48529) - georgekarrv: Rename product groups: #g-mdm → #g-apple-at-work, #g-software → #g-auto-patch... - georgekarrv: Handbook: reduce thread juggling in support escalations (#48512) - JordanMontgomery: Fix manual-personal enrollment for iOS/iPadOS (#48534) - georgekarrv: Updating team host id's and new group names for labels in dogfood (#48569) - noahtalerman: Reports: Clarify why there are no results (#48552) - allenhouchins: Document ACME certificate renewal in cert deployment guide (#48085) - allenhouchins: Add retries for brew API failures (#48306)

- juan-fdz-hawa: Fix S3 file carve cleanup hang and rework reconciliation - allenhouchins: Support wildcard expansion in launchctl service removal (#48536) - getvictor: Reject unsupported OnPremise Windows MDM enrollment with an actionable messag... - noahtalerman: Labels-filter search input has low-contrast text and misaligned icon (#48578) - noahtalerman: Show script ID/configuration profile UUID on hover in UI (#45787) - spalmesano0: Rename "Create" buttons and links to "Add" across the Fleet UI (#48284) - eashaw: Website: add link on software management page (#48591) - noahtalerman: Product design sprint kickoff ritual: Remove retro (#48575) - eashaw: Website: update ajax button component and contact page (#48590) - georgekarrv: Adding in check to disable recovery lock on personal macos since it doesn't h... - noahtalerman: Software title page tweaks (#48577) - fleet-release: Update Fleet-maintained apps (#48583) - lucasmrod: Update osquery schema and flags to 5.23.1 (#48587) - fleet-release: Update Fleet-maintained apps (#48608) - georgekarrv: Adding changes for Fleet v4.88.0 (#48446) - juan-fdz-hawa: Fix Redis MOVED errors from query results counts in cluster mode - juan-fdz-hawa: Fix cron jobs stuck in "expired" when a run is interrupted mid-flight - juan-fdz-hawa: Fix installed_software status in policy automation activities - pintomi1989: Added "Create a Fast-track issue on the help-customers board" to CSM … (#48576) - fleet-release: Update Fleet-maintained apps (#48615) - lucasmrod: Fix panic in GetClientConfig with null agent options config (#47388) (#48584) - fleet-release: Update Fleet-maintained apps (#48630) - noahtalerman: "Filtered" badge is vertically misaligned in dashabord chart headers (#48491) - georgekarrv: Add tech leads to CODEOWNERS for .claude directory (#48479) - georgekarrv: Bump migration timestamps after 4.88 cherry-pick (#48617) - kilo-code-bot[bot]: Add autopatch section to all software catalog pages (#48527) - kilo-code-bot[bot]: Better error message: Configuration profiles has characters that need escapin... - fleet-release: Update Fleet-maintained apps (#48643) - allenhouchins: Refresh EDR Freeze article and CTAs (#48663) - allenhouchins: Add key takeaways and CTAs to AI jobs article (#48588) - noahtalerman: Warn users about file carving size limits (#47376) - noahtalerman: API: Fix "Get host by Fleet Desktop token" description for iOS/iPadOS (#48517) - jkatz01: Fix GitOps creating duplicate software titles (#48664) - mike-j-thomas: Update Thumbtack customer story (#48673) - ThomasSalomon4: Typo (Digial -> Digital) (#48665) - noahtalerman: Add "DDM" wording for macOS declarations profiles (#48648) - LcTrKiD: [fix-no-Query-field] fleet-mcp: expose policy SQL in get_policies response (#... - fleet-release: Update Fleet-maintained apps (#48682) - plop28: Add CachyOS support (#47757) - lucasmrod: Fix performance regression in

software_macos

query (#48649) - lucasmrod: Google Workspace settings: page description instead of instructions card (#48... - lucasmrod: Fix TestGitOpsFullGlobal failing on main after Windows BatchSetMDMProfiles ch... - kilo-code-bot[bot]: Remove 52 case studies from fleetdm.com and social proof handbook (#48669) - sharon-fdm: Add native Splunk HEC log destination (#48455) - lucasmrod: Fix nondeterministic device_mapping order in ListHosts (#48696) - lucasmrod: Cleanup

policy_membership

stale entries in

distributed/write

(#48674) - sharon-fdm: Optimize query aggregated stats cron to skip queries without execution data (... - eashaw: Website: Add FAQ to /device-management page's header (#48709) - rachaelshaw: v4.88.0 doc changes (#46357) - noahtalerman: Update fleet-server-configuration.md (#48647) - GrayW: Improve readability of required field (#48684) - noahtalerman: GitOps (YAML) reference changes: Filtering for vulnerability exposure (#48640) - fleet-release: Update Fleet-maintained apps (#48714)

- getvictor: Loadtest: make MySQL max open conns tunable (#44802) (#48472) - fleet-release: Update Fleet-maintained apps (#48728) - fleet-release: Update Fleet-maintained apps (#48730) - fleet-release: Update Fleet-maintained apps (#48740) - fleet-release: Update Fleet-maintained apps (#48741) - fleet-release: Update Fleet-maintained apps (#48744) - marko-lisica: Update apps when closed (#48662) - spalmesano0: Fix Optional -> optional (#48753) - lucasmrod: Add CachyOS support (part 2/2) (#48688) - lucasmrod: Fix live results error page from browser auto-translate (#48277) (#48705) - andymFleet: 46235 dep profile assigner context cancelled (#48473) - allenhouchins: Revert "Update apps when closed" (#48758) - fleet-release: Update Fleet-maintained apps (#48745) - noahtalerman: Update Android device sync instructions and clarifications (#48428) - noahtalerman: Renaming: Update permissions (role based access) (#48431) - allenhouchins: Add WinDirStat as a Windows FMA (#48762) - spalmesano0: Update Okta PSSO guide (#48681) - allenhouchins: Add article: control Apple beta programs with DDM (#48646) - allenhouchins: Refresh CIS compliance article copy (#48768) - fletcher-rudra: Add Zorin OS as a recognized Linux platform (#45712) - lucasmrod: Add VEX exclusions for fleetctl (#48749) - allenhouchins: Refresh config-as-code article intro and takeaways (#48764) - allenhouchins: Update Apple beta programs article to current article format (#48776) - noahtalerman: Setup experience software is installed on iOS/iPadOS hosts (any enrollment me... - andreasn-work: Add testimonial from Josh Radcliffe (#48656) - getvictor: Improved the performance of Windows MDM profile installation (#48733) - lucasmrod: Fix data race detected by Splunk tests in CI (#48778) - allenhouchins: Reorder article intros and refresh CTAs (#48785) - lukeheath: Handbook: MDM and Software product groups become Apple @ Work and Auto Patchi... - cdcme: Fix platform capitalization (#48777) - fleet-release: Update Fleet-maintained apps (#48795) - cdcme: Fix custom packages download button (#48794) - getvictor: Removed the unused

/api/mdm/microsoft/auth

Windows MDM STS endpoint (#48734) - getvictor: Show certificates on host details page for Windows (#31294) (#48469) - lucasmrod: Fix polling of

/proc/stat

on Linux by caching (#48750) - lukeheath: Bump axios and form-data to resolve Dependabot CVE alerts (#48465) - lucasmrod: Document Fleet as a Go module workaround and remove Go module publishing work... - allenhouchins: Retry transient GitHub errors in winget ingester (#48775) - cdcme: Count FMAs by slug (#48783) - JordanMontgomery: Persist byod=true enroll param through IdP redirects (#48808) - getvictor: Add FLEET_MDM_ENABLE_DISK_ENCRYPTION alias for custom BitLocker profiles (#43... - fleet-release: Update Fleet-maintained apps (#48812) - allenhouchins: Rename Gemini app to Google Gemini (#48817) - cdcme: Fix heatmap current slot color (#48797) Read more: https://github.com/fleetdm/fleet/commits/main