🏗️ New commits pushed to Fleet: - getvictor: Bump radio identifiers migration to run after the cherry-picked BitLocker one... - lukeheath: Bump sails-hook-grunt to 5.0.2 in website and fleet-agent-downloader (#52423) - ddribeiro: Fix JSON formatting in REST API documentation (#52770) - allenhouchins: Add Druva inSync (GovCloud) as a macOS Fleet-maintained app (#52710) - cdcme: Remove iOS and iPadOS certificate authentication (#52744) - allenhouchins: Add September 2026 newsletter (#52116) - allenhouchins: Update article title in September 2026 newsletter (#52790) - allenhouchins: Fix link formatting in newsletter-2026-09.md (#52791) - allenhouchins: Change workshop request link in newsletter (#52792) - noahtalerman: `fleetctl mdm run-command`: All Apple platforms are supported (#52781) - fleet-release: Update Fleet-maintained apps (#52784) - allenhouchins: Fix i1Profiler patch policy comparing a marketing bundle_short_version (#52164) - eashaw: Website: Update website name in Google search results (#52801) - allenhouchins: Add Tableau Prep Builder as a Windows Fleet-maintained app (#52653) - kilo-code-bot[bot]: Add Brad Girardeau (Figma) testimonial (#52649) - raju249: Validate setup assistant with any usable ABM token and warn when it won't tak... - dependabot[bot]: Bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#52807) - MagnusHJensen: OAB: Certificate renewal (#52566) - JordanMontgomery: Fix enrollment endpoint errors (#52611) - lucasmrod: VEX fleetctl for CVE-2026-84445 (#52823) - RachelElysia: Fleet UI: Truncate long report names on Host details > Reports card (#52789) - nulmete: Fix doubled "about" in report "Collecting results..." empty state (#52834) - rajendrachavan: Validate script_id when applying policy specs (#52771) - getvictor: Fix edge case where recovery password is missing when restoring Bitlocker pro... - fleet-release: Update Fleet-maintained apps (#52824) - allenhouchins: Add article: What 13 new FFmpeg vulnerabilities mean for tracking a media lib... - lucasmrod: Fix Quay cleanup in docker cleanup workflow (#52826) - prateek-0490: Keep enrollment error detail on the server log line (#52348) - surajtripathy07: Apply min_cvss_score together with max_cvss_score when listing software versions - melpike: Enhance managed local account documentation (#51986) - dependabot[bot]: Bump js-yaml from 4.3.1 to 4.3.2 (#52819) - dependabot[bot]: Bump joi from 17.13.3 to 17.13.7 (#52822) - dependabot[bot]: Bump js-yaml from 4.3.1 to 4.3.2 in /tools/fleet-slackbot (#52820) - dependabot[bot]: Bump hono from 4.13.0 to 4.13.7 in /tools/fleet-slackbot (#52821) - getvictor: Bump the Win MDM cert skew to 1-day (#52709) - RachelElysia: Fleet UI: Show Install/Uninstall for script-only packages with an uninstall s... - RachelElysia: Fleet UI: Fix white page flash and redirect loop on logout (#52786) - getvictor: Warn when a Windows host enrolls in MDM with a hardware ID held by another ho... - lucasmrod: Fix GitOps for Fleet deployments that do not have server private key (#52829) - nulmete: Patch cached host team on transfer instead of invalidating (#52371) - melpike: Update managed account password retrieval documentation (#52608) - sharon-fdm: Fix evented table icon color in dark mode (#52851) - jamessorrenti: Update steps for connecting Fleet to AB (#51560) - lucasmrod: Allow

extensions_autoload

flag in

command_line_flags

(#52871) - fleet-release: Update Fleet-maintained apps (#52878) - allenhouchins: Update Evernote macOS maintained app to 11.33.5 (#52831) - allenhouchins: Bump Linux Claude Desktop patch policy to 1.49585.0 (#52830) - kilo-code-bot[bot]: Take down QA Engineer open position (#52887) - getvictor: Fixed GitOps mode blocking edits to a manual label's host membership (#52845) - fleet-release: Update Fleet-maintained apps (#52886) - noahtalerman: Add "Learn more" link to Assets tab on Configuration profiles page (#52728)

- juan-fdz-hawa: Fix "Could not transfer hosts" when transferring over 65,535 hosts - kilo-code-bot[bot]: Move Software nav item earlier, rename to Apps, add software-management link ... - kilo-code-bot[bot]: Show a single date per article in blog listview (#52693) - dependabot[bot]: Bump github.com/containerd/containerd from 1.7.33 to 1.7.35 (#52914) - juan-fdz-hawa: Stop serving a dead archived disk encryption key for Linux hosts - MagnusHJensen: GT: Migration, Datastore and structs (#52752) - RachelElysia: Fleet UI: Tooltip cleanups (default position, balance-cap workaround) (#52891) - rajendrachavan: Recognize all Fleet Linux distros in fleet-mcp platform checks (#52073) - fleet-release: Update Fleet-maintained apps (#52911) - allenhouchins: Replace ID 275 with 815 in exclusion list (#52934) - nulmete: Restore type-to-search in policy automation software/script pickers (#52931) - headmin: Fix perpetual "Update available" M365 Copilot macOS FMA (#51802) - nulmete: Fix caret position in searchable dropdowns (#52936) - allenhouchins: Add Monotype Fonts (macOS) Fleet-maintained app (#52764) - allenhouchins: Add JetBrains dotPeek as a Windows Fleet-maintained app (#52691) - allenhouchins: Add article: What Ubuntu's GnuPG authentication tag flaw means for trusting e... - getvictor: Fix BitLocker bugs (#52622) - juan-fdz-hawa: Quote Windows SCEP subject name values that need it - MagnusHJensen: GT: implement get token handler + new capability in profiles (#52917) - allenhouchins: Add article: AMD's Ryzen AI Halo chips created an endpoint category your inve... - allenhouchins: Fix RealVNC Connect Viewer homebrew ingestion after upstream cask rename (#52... - jbelbo: Rotate Windows managed local account password (#52683) - juan-fdz-hawa: Fix vulnerability exposure chart tooltip claiming a critical default - SebastianPintos: fix: Update README.md for typo (#52946) - fleet-release: Update Fleet-maintained apps (#52949) - getvictor: Added default 60s timeout to fleethttp client (refactoring) (#52760) - juan-fdz-hawa: Don't re-prompt for the LUKS passphrase when "Create key" is clicked twice - noahtalerman: Hardware model tooltip should appears below text w/ no arrow (#52750) - allenhouchins: Fix Tableau Desktop (Windows) FMA exists/patched/open queries (#52689) - allenhouchins: Microsoft Edge FMA: ignore and remove stale auto-updater bundles so patch pol... - fleet-release: Update Fleet-maintained apps (#52957) - claude[bot]: Set Workstations as default fleet for Windows Autopilot enrollment (#52965) - getvictor: Prevent linking host during Win MDM enrollment if MDMHardwareID matches anoth... - allenhouchins: Unfreeze RealVNC Connect Viewer (macOS) (#52968) - allenhouchins: Enable additional Fleet configurations in main.tf (#52974) - allenhouchins: Add AMD Ryzen AI Developer Platform as a supported Linux platform (#52635) - cdcme: Define script variables ahead of the script body (#52613) - nulmete: Fix "Hosts enrolled" chart drill-down including pending hosts (#52972) - melpike: Add hover tooltips to configuration profile action buttons (#52989) - noahtalerman: Edit enroll secret activity is used for add/delete...pluralize to make it les... - georgekarrv: Adding changes for Fleet v4.91.1 (#52861) - fleet-release: Update Fleet-maintained apps (#53003) - mikermcneil: Update ai-rewriting-the-job-description.md (#52999) - fleet-release: Update Fleet-maintained apps (#53007) - claude[bot]: Remove stale Warehouse fleet references from IT handbook (#52979) - fleet-release: Update Fleet-maintained apps (#53010) - MagnusHJensen: significantly update research around apple account restrictions (#52948) - jkatz01: Add timeout to maintained_apps_auto_update and cleanup_unused_software_instal... - MagnusHJensen: Allow clearing AAP form via the UI (#53016) - MagnusHJensen: show MDM is not turned on for config status modal (#52925) - cdcme: Scope name template custom variables (#52708)

- getvictor: Fleet doesn't support external startup keys (#52704) - lucasmrod: Route policy reset and automation_activities endpoints under /api/v1 (#52828) - juan-fdz-hawa: Report LUKS escrow progress so a dismissed prompt frees "Create key" - surajtripathy07: Reject host_expiry_window <= 0 in global config when host expiry is enabled (... - Dhvanit41: Fix 51929 mdm commands toggle persist (#52556) - fleet-release: Update Fleet-maintained apps (#53025) - fleet-release: Update Fleet-maintained apps (#53032) - kc9wwh: Update security notes on secret variables in Fleet (#52857) - allenhouchins: Add CrowdStrike, Smallstep, and DigiCert to the integrations page (#53011) - prateek-0490: Make API error response handling consistent across handlers - kc9wwh: Add netskope table to fleetd (#52201) - mike-j-thomas: Add /omarchy landing page (#53026) - noahtalerman: Built-in variables guide: Change order of variables (#51994) - noahtalerman: Fix guide heading styles (#52894) - noahtalerman: Configuration profiles guide: Use "profile" and never "declaration" on its ow... - kc9wwh: Regenerate fleet-mcp osquery schema copy to unblock check-automated-doc (#53048) - lucasmrod: Harden install-fleetctl.sh: version pinning, checksum verification, and a wor... - GrayW: Create fleetd_healthcheck_macos.sh (#53047) - fleet-release: Update Fleet-maintained apps (#53036) - allenhouchins: Bump Linux Claude Desktop patch policy to 1.52386.0 (#53037) - allenhouchins: Add fleet-case-study-formatting Claude Code skill (#49917) - lucasmrod: Fix fleetctl npm wrapper exiting 0 when the download or binary fails (#52956) - georgekarrv: Reorganize contributing docs by feature; EM-only docs codeowners (#52453) - allenhouchins: Add Oktane 2026 announcement (#52759) - cdcme: Honor outbound network settings for installer URL downloads (#52703) - karmine05: Add software inventory guide (#53057) - MagnusHJensen: Cleanup frontend test output (#53020) - juan-fdz-hawa: Move declarations to the proper place to fix linter. - georgekarrv: Add @rachaelshaw as explicit codeowner of Contributing reference docs (#53065) - fleet-release: Update Fleet-maintained apps (#53056) - getvictor: Serve API routes through a stdlib ServeMux fast path (#52927) - sharon-fdm: Document Windows multi-user limitation for user-scoped profiles (#53058) - sharon-fdm: Add Windows Autopilot for Beginners doc (#52714) - eashaw: Website: Test replacing docsearch on documentation and article pages (#53067) - noahtalerman: Usage stats guide: Add missing

numHostsABMPending

(#52898) - noahtalerman: Request certificate API: CAs "coming soon" isn't true (#52890) - MagnusHJensen: [Docs]: Fix wrong env variable in docs (#52915) - karmine05: Software inventory guide: per-category coverage tables and data depth (#53075) - allenhouchins: Bump Linux Claude Desktop patch policy to 1.52386.3 (#53094) - fleet-release: Update Fleet-maintained apps (#53099) - noahtalerman: Show "Last restarted" tooltip below the value & fix "Hardware model" missing ... - Dhvanit41: Reject Windows profiles with an empty name (#52916) - allenhouchins: Update Fleet release date and workshop details (#53109) - raju249: Use the default fleethttp client timeout for APNs pushes (#53019) - MagnusHJensen: use 60s default timeout on DEP client (#53040) - lucasmrod: Install fleetctl with install-fleetctl.sh instead of npm in GitOps CI and wor... - raju249: Fix flaky stalled-body APNs push test (#53115) - juan-fdz-hawa: Propagate SCIM userName email changes to the host IdP device mapping - juan-fdz-hawa: Cap GET /software/versions page size when unpaginated - MagnusHJensen: Auto sort frontend import order (#53021) Read more: https://github.com/fleetdm/fleet/commits/main