🏗️ New commits pushed to Fleet: - noahtalerman: Settings > Integrations > Calendar events: Copy button missing border (#51578) - prateek-0490: Validate activities order_key against an allowlist - getvictor: Windows: Defer user-scoped profiles until an MDM user context exists (#51310) - prateek-0490: Extend outbound address filtering to unspecified and NAT64 addresses - lukeheath: Handbook: remove GitHub Actions repo exception from "Why do we use one repo?"... - eashaw: Website: Update MySQL service used by Fleet premium trial instances (#51742) - allenhouchins: Add Reed College case study (#51709) - fleet-release: Update Fleet-maintained apps (#51753) - fleet-release: Update Fleet-maintained apps (#51755) - MagnusHJensen: Policy Automation resend config profile - GitOps (#51644) - fleet-release: Update Fleet-maintained apps (#51763) - fleet-release: Update Fleet-maintained apps (#51768) - getvictor: Resolving Lucas's code review comments (#51740) - noahtalerman: Add "Compatibility" checkbox to the user story template (#51450) - RachelElysia: Fleet UI: Suppress empty TooltipWrapper renders (#51739) - sharon-fdm: Fix Windows reinstallation failure when MSI source is unavailable (#51674) - irenareedy: Update fleet-4.90.0.md (#51770) - getvictor: Allowing "Unassigned" to set default Windows fleet. (#51767) - hmacr: fix: Show descriptive message when script produces no std output (#50842) - juan-fdz-hawa: Fixed linter issues on santa_log (#51788) - lukeheath: Add fleetdm/security repo to handbook's "Why this way?" repo list (#51405) - MagnusHJensen: remove rosetta call-out from contributor docs (#51716) - fleet-release: Update Fleet-maintained apps (#51798) - allenhouchins: Update Firefox for Windows FMA (#51799) - sharon-fdm: Fix SCIM user not remapped when PUT device_mapping email unchanged (#51795) - ksykulev: Website: More android datadog usage statistics (#51396) - spalmesano0: Add redirect for configuration profiles guide (#51553) - Dhvanit41: Let Save activate when adding a package in GitOps mode (#51443) - lukeheath: Fix high Trivy code scanning alerts: bump x/mod, x/net, x/image, x/sys across... - getvictor: Updated docs for Windows user-scoped profiles (#51332) - fleet-release: Update Fleet-maintained apps (#51841) - raju249: Per-platform disk encryption: fan-out migration (#51258, 1/7) (#51701) - Dhvanit41: Apply iOS and iPadOS update settings when GitOps creates a fleet (#51847) - spalmesano0: Add sysdiagnose info to troubleshooting guide (#51734) - raju249: Per-platform disk encryption: settings model (#51258, 2/5) (#51777) - dependabot[bot]: Bump github.com/gorilla/websocket from 1.5.1 to 1.5.3 in /cmd/fleet-mcp (#51829) - fleet-release: Update Fleet-maintained apps (#51860) - raju249: Per-platform disk encryption: platform-specific reads (#51258, 3/5) (#51846) - noahtalerman: New bookmark: #g-byod (#51790) - RachelElysia: Docs: Document has_uninstall_script on host and device software responses (#5... - RachelElysia: Fleet UI: Show success toast after saving Deploy modal changes (#51818) - allenhouchins: Consolidate dogfood-gitops secrets into a JSON bundle (#51864) - fleet-release: Update Fleet-maintained apps (#51862) - lukeheath: Handbook: use AI to help you communicate, not to communicate for you (#51863) - Nameless-Monster-Nerd: Fleet UI: Prevent transient Self-service empty state (#50161) - rfoo2015: Update README.md (#51664) - allenhouchins: Update Evernote macOS to 11.31.5 (#51866) - lukeheath: Remove jq from fleet Docker image (#51870) - MagnusHJensen: remove 8 unused frontend deps (#51859) - kevinmcox: Make software title details versions table sortable by version - JordanMontgomery: Fix duplicate device mapping (#51697) - melpike: Surface macOS bootstrap token escrow status via API (#51159) - MagnusHJensen: collapse name field into top level key for profile policy automation (#51854)

- allenhouchins: Fix Signal FMA install context and uninstall path resolution (#51874) - prateek-0490: Use case-sensitive collation for token columns - AndreyKizimenko: Add checklist item for fleet creation in story template (#51885) - spalmesano0: Add article on how we use GitHub (#51574) - allenhouchins: Fix IntelliJ IDEA Windows FMA, rename it from Ultimate, and remove the CE FMA... - allenhouchins: Repoint the IntelliJ IDEA CE software catalog redirect at IntelliJ IDEA (#51888) - AndreyKizimenko: Update API verification checklist in story template (#51897) - ksykulev: List and view results of custom Android commands (#51498) - MagnusHJensen: update wipe modal with extra copy (#51895) - lucasmrod: Remove

withRetryTxx

on

host_sofware_installed_paths

inserts/deletions (#5... - MagnusHJensen: update metrics tool and submit mock apns loadtest metrics (#51778) - MagnusHJensen: rework mock apns with redis approach (#51703) - RachelElysia: Fleet UI: Fix blank actor on failed VPP install activities (#51662) - rynsatterlee: Update name and handle for Ryn in CODEOWNERS and articles (#51899) - spalmesano0: Add GitLab info to custom variables guide (#51912) - spalmesano0: Clarify that two apps are needed for Fleet users vs end users (#51834) - AdamBaali: Document host deletion and host expiry behavior (#51855) - allenhouchins: Switch ImageGlass Windows FMA to MSIX (#51924) - kilo-code-bot[bot]: Handbook: route Google Workspace API app access requests to IT (#51921) - MagnusHJensen: make osquery-perf report software update device id (#51858) - raju249: Per-platform disk encryption: write semantics and POST /disk_encryption (#512... - raju249: Per-platform disk encryption: edited_disk_encryption_settings activity (#5125... - MagnusHJensen: fix db schema (#51934) - juan-fdz-hawa: Repair duplicate software entries in a migration instead of a cron - kilo-code-bot[bot]: Restore Customer Support Engineer open position (remove APAC restriction) (#5... - MagnusHJensen: remove mention of osquery for verifying DDM profiles (#51932) - juan-fdz-hawa: Add single sign-on (SSO) in front of Fleet Desktop's My device page - JordanMontgomery: Improve Apple deviceinfo parsing (#51812) - noahtalerman: Adam Bali is interim CODEOWNER for

docs/solutions/

(#51792) - raju249: Accept per-platform disk encryption settings on PATCH /fleets/{id} (#51942) - AdamBaali: Guides: add forcing a standard user account to Windows MDM setup (#51351) - fleet-release: Update Fleet-maintained apps (#51936) - allenhouchins: Add Harmony SASE (Perimeter 81) as a macOS Fleet-maintained app (#51733) - bigaapl: Add Controller role and contact information (#51952) - kilo-code-bot[bot]: Add Zentral MDM detection (#50366) - fleet-release: Update Fleet-maintained apps (#51949) - allenhouchins: Fix Android Studio Windows FMA uninstall: unquote the NSIS _?= path (#51950) - andymFleet: 50336 apple business stale fleet names (#51241) - allenhouchins: Fix Granola per-user install context; document five apps that could not be va... - MagnusHJensen: fix racy coordinator test (#51935) - lucasmrod: fleetd WebSocket transport (#51427) - AndreyKizimenko: Modify release QA template for supply chain focus (#51971) - MagnusHJensen: only show error detail for failed DDM (#51933) - getvictor: Clarified docs regarding escrowing disk encryption keys for Windows/Linux (#5... - georgekarrv: Add release budget for policy-automation installs and scripts (#51824) - eashaw: Add CODEOWNER for website database models (#51941) - dantecatalfamo: Add QR code for the enrollment link on the Add hosts modal (#51887) - eashaw: Website: add configuration profile generator (#51999) - fleet-release: Update Fleet-maintained apps (#52001) - mikermcneil: Website: Fix bad error message in build script (#51715) - MagnusHJensen: remove custom plist bounds for Apple enrollment (#51939) - MagnusHJensen: 51261 per platform disk encryption GitOps (#51953)

- tianrking: Recover vulnerability counts after interrupted table swaps - lucasmrod: Remove unnecessary computation in server debug handler and fixes to agentws v... - nulmete: Resend Android managed app config on custom host vital value change (#51960) - lucasmrod: Fix race and CI failures (#52015) - jbelbo: Support SVG org logos in generate-gitops (#51973) - raju249: Make the FileVault profile payloads follow the two macOS settings (#52004) - fleet-release: Update Fleet-maintained apps (#52011) - juan-fdz-hawa: Fix software rows saved without a software title errors - allenhouchins: Fix per-user install context for 32 Windows Fleet-maintained apps (#51940) - allenhouchins: Add 8 Windows FMAs (#51809) - RachelElysia: Software: Search matches bundle identifier and custom display name (#51722) - jkatz01: Cap failed install attempts with redis keys (#51746) - JordanMontgomery: 51262: custom filevault/encryption UI (#51938) - getvictor: Windows: Retry configuration profiles (#51673) - fleet-release: Update Fleet-maintained apps (#52033) - allenhouchins: Create nar-ai-forandrar-jobbet-vem-ligger-steget-fore.md (#52029) - allenhouchins: Fix Firefox Dev Edition/ESR/stable FMA Default Browser Agent error on Windows... - JordanMontgomery: 51260 Derive disk encryption status from per-platform flags (#51981) - bigbgh: Update enroll-hosts.md (#52009) - fleet-release: Update Fleet-maintained apps (#52052) - juan-fdz-hawa: Use canonical EPSS feed URL (epss.empiricalsecurity.com) - RachelElysia: GitOps: pick a package inside a multi-package YAML with hash_sha256 (#51946) - noahtalerman: Clarify 'Product design kickoff' task description (#52074) - juan-fdz-hawa: Make software title details versions table sortable by version - rachaelshaw: Product design rituals: Stop creating issues on drafting board (#52060) - noahtalerman: UI redirect: Zero-touch enrollment for company-owned Android (#51969) - sharon-fdm: Set SkipUserStatusPage=true in ESP release commands (#51816) - RachelElysia: Docs: document software_installer_id on fleet-level policy endpoints (#52058) - nulmete: Serve Fleet-maintained app icons as static files (#51980) - jp-cpe: Update api_endpoints.yml (#51608) - mike-j-thomas: Center homepage hero on tablet/mobile breakpoints (#52082) - AndreyKizimenko: Add 4.90.0 baseline and 4.89→4.90 / 4.90→4.91 migration loadtest results (#52... - MagnusHJensen: APNS ping backend (#52018) - MagnusHJensen: fix racy mock apns tests (#52050) - MagnusHJensen: APNS Ping frontend (#52036) - RachelElysia: GitOps: pin policy to the exact installer resolved from the YAML (#52002) - RachelElysia: Fleet UI: Add spacing to Munki issues section on host details (#52092) - jkatz01: Use DB flags to determine if FMA scripts were edited by admins (#52057) - sharon-fdm: Fix osquery/orbit config 500 when host references deleted team (#51943) - noahtalerman: Update MDM setup instructions with automation details (#52095) - mrala: Fix typo in README.md (#52097) - getvictor: Windows managed local account rename (#52079) - fleet-release: Update Fleet-maintained apps (#52088) - claude[bot]: Document content-planning label process in handbook (#52099) - fleet-release: Update Fleet-maintained apps (#52100) - prateek-0490: Require a team selection when validating report run targets - noahtalerman: Use MDM on/off language in Controls card empty state (#52110) Read more: https://github.com/fleetdm/fleet/commits/main