🏗️ New commits pushed to Fleet: - raju249: Add the background orphan mop to the Apple MDM command cleanup (#53814) - RachelElysia: Fleet UI: Migrate five worst-offender forms onto useFormValidation (#52980) - fleet-release: Update Fleet-maintained apps (#53955) - RachelElysia: Fleet UI: Storybook stories for 10 frequently-used components (#53904) - JordanMontgomery: Fix accountconfiguration command creation (#53820) - fleet-release: Update Fleet-maintained apps (#53960) - eashaw: Add GitHub workflow to run profile generator tests (#53885) - lucasmrod: Orbit: don't exit when startup device token rotation fails (#53962) - alececkmann-hadrian: Allow Windows OOBE Terms of Use redirect_uri (#53933) - eashaw: Website: update table name highlighting on osquery table documentation pages.... - allenhouchins: Update Company Portal macOS FMA to version 5.2608.0 and freeze input (#53989) - ksykulev: Android zero touch enrollment front end (#53217) - eashaw: Website: update profile generator tests to run each case three times. (#53988) - RachelElysia: Fleet UI: Storybook stories AI-review followups (#53986) - noahtalerman: Download page: label Windows fleetctl buttons x64 and Arm64 (#53979) - RachelElysia: Fleet UI: Fix Select targets empty-state ghost table collapsing to content wi... - RachelElysia: Fleet UI: Hide install details on Fleet Free (#53953) - RachelElysia: Fleet UI: Hide Update button in software update modal for users without write... - nulmete: Reject replayed SAML assertions on SSO login (#53655) - fleet-release: Update Fleet-maintained apps (#54018) - allenhouchins: Bump Claude for Windows FMA to 2.7032.0 (#53840) - eashaw: Website: update events shown on workshops page (#54016) - nonpunctual: Update instructions for SCEP cert integration to match feature label in Fleet... - MagnusHJensen: use drain loop for apple profile reconciler, but lower per tick cap (#53601) - GrayW: Update cis-benchmarks.md (#53957) - github-actions[bot]: Update Orbit CA certs [automated] (#54031) - raju249: Retire the refetch-only cleanup in favor of the Apple MDM command cleanup (#5... - MagnusHJensen: follow up UI changes for default AB token (#53812) - lucasmrod: Fleet UI: Reset policy from an automation run resets only that run's host (#5... - lucasmrod: Allow running local TUF Fleet Desktop when building from newer macOS to older... - lucasmrod: Bump macOS runners building Fleet Desktop from macos-14 to macos-15 (#54037) - noahtalerman: Update CODEOWNERS for /docs/solutions (#53972) - escomeau: Update go-to-market-operations.md (#54012) - lucasmrod: Fix bypass on EUA when disabled (#53902) - ShreyashAgare26: Cap the vulnerabilities tooltip in the software details modal (#53038) - fleet-release: Update Fleet-maintained apps (#54042) - MagnusHJensen: MOP: self service apple profile reconciler (#53816) - nulmete: Hide policies from fleet desktop (#53905) - lucasmrod: Remove health check for Splunk (#53913) - dependabot[bot]: Bump js-yaml from 3.15.1 to 3.15.2 in /ee/fleetd-chrome (#52848) - dependabot[bot]: Bump browserslist from 4.28.1 to 4.28.8 in /ee/fleetd-chrome (#52327) - dependabot[bot]: Bump @xmldom/xmldom from 0.8.13 to 0.8.15 in /ee/fleetd-chrome (#52388) - allenhouchins: Add guide: Preinstall Fleet's agent on Windows with a provisioning package (#... - fleet-release: Update Fleet-maintained apps (#54050) - JordanMontgomery: Fix pending profiles getting stuck on team transfer due to command cancellati... - allenhouchins: Update ppkg guide: fleetd build flags and optional pre-ship verification (#54... - allenhouchins: Add article: Autopilot without Autopilot (#54061) - noahtalerman: Send fleetd milestone stories to confirm and celebrate on release (#53803) - rynsatterlee: Enhance fleet troubleshooting documentation with logs info (#53340) - jkatz01: Notify before patching - repeat 1 hour notification for hosts that went offli... - lucasmrod: Fix build in Linux github runners (#54053)

- RachelElysia: Fleet UI: Host details header stops crushing Last fetched on narrow screens (... - raju249: Bound the work done verifying Apple deviceinfo payloads (#53937) - georgekarrv: gm: add

chore

commands (rank by handbook priority, merge sizes with release... - georgekarrv: Adding changes for Fleet v4.92.1 (#53907) - jkatz01: Notify before patching - refetch the reminder toast once install_at passes (#... - getvictor: Add Windows one-time secret support to orbit (#53686) - Dhvanit41: Log rejected enrollments with the host ID and without the overwrite w… (#54033) - jbelbo: Start Windows enrollment retention at host deletion (#54077) - jbelbo: Avoid placeholder limit in incoming host enrollment touch (#54099) - RachelElysia: Fleet UI: Show failure reason on notify-before-patching activity rows (#54092) - lukeheath: Right-size dogfood ElastiCache to reference architecture (#54112) - fleet-release: Update Fleet-maintained apps (#54109) - hollidayn: Update 📜 Fleet Subscription Terms.md (#54121) - mike-j-thomas: Website: Homepage hero ticker and 50/50 layout (#54025) - kilo-code-bot[bot]: Website: Fix "All" article filter to actually show all categories except Indu... - mikermcneil: Website: Add back "newsletter" link now that the first newsletter exists (#54... - eashaw: Website: update text on /better page (#54124) - jbelbo: Renumber migrations after the 4.93 cherry-pick (#54094) - mikermcneil: website: Removing confusing sentence (#54134) - rfairburn: db -> ref arch + tf mod ver for tls pq defaults (#54117) - fleet-release: Update Fleet-maintained apps (#54154) - MagnusHJensen: MOP: clear rows on host deletion, mdm re-/enrollment, and profile deletion (#... - juan-fdz-hawa: Require a pending enrollment prompt to start setup experience MDM SSO - juan-fdz-hawa: SQL editor fixes - AndreyKizimenko: Fix typo in APNs bad gateway error message (#54143) - juan-fdz-hawa: Fix Lightroom / Lightroom Classic CVE cross-matching - RachelElysia: Fleet UI: Hide per-fleet actions on software title 'All fleets' view (#54114) - noahtalerman: Report details: hide log destination when automations are off (#54005) - harrisonravazzolo: Create article on binary authorization for macOS 27 (#54192) - melpike: Always show MDM status modal buttons, use secondary style, toast on check-in ... - raju249: Split On (personal) from On (manual - personal): migration and backend (#54039) - noahtalerman: Patch management guide: note Patch when app is closed known issue (#53921) - noahtalerman: Certificates guide: move scripts to docs/solutions (#53971) - marko-lisica: Update patch management policy details in documentation (#54060) - lucasmrod: Fix macOS/Windows lint issues in Go in

main

(#54090) - allenhouchins: Nudge: add macOS 27 target, OS-specific update URLs, and macOS 15 upgrade dea... - fleet-release: Update Fleet-maintained apps and version shortener (#54185) - dependabot[bot]: Bump github.com/containerd/containerd from 1.7.35 to 1.7.36 (#54110) - noahtalerman: Android MDM is turned on via the UI, not GitOps (#53391) - marko-lisica: Revert "Patch policies: Notify end users before app updates" docs from main (... - juan-fdz-hawa: Reduce DB load of hosts/:id/health endpoint - marko-lisica: Document missing

installer_id

param for DELETE `/api/latest/fleet/software/... - allenhouchins: Add handbook-pr Claude skill for handbook changes (#54218) - eashaw: Website: update schema used for mobileconfig and ddm profile generations (#54... - allenhouchins: Fix Default Folder X macOS FMA bundle identifier (#54199) - mikermcneil: Homepage: disable announcement banner (#54198) - jkatz01: Add timeout to title icon and bootstrap package cleanup jobs (#54220) - nulmete: Clarify global host_expiry_window validation error (#54224) - JordanMontgomery: Release fleet desktop v1.5.1 (#54230) - Dhvanit41: Authorize before looking up policies when deleting global policies (#54182)

- nulmete: Permissions column and API endpoint count on fleet Users page (#54082) - allenhouchins: Bump Zoom Rooms FMA (custom-tap) to 7.2.0.14036 (#54202) - eashaw: Website: add profile generator test cases (#54223) - allenhouchins: Fix custom-tap casks for Homebrew 7 and regenerate Fleet Desktop 1.5.1 (#54240) - cdcme: Add host_script_results (script_id, exit_code) index (#54087) - lukeheath: Bump qs to 6.16.0 in website and fleet-agent-downloader (#54062) - juan-fdz-hawa: Fix false positive CVEs for the bash Python package - ksykulev: Fix concurrent zero touch token generation (#54147) - cdcme: Expire old host script results (#54122) - ShreyashAgare26: Cap modal width to the viewport at narrow screens (#53089) - ksykulev: Change zero touch reponse to match API docs (#54167) - Leanngove: Remove "enabled" from Android vital titles (#53531) - cdcme: Periodically clean up host software installs (#54139) - JordanMontgomery: Rename "OTES" config options (#54234) - Leanngove: Update Android self-service software scoping section (#54219) - jkatz01: Show Single App Mode copy in VPP install details for Error 1407 (#54267) - ksykulev: Adding zero touch conf endpoint to api list (#54146) - Leanngove: Update unlock command documentation (#53683) - allenhouchins: Add /legal/dpa redirect to the Fleet Data Processing Addendum (#54028) - noahtalerman: Product maturity: macOS and iOS/iPadOS Complete in Q4 2026, macOS Lovable in ... - fleet-release: Update Fleet-maintained apps (#54285) - raju249: Hide the My device link for unenrolled or Free iOS/iPadOS hosts (#54294) - raju249: Filter and count On (personal) and On (manual - personal) separately (#54177) - marko-lisica: [Docs update] Patch app when closed (#53338) - juan-fdz-hawa: SCIM group put/patch member validation handle unknown - juan-fdz-hawa: Fix CVE detail 404 for CVEs matched before NVD publishes them - JordanMontgomery: Fix generate gitops failing on Fleet Free when Apple MDM enabled (#54088) - lucasmrod: Fix report pages failing on results larger than MySQL's sort buffer (#54264) - jkatz01: Fix Chromium browsers getting patched while open after self auto update (#54250) - juan-fdz-hawa: Fix Windows CIS policy queries that could never pass or always passed - allenhouchins: Add DGX Spark guide and frontier hardware article (#54310) - headmin: Add case for Apple M6 in dex-queries.yml (#54315) - getvictor: Fixed a "This host is offline" error appearing on a new host (#53914) - fleet-release: Update Fleet-maintained apps (#54306) - dantecatalfamo: Retry Android Management API calls on 429 and pass 429 through the proxy (#54... - allenhouchins: Bump Linux Claude Desktop patch policy to 2.9939.4 (#54256) - Dhvanit41: Keep an Android host's disk space when a re-enrollment reports none (#52639) - melpike: Hide iPadOS fleet column first in Apple Business Manager table, narrow fleet ... - noahtalerman: Link disk encryption key modal's "Learn more" to the login-with-key guide sec... - nulmete: Drop live query results from hosts the campaign does not target (#53774) - MagnusHJensen: MOP: Install and Uninstall configuration profiles (#54035) - noahtalerman: Usage stats guide: Remove duplicate

numHostsFleetDesktopEnabled

(#53717) - noahtalerman: Patch when app is closed: clarify what needs to be set today (#53737) - lukeheath: Add 2026 penetration test to handbook security audits (#54008) - kilo-code-bot[bot]: Remove duplicate 'guides' link on deploy-fleet docs page (#54277) - tux234: Docs: correct claims that don't match the code (ServiceNow, certificates, CIS... - Dhvanit41: Stop the Android mock from reporting an enterprise as deleted (#52507) (#52550) - noahtalerman: Add guide: Deploy Okta FastPass for Linux (#53143) - noahtalerman: Activity feed: consistent borders for activity icons (#54278) - ksykulev: Removing DPC extras key (#54358) - RachelElysia: Fleet UI: My device Self service table stops squeezing columns at narrow widt...

Read more: https://github.com/fleetdm/fleet/commits/main