🏗️ New commits pushed to Fleet: - nulmete: Register Ace's theme and modes from every editor (#52441) - RachelElysia: Fleet UI: Add hover state and pointer cursor to side nav items (#52278) - RachelElysia: Fleet UI: Wire raw-response panel on two more error toasts (#52205) - RachelElysia: Fleet UI: Skipped-install cadence link + surface real failure on My device (#... - juan-fdz-hawa: Decode vulnerability feeds with encoding/json/v2 - sharon-fdm: Fix ChromeOS system_info queries failing when hardware platform API is disabl... - juan-fdz-hawa: Fix slow host software list query - allenhouchins: Add Campus case study (#51797) - kilo-code-bot[bot]: Add guidance on prefixing externally shared Google Docs (#52417) - juan-fdz-hawa: Fix SCIM group PATCH silently deleting members - allenhouchins: Website: Add Abridge case study (#52482) - github-actions[bot]: Update versions of fleetd components in Fleet's TUF [automated] (#52491) - lucasmrod: Release notes for fleetd v1.60.0 (#52490) - fleet-release: Update Fleet-maintained apps (#52489) - sharon-fdm: Revert: Disable WSTEP ROBO certificate renewal (#51468) (#52495) - georgekarrv: Handbook: Incident on-call initial triage expectations (#52438) - kitzy: Add guide for custom BitLocker/FileVault disk encryption profiles (#52139) - juan-fdz-hawa: Harden host MDM command authorization - fleet-release: Update Fleet-maintained apps (#52498) - allenhouchins: Remove promotional content from Chrome 152 article (#52502) - allenhouchins: Remove promotional content from JFrog Artifactory article (#52503) - ksykulev: Exponential backoff for android certificate retries (#52308) - lucasmrod: Create workflow to create fleetd release QA ticket when fleetd RC is cut (#52... - kitzy: Add Microsoft OLE DB Driver 19 for SQL Server as a Windows Fleet-maintained a... - kitzy: Add Raspberry Pi Imager as a Fleet-maintained app (#52412) - georgekarrv: Add handbook guidance for mid-cycle stories and customer issue escalation (#5... - allenhouchins: Add Vim as a Windows Fleet-maintained app (#52194) - noahtalerman: Disk encryption settings show disabled controls with a tooltip instead of an ... - fleet-release: Update Fleet-maintained apps (#52546) - raju249: Add the daily APNs sweep cron and the legacy pusher rollback lever (#52356) - raju249: Hide the My device link on platforms that have no My device page (#52245) - kitzy: Add guide for host name templates, link from API rename guide (#52138) - eashaw: Website: add arch linux management page (#52526) - MagnusHJensen: additional attempts at apns-mock racy/ci stress flakes (#52381) - mike-j-thomas: Link Arch Linux and Omarchy to arch-linux-management page (#52554) - spalmesano0: Show the primary user email on the Hosts page when multiple are present (#48869) - spalmesano0: Add a missing period to the live report tooltip (#52525) - spalmesano0: Update articles for positive language changes (see #47603) (#51545) - spalmesano0: Add note on how to fix stuck user-channel config profiles (#51552) - spalmesano0: Add step to confirm a local user account is created (#51898) - juan-fdz-hawa: Replace node-sql-parser with a vendored osquery SQL parser - juan-fdz-hawa: Explain "Never" in the Hosts list "Last fetched" column - juan-fdz-hawa: Show the default sort indicator on Hosts column (#52563) - juan-fdz-hawa: Fix policy description and resolution newlines being collapsed - melpike: [Route] Add route for device attestation guide (#52573) - spalmesano0: Fix hanging period in Android refetch tooltip (#52574) - Leanngove: Adding Android encryption status doc to routes.js (#50634) - surajtripathy07: Add software custom targets warning to delete label modal (#50943) - juan-fdz-hawa: Fix macOS CIS 5.3.1, 5.1.7 false-fails and 2.7.1 test scripts - kevgliss: Limit expired host cleanup per run (#46702) - dantecatalfamo: Report Android host vitals from the osquery-perf load-test agent (#52323)

- getvictor: Fixing Microsoft Graph unreleased security concerns. (#52579) - godlike64: fix: Typo in High-level workflow section (#52575) - nulmete: Add third-party integration usage statistics (#52562) - MagnusHJensen: OAB: Block manual endpoints + SCEP when both configured (#52552) - nulmete: Show tooltip for truncated labels in hosts filter dropdown (#52592) - kc9wwh: Update yaml-files.md with DDM payload scope details (#52521) - hslatman: Add

populate_end_users

option to List Hosts API endpoint (#52258) - noahtalerman: Clarify when policy counts reset (#52514) - getvictor: Fixed JSON error regression due to Go 1.27 (#52439) - eashaw: Website: update labels on search bars on docs and article pages (#52598) - nulmete: Fix misaligned status icon in policy results table (#52599) - georgekarrv: Push the release due date when unreleased bugs remain in the release candidat... - dantecatalfamo: Return 404 for Android commands when AMAPI has no such device (#52548) - dantecatalfamo: Display the new Android host vitals (#52393) - getvictor: Improved API error messages due to JSON issues. (#52581) - cdcme: Fix software install status timeouts (#52289) - mikermcneil: Handbook: Update why-this-way.md (#52398) - RachelElysia: FE: Update CSS from margins > gaps (#45986) - Dhvanit41: Clear stale failure detail when an Android profile becomes verified (#50774) - eashaw: Website: remove duplicate route (#52624) - SFriendLee: Took out the word "fast" in "No one is coming" paragraph (#52615) - getvictor: Docs: clarify that SCIM deprovisioning deletes the Fleet user (#52602) - jakestenger: Add VPN DDM deployment guide (#50587) - claude[bot]: Bump Linux Zoom to 7.1.5.4332 and Slack to 4.52.155 in Workstations gitops co... - fleet-release: Update Fleet-maintained apps (#52641) - mikermcneil: Website: Update ai-in-it.ejs (#52643) - allenhouchins: Unfreeze Fire Alpaca (darwin) (#52644) - raju249: Add in-process retry of transient APNs push failures (#52362) - noahtalerman: Document app configuration behavior (#51917) - marko-lisica: Fix formatting in EnableFirewall policy examples (#51425) - Dhvanit41: Build the in-house app manifest URL from the Apple server URL (#52156) - MagnusHJensen: OAB: Update settings and add activity template (#52570) - MagnusHJensen: APNS push when call directly and not via transaction for VPP and IPA activate... - spalmesano0: Use human-friendly language in

fleetctl new

usage text (#51544) - lucasmrod: Cache graph tokens and endpoint URLs per tenant (#52214) - nulmete: Truncate long host location with a tooltip (#52604) - nulmete: Fix custom host vital height on host details (#52588) - MagnusHJensen: OAB: Update host/device details banners, block add hosts modal (#52656) - MagnusHJensen: disable resize on both text areas in MDM Command details modal (#52668) - rajendrachavan: Use a longer HTTP timeout for fleet-mcp single-host live queries (#52048) - eashaw: Website: update mobile logo grid on arch linux management page (#52669) - lucasmrod: Docs: Minor fix to batch script host_results (#52659) - noahtalerman: Clarify Require IdP authentication is per-fleet for manual enrollment links (... - noahtalerman: API docs: Move "Run live report" endpoints and add warning (#52024) - noahtalerman: Document Android and iOS/iPadOS vulnerability coverage (#52208) - noahtalerman: Custom host vitals guide: Link to specific endpoint (#51532) - noahtalerman: macOS MDM migration: Export FileVault keys to a spreadsheet (#51363) - noahtalerman: Guide: Remove outdated image (#51278) - noahtalerman: Configuration profiles: Clarify "PayloadScope" for user-channel DDM profiles ... - noahtalerman: We say "configuration profiles" now (#51594) - noahtalerman: Custom variables guides update (#51596) - noahtalerman: Rename/repurpose the "🦢 Drafting" board => "🦢📨🎉 Product design intake & o... - nonpunctual: Enhance system_profiler.yml with new SQL example query (#52192)

- mason-buettner: Update categories section in yaml-files.md (#52290) - noahtalerman: Document how iOS/iPadOS self-service authentication works (#52302) - noahtalerman: Controls > OS settings > Configuration profiles: Copy change (#52673) - lucasmrod: Add ddribeiro for consulting docs approval (#52680) - dantecatalfamo: Document the Android-only host vitals in the REST API reference (#52603) - allenhouchins: Add allenhouchins as maintainer for pkg/patch_policy (#52640) - allenhouchins: Unfreeze Binance (macOS) (#52670) - allenhouchins: Unfreeze DBeaver Enterprise (macOS) (#52671) - noahtalerman: Managed bookmark: "🦢 Drafting" board => "🦢📨🎉 Product design intake & outt... - fleet-release: Update Fleet-maintained apps (#52650) - raju249: Fix gitops wiping all VPP and ABM token assignments when config references a ... - juan-fdz-hawa: Align authorization handling across host MDM endpoints - lucasmrod: Fix windows_updates crash on Windows ARM64 by bumping go-ole (#52661) - cdcme: Add patch policy and software automation usage statistics (#50766) - nulmete: Fix unsaved changes prompt on SSO settings when the form is back to its origi... - amasen02: fix(mdm): prevent windows client certificate lifetime truncation (#52601) (#5... - lucasmrod: Use environment variables on fleetd MSI installer (#52475) - MrNRod: Fix typo in meeting deletion instructions (#52707) - surajtripathy07: Flag setup experience software installs as Fleet-initiated (#52460) - allenhouchins: Migrate Audacity Windows FMA to the 4.0 WiX MSI installer (#52638) - MagnusHJensen: unblock app.managed configuration (#52662) - MagnusHJensen: update mdm assets tool with decrypt (#52695) - eashaw: Website: update configuration generator. (#52726) - claude[bot]: Update IT handbook rituals: remove eval-instance review, relabel release-cycl... - kitzy: Fix phantom Fleet Desktop update for Raspberry Pi Imager (#52648) - github-actions[bot]: Update versions of fleetd components in Fleet's TUF [automated] (#52736) - dantecatalfamo: Show Android certificates as retrying in host OS settings (#51036) - prateek-0490: Keep the BYOD IdP authentication result in a server-side session (#52365) - lukeheath: Nonce runtime-injected styles/scripts so the UI works using CSP (#52337) - melpike: Update custom OS settings documentation (#52745) - fleet-release: Update Fleet-maintained apps (#52739) - getvictor: Script to restore BitLocker protection. (#51712) - lucasmrod: Add AI assistance disclosure line to the PR template (#52561) - allenhouchins: Teleport Suite FMA: remove auto-updater client-tools cache so patch policy ca... - MagnusHJensen: fix osquery schema docs and update workflow (#52696) - noahtalerman: Install updates when apps are closed (#51789) - lukeheath: Regenerate merged osquery schema after system_profiler example update (#52741) - allenhouchins: Remove trailing horizontal rule and CTA line from article drafts (#52712) - allenhouchins: Add JetBrains dotTrace as a Windows Fleet-maintained app (#52692) - allenhouchins: Consolidate the IntelliJ IDEA open-query overrides (drop CE, rename Ultimate)... - JordanMontgomery: Rework nano enrollments seen times (#52310) - allenhouchins: Unfreeze DBeaver Lite (macOS) (#52753) - allenhouchins: Unfreeze DBeaver Ultimate (macOS) (#52754) - fleet-release: Update Fleet-maintained apps (#52755) - allenhouchins: Add Claude Desktop for Debian-based Linux to Workstations (script-only packag... - allenhouchins: Exclude staged Webex upgrade bundles from macOS patch policy (#52636) - claude[bot]: Document FMA issue labeling in engineering handbook (#52725) - ksykulev: Android Custom Commands: Removing sensitive fields from raw_result (#52621) Read more: https://github.com/fleetdm/fleet/commits/main