🏗️ New commits pushed to Fleet: - dependabot[bot]: Bump ip-address from 10.4.0 to 10.7.2 in /tools/fleet-slackbot (#54292) - sharon-fdm: Update areas of expertise for Supply Chain and Power to PC (#54245) - lucasmrod: Harden automatic policy osquery query generation (#54336) - melpike: Fix spacing on Okta conditional access modal certificate section (#54377) - jbelbo: Add description column to configuration profiles (#54006) - noahtalerman: Windows & Linux setup experience: document login tab reopening (#54362) - kitzy: GitOps: support path/paths for fleet_maintained_apps and app_store_apps (#52080) - jkatz01: Fix in-house app package update returning 404 when an install has no upcoming... - Leanngove: Update host activity feed empty-state copy to reference commands (#53991) - allenhouchins: Add Lenovo SUHelper as a Windows Fleet-maintained app (#54396) - RachelElysia: Fleet UI: Team Admin sees Turn on for their own fleet's Hosts online modal on... - kilo-code-bot[bot]: Add Shayna Waldman testimonial (#53266) - JordanMontgomery: Store a result body when a host secret can't be expanded for an Apple MDM com... - raju249: Show On (personal) and On (manual - personal) separately in the UI (#54291) - MagnusHJensen: MOP: UI self service (#54406) - juan-fdz-hawa: Scope chart settings "Clear all" to the active tab - RachelElysia: Fleet UI: Fix Hosts filter dropdown overflow at narrow widths (#54371) - noahtalerman: Add guide: Provision Windows devices with Fleet, Okta, and a partner (#53896) - allenhouchins: Docs: fix end user auth bypass requirement and fleetd installer list (#54432) - allenhouchins: Add cloud-init first-boot enrollment guide and Linux zero-touch gap analysis ... - allenhouchins: Add article: Ubuntu's first curl fix for CVE-2026-8927 didn't hold, so a clos... - allenhouchins: Fix Okta FastPass sign-in in the Fleet Desktop macOS app (#54323) - RachelElysia: Fleet UI: Notify before patching shows a reason for every failure exit code (... - jkatz01: Keep apps on the patch reminder at the deadline and show updated apps as upda... - allenhouchins: Add article: Apple shipped five updates on September 28, and only two fix the... - allenhouchins: Handbook: replace links to deleted AI writing instructions (#54228) - allenhouchins: Update Evernote FMA (macOS) to 11.36.3 (#54434) - nulmete: Hide "Show hidden policies" toggle when none are hidden (#54427) - cdcme: Report a cleaned-up script result as gone instead of a generic error (#54440) - cdcme: Pin the query plan for the script results cleanup guards (#54439) - lukeheath: Handbook: update Apple @ Work and Auto Patching board links (#54372) - lucasmrod: Post open community PRs to #help-engineering every Monday (#54424) - RachelElysia: Fleet UI: Fix stretched EVENTED TABLE and Requires MDM badges in query side p... - JordanMontgomery: Add rotation_command_uuid and rotation_requested_at to host_disk_encryption_k... - marko-lisica: Docs: remove software API items that don't exist in the code (#54416) - allenhouchins: Add Zoom for Government as a macOS Fleet-maintained app (#54459) - ShreyashAgare26: Disable agent options Save while the YAML is invalid (#53097) - fleet-release: Update and fix Fleet-maintained apps (#54456) - terry-kwok-code: Add host 1798 to excluded storage restrictions (#54333) - juan-fdz-hawa: Fix hosts filtered by CVE timing out at scale - allenhouchins: Add Linux OS update remediation script (docs/solutions + dogfood) (#53439) - jbelbo: Accept name and description on profile endpoints (#54195) - allenhouchins: Add article: A registry allow list for WSL containers only helps if you can s... - getvictor: Windows MDM one-time secrets (server) (#53829) - dependabot[bot]: Bump axios from 1.18.0 to 1.20.0 (#54452) - dependabot[bot]: Bump dompurify from 3.4.13 to 3.4.16 (#54453) - HRMXGO: Fix docker-compose healthcheck port interpolation (#53804) - melpike: Left-align text in dropdown option tooltips (#54468)

- melpike: Replace disk encryption checkbox helper text with a tooltip (#54476) - spalmesano0: Add MDM and migration links to Apple MDM setup guide (#54254) - noahtalerman: Role-based access: Only admins and maintainers can run arbitrary scripts (#54... - allenhouchins: Install Fleet-maintained apps with a patch policy during Windows and Linux se... - eashaw: Profile generator: update schema used for windows profiles, add windows test ... - ireedy: Handbook: suspend account access after 6+ weeks of leave (#54495) - mike-j-thomas: Refresh /linux-management landing page (#54301) - Brajim20: Add Fleet-maintained apps smoke test to release QA template (#54493) - fleet-release: Update Fleet-maintained apps (#54497) - fleet-release: Update Fleet-maintained apps (#54504) - JordanMontgomery: Return a proper 404 on not-found ACME enrollments (#54429) - juan-fdz-hawa: Sort vulnerabilities by created_at without correlated subqueries - raju249: Clear fleet-scoped host filters when switching to All fleets (#54303) - MagnusHJensen: fix lint (#54516) - georgekarrv: Adding changes for Fleet v4.92.2 (#54341) - timball: Fix cross-arch fleetctl package on Windows (#54502) - jdscreations: Reset WelcomeHost refetch timer on give-up, not just the spinner (#53824) - RachelElysia: Activity feeds: show software display name override (#54241) - allenhouchins: Update UK representative address in privacy policy (#54524) - fleet-release: Update Fleet-maintained apps (#54517) - Dhvanit41: Honor the GitOps secrets exception on a fleet's enroll secrets button (#53588) - Prajwal2246: Fix missing Live report tooltip for locked hosts (#54509) - lucasmrod: Reduce lock contention on

query_results

(and batch when clearing results) (... - juan-fdz-hawa: Fix missing and intermittently lost Windows OS vulnerabilities - nulmete: Add load test run artifacts: 24k-host team transfer (#52371) (#52524) - rachaelshaw: Fix Sails.js stylization (#54469) - lukeheath: Website: Add script to send usage statistics to a Google sheet (#53191) - eashaw: Website: Add summary to the end of profile generator test (#54537) - RachelElysia: Fleet UI: Self-service failed install shows as "Failed" with Retry (#54528) - juan-fdz-hawa: Tighten platform handling in vulnerability feed processing - allenhouchins: Stop bundling a second copy of Fleet Desktop.app in the macOS pkg (#54533) - JordanMontgomery: Add on-demand FileVault key rotation backend (#54213) - jkatz01: Renumber 4.94 migrations to after the latest 4.93 migration (#54540) - juan-fdz-hawa: Remove Homebrew executable hash UI from host software - fleet-release: Update Fleet-maintained apps (#54544) - lukeheath: Handbook: Point usage statistics references to the automatically updated shee... - noahtalerman: iOS/iPadOS: Show tooltip w/ host's current local time (#52738) - JordanMontgomery: Add FileVault key rotation to the disk encryption key modal and activity feed... - juan-fdz-hawa: Stop the CVE feed generator from hanging after a GitHub rate limit - kevinmcox: Make OS tables sortable by version (#53013) - fleet-release: Update Fleet-maintained apps (#54555) - getvictor: Updated the UI for Windows one-time enroll secrets (#54332) - eashaw: Website: Update apple profile schema & generation script, add mobileconfig, d... - dependabot[bot]: Bump brace-expansion from 1.1.18 to 1.1.21 (#54481) - juan-fdz-hawa: Add support for Okta NDES to the request certificate API - juan-fdz-hawa: Stop homebrew_outdated from waiting on Homebrew's full auto-update - kitarp29: Adding the logic to make controls even when it's empty (#50836) - Dhvanit41: Keep unreported Android app installs pending instead of failing them (#52632) - JordanMontgomery: Add PR template changes for nano cleanups (#54530) - lukeheath: Handbook: Remove Grafana dashboard reference (#54576) - getvictor: Allow deleted Windows MDM host to come back to its original team. (#54477)

- lukeheath: Dogfood: enable Content-Security-Policy (#54577) - cdcme: Move header timeout to orbit (#54568) - kc9wwh: Explain that report intervals count host awake time (#54097) - eashaw: Profile generator: update test logs and cases (#54587) - Leanngove: Clarify Delete software API Android uninstall behavior and use fleet_id in ex... - fleet-release: Update Fleet-maintained apps (#54597) - fleet-release: Update Fleet-maintained apps (#54603) - georgekarrv: Run gitops workflows from main on pull requests (#53059) - sharon-fdm: Add tiered CODEOWNERS for orbit (#54543) - allenhouchins: Add Apple in the enterprise 2026 report announcement (#54501) - noahtalerman: Fleet variables guide: fix IdP username row (Scripts column missing Linux) (#... - noahtalerman: Fleet-maintained app maintenance: how to edit an app's pre-install query (#54... - getvictor: Added a backend patterns note for unbounded tables (#54636) - fleet-release: Update Fleet-maintained apps (#54637) - allenhouchins: Update Evernote FMA (macOS) to 11.36.4 (#54638) - jbelbo: Send Windows ESP hold commands once per session (#54490) - juan-fdz-hawa: Fix nvram_info AMFI detection for hex boot-args values - cdcme: Avoid policy lock on script re-apply (#54602) - jbelbo: Carry profile name and description through GitOps (#54375) - RachelElysia: Fleet UI: Shorten custom label filter placeholder (#54643) - allenhouchins: Fix overlapping title text in Apple in the enterprise PDF (#54646) - nulmete: Re-enforce host name template when a host is renamed on the device (#54089) - RachelElysia: Fleet UI: Show "no items match" state on client-filtered report tables (#54564) - nulmete: Send the host name command after re-enrollment instead of trusting a stale na... - eashaw: Website: Add support for new and updated usage statistics (#54659) - ksykulev: Added new Datadog metric android_proxy.amapi_request_count_by_request_type (#... - spalmesano0: Add default label colors and some extra label types (#54522) - getvictor: Improved Windows MDM host linking (#54635) - AndreyKizimenko: Loadtest: add a MySQL pool size input to loadtest-infra (#54680) - lucasmrod: Fix flaky TestRotator remote check assertion (#54653) - lucasmrod: VEX fleetctl for jackson CVEs (#54649) - getvictor: Win MDM one-time secrets: deleted unassigned host stays unassigned (#54681) - lukeheath: Bump axios, brace-expansion, engine.io, and urllib3 (#54684) - cdcme: Software installs aren't orphaned when an installer is deleted (#54663) - fleet-release: Update Fleet-maintained apps (#54697) - allenhouchins: Fleet Desktop (macOS): open transparency links in the default browser (#54505) - cdcme: Delete pending runs of deleted hosts (#54668) - allenhouchins: Add article: Three conditions decide whether Windows 11 26H2 backs up a PC's ... - rachaelshaw: Fix typo in REST API docs (#54711) - lukeheath: Handbook: document when to request a CVE for a security advisory (#54655) - fleet-release: Update Fleet-maintained apps (#54718) - kilo-code-bot[bot]: Website: scope handbook search to /handbook, restore Algolia for data tables ... - allenhouchins: Allow Fleet Desktop (macOS) to run on Macs that aren't MDM-enrolled (#54324) - allenhouchins: Add article: CVE-2026-102490 gives root on every Zammad version, so the first... - allenhouchins: Add Fleet Virtual Summit 2026 announcement article (#54557) - noahtalerman: Website: add /learn-more-about/deleting-a-host redirect (#54692) - noahtalerman: Best practice ADMX guides and profiles: one profile with the ADMX embedded (#... - allenhouchins: Fix homebrew FMA ingestion: rename Swifty to Rowel after upstream cask rename... - fleet-release: Update Fleet-maintained apps (#54737) - lukeheath: Improve validation handling on keys (#54740) - fleet-release: Update Fleet-maintained apps (#54757) - allenhouchins: Add Warehouse status custom host vital to dogfood (#54764)

- allenhouchins: Add Warehouse: Ready for deployment label to dogfood (#54765) Read more: https://github.com/fleetdm/fleet/commits/main