🏗️ New commits pushed to Fleet: - prateek-0490: Escape values interpolated into the conditional access Apple profile - juan-fdz-hawa: Integration tests breakdown: Extract integration_core_hosts_reports_test - swharr: Fix grammar in CEO travel packing instructions (#52112) - prateek-0490: Validate software list order keys against an allowlist - getvictor: renaming

windows_enrollment

to

windows_automatic_enrollment

(#52098) - prateek-0490: Batch scheduled query name lookups when processing result logs - lucasmrod: Support host deletion scenario (hub should disconnect such host) (#52049) - dantecatalfamo: Keep SCEP enrollment secrets out of the Android device logs (#51914) - claude[bot]: Comment out Product Designer open role on website (#52124) - MagnusHJensen: Remove non-existing "Update recovery lock" link (#52091) - juan-fdz-hawa: Deprovision SCIM-deactivated users via a durable Fleet-user link - mason-buettner: Update instructions for managing software categories (#52130) - allenhouchins: Website: add Newsletters and Industry news article categories (#52120) - ArendPeter: [Docs] Fix "Boring Solutions" hyperlink on company page (#52006) - fleet-release: Update Fleet-maintained apps (#52137) - russellhancox: Update Santa icon for macOS FMA (#52115) - fleet-release: Update Fleet-maintained apps (#52153) - vaibhav8a: docs: fix typo reccommend -> recommend (#52146) - fleet-release: Update Fleet-maintained apps (#52166) - noahtalerman: Add tooltip clarifying token rotation still happens with SSO - juan-fdz-hawa: Integration tests breakdown: Extract integration_core_hosts_test - rfairburn: Osquery config etags (#50288) - jbelbo: Update Windows profile name on edit (#52055) - jkatz01: Update FMA scripts in auto-update job when they change in manifest without a ... - jkatz01: Use hardcoded string for skipped install details (#52135) - juan-fdz-hawa: Integration tests breakdown: Extract the remaining integration_core tests - allenhouchins: Match only the app's own executable in macOS FMA open queries (#52133) - dantecatalfamo: Keep Enrollment ID on the host page after a BYOD host unenrolls (#51791) - nulmete: Load each page's code when its route is entered (#52038) - fleet-release: Update Fleet-maintained apps (#52180) - lukeheath: Bump echo to v4.15.3 in goval-dictionary (CVE-2026-55677) (#51996) - sharon-fdm: Add server and agent compatibility policy to handbook (#51652) - lucasmrod: Upgrade upload/download-artifact actions due to node 20 removal in Sep 23rd (... - allenhouchins: Unfreeze Pritunl (darwin) (#52162) - nulmete: Add useFormValidation hook and migrate the user forms onto it (#50435) - cdcme: Defer policy membership wipe (#52188) - kitzy: Add guide: set up Fleet GitOps for staging and production (#51501) - lucasmrod: Update actions/checkout to v7.0.1 and remove some unnecessary full checkout (... - JordanMontgomery: Fix iOS/iPadOS refetch stuck bug (#51736) - allenhouchins: Add Microsoft Defender (macOS) as a Fleet-maintained app via custom tap (#52195) - dantecatalfamo: POC: Zero-touch enrollment for company-owned Android (research doc) (#50321) - jkatz01: Add more details to oncall prs script (#52182) - AndreyKizimenko: Hangar: crash diagnostics logging, Wails beta.8 upgrade, build versioning (#5... - Dhvanit41: Hide the toast details panel when the payload is empty (#51338) - MagnusHJensen: fix all go lints (#52203) - allenhouchins: Add Vagrant as a Windows Fleet-maintained app (#52200) - RachelElysia: Fleet UI: Put unsupported-extension error reason in the toast raw-response pa... - fleet-release: Update Fleet-maintained apps (#52206) - georgekarrv: gm jarvis: issue-centric workflow, Project View, and caching (#49172) - nulmete: Default osquery config etag flags to off (#52211) - spalmesano0: Update command UUID note (#51473) - dantecatalfamo: Store and return additional Android host vitals (#52039) - fleet-release: Update Fleet-maintained apps (#52216)

- lukeheath: Remove temporary trivy-close-legacy workflow (#52202) - claude[bot]: Add why-this-way entry: route taskings through team's manager (#52010) - noahtalerman: Document actual policy check/automation cadence (#52183) - nulmete: Add

osquery.config_in_memory_cache

flag, off by default (#52209) - MagnusHJensen: another attempt to fix flakiness in mock APNS (#52181) - raju249: Show manual BYOD re-enroll instructions for manual BYOD hosts (#52167) - JordanMontgomery: Fix MDM command activity creation (#52219) - nulmete: Load react-select's base styles from the app entry (#52243) - JordanMontgomery: Implement PSSO user registration for non-setup, no prior setup flows (#52096) - fleet-release: Update Fleet-maintained apps (#52256) - nulmete: Give dev's shared webpack chunks fixed names (#52257) - lucasmrod: Update actions/checkout to v7.0.1 in website, docs, and vulnerability dashboa... - rajendrachavan: Write a query and its labels in a single transaction (#51845) - lucasmrod: Add VEX exclusions for SSH server vuln in fleetdm/fleet (#52251) - lukeheath: Bump x/crypto to v0.55.0 in goval-dictionary (CVE-2026-56854) (#52230) - lucasmrod: Prevent run of orbit codesign in forks PRs and pushes to forks (#52264) - cdcme: Add pull request etiquette guidance (#51247) - jbelbo: Retry MySQL 1615 during migrations (#52067) - JordanMontgomery: Add sort indicators to controls list (#52266) - RachelElysia: Patch policies: Hide skipped install from global feed, factor policy refresh ... - kilo-code-bot[bot]: Add CS responsibility for responding to logo removal requests (#52286) - kc9wwh: New fleetd table apfs_crypto_users (#50763) - allenhouchins: Update link to example santa.yml file in documentation (#52309) - fleet-release: Update Fleet-maintained apps (#52284) - allenhouchins: Bump Evernote macOS FMA version to 11.32.5 (#52267) - MagnusHJensen: remove in house app and VPP backdating and only fire APNS ping after committe... - juan-fdz-hawa: Scope the software checksum dedupe migration to giflib - dantecatalfamo: Store and return Android IMEI and MEID host vitals (#52304) - fleet-release: Update Fleet-maintained apps (#52316) - getvictor: Restore BitLocker protection (#51852) - kilo-code-bot[bot]: Add why-this-way entry: avoid daylight-saving-specific time zone abbreviation... - RachelElysia: Fleet UI: Auto-highlight first result in command palette pickers (#52293) - kitzy: Improve custom osquery extensions step-by-step guide (#52248) - lukeheath: Handbook: clarify #help-releases threads are only for release date discussion... - lukeheath: Handbook: fix grammar in release date discussion guidance (#52325) - codrmonkey: Fix typo in 83(b) election filing instructions (#52283) - georgekarrv: Adding changes for Fleet v4.90.2 (#51983) - dependabot[bot]: Bump browserslist from 4.28.1 to 4.28.8 (#52328) - dependabot[bot]: Bump postcss-selector-parser from 7.1.1 to 7.1.5 (#52329) - fleet-release: Update Fleet-maintained apps (#52340) - mike-j-thomas: Update macs-excluded-from-external-storage-restrictions.yml (#52341) - MagnusHJensen: add ACME support for iPhones and iPads (#52250) - github-actions[bot]: Update Go to 1.26.8 [automated] (#52345) - raju249: Add enabled index to nano_enrollments for the APNs sweep (#52353) - lukeheath: Use base filename when saving Orbit signed-URL installer downloads (#52121) - noahtalerman: Show

fleetctl generate-gitops

in

fleetctl --help

output (#51819) - juan-fdz-hawa: Allow Technician role to clear iOS/iPadOS passcodes - lucasmrod: Fix flaky TestIntegrationsUpdatesExpiredSignatures test (#52359) - raju249: Swap buford for nanopush, send APNs pushes with expiration, push type, and to... - nulmete: Differentiate users restricted to specific API endpoints in the users table (... - nulmete: Add disk_encryption_enabled to List hosts response (#52300) - MagnusHJensen: [Handbook]: add section about the reviewer always needs to test any community...

- dependabot[bot]: Bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#52352) - sharon-fdm: Add MDM profile counts to usage statistics (#52268) - MagnusHJensen: Rework recovery lock flow to always verify recovery lock password (#52176) - lucasmrod: Add VEX exclusion for ssh CVE (#52355) - lucasmrod: Add VEX exclusion for gRPC CVE (#52354) - getvictor: Add serial and host id to Win MDM enroll activity (#52235) - fleet-release: Update Fleet-maintained apps (#52366) - allenhouchins: Bump Druva inSync FMA (custom-tap) to 8.1.4,110973 (#52376) - surajtripathy07: Include the failing script's filename in fleetctl gitops script errors (#52169) - MagnusHJensen: incremental lint to micromdm/plist (#52358) - RachelElysia: Policy automation: Show pre-install query failure copy in Details modal and D... - Flawkee: Fix: MacOS Software Package version resolve logic - dependabot[bot]: Bump qs from 6.15.2 to 6.16.0 in /tools/fleet-slackbot (#52377) - noahtalerman: Confirm & celebrate: Move stories instead of original request (#52291) - dependabot[bot]: Bump github.com/apache/thrift from 0.23.0 to 0.24.0 (#52373) - thisisjoegrant: add Windows 10 support to manual enrollment tests (#51877) - thisisjoegrant: Add _fleetadmin to enrollment tests (#52276) - jkatz01: Migration partial apply test (#52207) - dependabot[bot]: Bump fast-uri from 3.1.5 to 3.1.7 (#52390) - dependabot[bot]: Bump fast-uri from 3.1.5 to 3.1.7 in /tools/fleet-slackbot (#52389) - lukeheath: Fix github-manage bug reporting (#52415) - sharon-fdm: Update Windows 10 CIS benchmark policies to v5.0.0 (#52282) - eashaw: Fleet agent downloader: Update app to use auth0 SSO (#49927) - karmine05: Detect custom and framework-based AI agents in ai_tools - noahtalerman: Product groups handbook: Remove goal descriptions to deduplicate (#52421) - getvictor: Frontend tweaks for Microsoft Graph (#52372) - fleet-release: Update Fleet-maintained apps (#52424) - allenhouchins: Unfreeze NVIDIA GeForce NOW (darwin) (#52406) - jp-cpe: Add guide: trigger AppleCare log collection with a custom MDM command (#51108) - claude[bot]: Add note on customer success/support role coverage to time off handbook (#52426) - georgekarrv: Rescale t-shirt sizes for 3-week release cycles (#52403) - getvictor: Update to Go 1.27.1 (#52413) - noahtalerman: Release article: Fleet 4.91.0 (#51944) - lukeheath: Adding changes for Fleet v4.91.0 (#52433) - rachaelshaw: Preview of v4.91.0 doc changes (#49251) - getvictor: Don't display refetch error for pending hosts (#52384) - fleet-release: Update Fleet-maintained apps (#52447) - allenhouchins: Enable FLEET_MDM_ALLOW_CUSTOM_ACTIVATIONS on dogfood (#52452) - allenhouchins: Add article: What Chrome 152's two critical flaws mean for confirming browser... - Sampfluger88: Add "Record Solutions Specialist-attributed meetings delivered" (#52448) - allenhouchins: Add article: What the JFrog Artifactory token exploit means for tracking self... - allenhouchins: Update chrome-152-critical-flaws-confirming-patch-coverage.md (#52457) - surajtripathy07: Include the failing profile's name in fleetctl gitops custom settings errors ... - MagnusHJensen: OAB: add only allow ab enrollments fields e2e (#52260) - MagnusHJensen: [Docs]: add blocking personal apple accounts on MDM enrolled devices research... - raju249: Reset the modal closing state after an animated close (#52249) - lucasmrod: Update instructions for self-hosted Okta conditional access (#52391) Read more: https://github.com/fleetdm/fleet/commits/main