🏗️ New commits pushed to Fleet: - getvictor: Document Windows PIN setup error. (#55130) - mikermcneil: Website: Update europe.ejs (#55149) - Prajwal2246: Stop batch software upload after first package failure (#53407) - allenhouchins: Claude FMA: skip _mbsetupuser and report chown failures (#55151) - allenhouchins: Add Willow Voice as a macOS FMA (#55153) - mikermcneil: Website: Update europe.ejs (#55159) - allenhouchins: Add article: Jira 9.12.40, Confluence 9.2.26, Bitbucket 9.4.26: the fixed bui... - spalmesano0: Cherry-pick Patching end user experience guide (#55163) - rachaelshaw: Simplify "schedule a report" guide (#55180) - dantecatalfamo: Only retry Android API quota errors when the retry fits in the response (#54920) - getvictor: Fixed IdP/SCIM user mapping for deleted Win host coming back. (#55044) - AndreyKizimenko: Add 4.91–4.93 baseline, migration, and Windows MDM loadtest results (#55172) - getvictor: Clear fleetd_present_at at upsert (#55128) - getvictor: Converted remaining slog to use Context. (#55177) - kitzy: Add CLAUDE.md and fleet-gitops skill to fleetctl new template (#53624) - dependabot[bot]: Bump github.com/moby/sys/user from 0.3.0 to 0.4.1 (#55139) - juan-fdz-hawa: Reduce ai_tools cost, fix accuracy and other fixes - mikermcneil: Website: Update europe.ejs: Friendlier (#55202) - fleet-release: Update Fleet-maintained apps and fix eM Client (#55193) - allenhouchins: Fix Firefox macOS FMA permissions with custom install scripts (#55203) - fleet-release: Update Fleet-maintained apps (#55204) - JordanMontgomery: One time tokens: Rotation endpoint (#54666) - JordanMontgomery: One time token activity copy (#54669) - JordanMontgomery: One time tokens: Enforce EUA requirements (#54667) - allenhouchins: Stop macOS FMA installs when the app won't quit (#55157) - allenhouchins: Remove lo-rain, NotchNook, and Huly as macOS FMAs (#55165) - allenhouchins: Remove Abstract as a macOS FMA (#55164) - allenhouchins: Add KiCad as a macOS FMA (#54613) - robbiet480: Add Outset as a macOS Fleet-maintained app (#55089) - allenhouchins: Add per-update detail columns to the software_update table (#53635) - allenhouchins: Fix FMA installer downloads for Avast Secure Browser, DbVisualizer, and Visua... - allenhouchins: Shorten two dogfood label descriptions to fit the 255-character limit (#55216) - allenhouchins: Dogfood: make sshd PermitRootLogin policy see directives in drop-in files (#5... - kilo-code-bot[bot]: Website: show Europe-specific homepage banner to European visitors (#55220) - raju249: Return a validation error instead of panicking on non-boolean GitOps controls... - raju249: Fix TestSSO for static token refusal in fleets with end user authentication (... - spalmesano0: Make search box the right-most element on Host details > Software pages (#54804) - github-actions[bot]: Update Go to 1.27.2 [automated] (#55221) - lucasmrod: Add Windows targets to test osqueryd changes/PRs (#55231) - getvictor: Moved CA and certificate template secret encryption to Fleet's shared encrypt... - noahtalerman: Cleanup mobile enrollment guides (#55189) - noahtalerman: Fleet vs. Jamf Pro and NinjaOne: add Android zero-touch and other new Fleet f... - allenhouchins: Bump Linux Claude Desktop patch policy to 2.31226.0 (#55243) - nulmete: Avoid locking policy_membership when refreshing policy_stats (#55138) - spalmesano0: Revamp vulnerability filters so the controls aren't hidden (#53269) - dantecatalfamo: Allow wipe on personally-owned Android hosts (#54906) - cdcme: Skip cached hashless FMA downloads in auto-update cron (#55150) - lucasmrod: Run golangci-lint in Go patch release workflow (#55255) - kilo-code-bot[bot]: Website: add JNUC photo to workshops page carousel (#55026) - AndreyKizimenko: Handbook: reopen QA engineer position for automation and load testing (#55188) - karmine05: Software inventory reference: add AI sessions row (#55237)

- AmanSarsenov-01: Correct spelling from 'Visibly' to 'Visually' (#55249) - noahtalerman: Add guide: Conditional access: Google (#55107) - AndreyKizimenko: Loadtest: add a Redis pool size input to loadtest-infra (#55104) - lucasmrod: Bump golangci-lint to v2.14.0 to fix lint with Go 1.27.2 (#55254) - nulmete: Stop My device policies from jumping on hidden policies toggle (#55267) - noahtalerman: Roadmap preview, October 2026 (#54905) - noahtalerman: Fix 404 for enrollment troubleshooting link (#55269) - claude[bot]: Handbook: add idioms to CEO flaws (#55274) - jkatz01: Keep apps and automations on token updates for fleets that did not change (#5... - ksykulev: Restrict unsupported osquery platforms from osquery endpoints (#55055) - Leanngove: Keep fleet selection when opening Software from the dashboard card (#55260) - spalmesano0: OS updates empty states (#52682) - allenhouchins: Nudge postinstall: load LaunchAgent into the logged-in user's GUI domain (#55... - georgekarrv: Multiple app store app instances (#55276) - jkatz01: Merge remote-tracking branch 'origin/main' into feat/47904-multiple-app-insta... - RachelElysia: App Store app versions: host detail icon, activity copy, install note, setup ... - jkatz01: Move FMA manifest reads to async part after request. (#55277) - noahtalerman: Conditional access: Google guide: call out matching limitation (#55283) - getvictor: Add cleanup that permanently deletes Fleet's records of certificates removed ... - ddribeiro: Update BYOD fleet description in yaml-files.md (#55287) - Leanngove: Add route for Google Play automatic app updates info (#55192) - dependabot[bot]: Bump handlebars from 4.7.9 to 4.7.10 in /ee/fleetd-chrome (#55199) - lukeheath: Fix bug and PR report crash on PRs from deleted forks (#55292) - kilo-code-bot[bot]: Website: remove unneeded cache headers from homepage (#55224) - allenhouchins: Website: Add GDPR badge to footer (#54900) - allenhouchins: Regen macOS Fleet-maintained app scripts (3/10: cyberduck through fellow) (#5... - allenhouchins: Regen macOS Fleet-maintained app scripts (2/10: bitbox through customshortcut... - allenhouchins: Regen macOS Fleet-maintained app scripts (1/10: 010-editor through biscuit) (... - allenhouchins: Regen macOS Fleet-maintained app scripts (4/10: ferdium through inkscape) (#5... - allenhouchins: Regen macOS Fleet-maintained app scripts (5/10: input-source-pro through matt... - allenhouchins: Regen macOS Fleet-maintained app scripts (7/10: omnigraffle through quip) (#5... - allenhouchins: Regen macOS Fleet-maintained app scripts (6/10: meetingbar through omnifocus)... - allenhouchins: Regen macOS Fleet-maintained app scripts (8/10: qview through sonos) (#55306) - allenhouchins: Regen macOS Fleet-maintained app scripts (9/10: sony-ps-remote-play through t... - allenhouchins: Regen macOS Fleet-maintained app scripts (10/10: tunnelblick through zwift) (... - allenhouchins: Update macOS Fleet-maintained apps: Defender bump, nightly version bumps, and... - allenhouchins: Remove UPDF as a macOS Fleet-maintained app (#55297) - allenhouchins: Unfreeze Keeper Password Manager (darwin) (#55263) - allenhouchins: Unfreeze i1Profiler (darwin) (#55264) - fleet-release: Update Fleet-maintained apps (#55319) - K3ll3r: Fix Wispr Flow FMA bundle ownership after install (#54708) - fleet-release: Update Fleet-maintained apps (#55327) - delize: Validate VPP app availability during gitops dry runs (#54019) - allenhouchins: Unfreeze DockFix (darwin) (#55334) - fleet-release: Update Fleet-maintained apps (#55337) - allenhouchins: Unfreeze MEGAsync (darwin) (#55333) - allenhouchins: Bump Linux Claude Desktop patch policy to 2.31226.1 (#55328) - allenhouchins: Stop macOS FMA custom install scripts when the app won't quit (#55342) - fleet-release: Update Fleet-maintained apps (#55349) - raju249: Fix InsertVPPAppWithTeam call in VPP token test after signature change (#55357)

- MagnusHJensen: AMDS: Authenticate cert verifier (#54968) - raju249: Apply the Apple Business issues filter on label-scoped host lists and counts ... - MagnusHJensen: fix misaligned table icon and left-align plus first line icon in host vital (... - juan-fdz-hawa: Define Linux disk encryption escrow eligibility once - Prajwal2246: Fix return navigation from live reports and policies (#54411) - MagnusHJensen: Filevault rotation: do not fail on notification failure if we queued the comm... - MagnusHJensen: AMDS: Issue challenges with purposes (#55095) - irenareedy: Update roadmap-preview-october-2026.md (#55291) - aliaska-varieva: Treat trailing zero version parts as equal in SmartVerCmp (#55056) - fsahinler: Add to customer-success list (#55242) - fleet-release: Update Fleet-maintained apps (#55368) - rfairburn: Disable FLEET_SERVER_ENABLE_CSP Dogfood (#55383) - melpike: Add route for rejected automatic enrollment (#55124) - jkatz01: Count only hosts in the app's fleet in App store app count (#55385) - eashaw: Website: remove query string cleaning script in layout (#55395) - mike-j-thomas: Handbook: add Fleet fast track deck (#55345) - cdcme: Reuse script content ID on policy script retry (#55394) - cdcme: Keep MSI upgrade code on GitOps reuse (#55393) - fleet-release: Update Fleet-maintained apps (#55390) - getvictor: Windows certs show up verified sooner, which matters for ESP (#55293) - AndreyKizimenko: Release QA: split Android into its own BYOD section (#55285) - eashaw: Website: add email template for October 2026 newsletter. (#55421) - noahtalerman: Update colors for text editors in the Fleet product (#55422) - noahtalerman: Dropdown menus open too close to the dropdown (#55420) - noahtalerman: Activity feed: 2px rings and timeline line (#55415) - noahtalerman: Host details > Reports: align card header, secondary button, remove back link... - noahtalerman: Roadmap preview October 2026: Order features to create a top 5 (#55372) - github-actions[bot]: Update versions of fleetd components in Fleet's TUF [automated] (#55428) - ShreyashAgare26: Consolidate pill styles into shared Tag component (#54174) - fleet-release: Update Fleet-maintained apps (#55425) - allenhouchins: Remove Debookee as a macOS Fleet-maintained app (#55447) - raju249: Send at most one pending DeviceConfigured per host during setup experience re... - raju249: Toast Account provisioning field errors once (#55446) - lucasmrod: Add guide: Enforce OS updates on macOS with Nudge (#55142) - noahtalerman: Software inventory reference: add Fedora Atomic desktops (rpm-ostree) (#54803) - jbelbo: Add Windows end user agreement (#55387) - noahtalerman: Disk encryption: clearer labels, and when to check only macOS key escrow (#55... - noahtalerman: Software title: hide "Added" timestamp for Apple App Store apps (#55245) - lucasmrod: VEX fleetctl for CVE-2026-78669 (#55429) - dantecatalfamo: Keep commands from a previous Android Enterprise from blocking the reconciler... - dantecatalfamo: Allow all Android app config fields except packageName and installType (#54807) - dantecatalfamo: Fix Android WIPE for a deleted host never reaching a terminal state (#54574) - dantecatalfamo: Configure destination fleets for Android zero-touch enrollment (#55272) - lucasmrod: Bump osqueryd version to 5.24.0 to release to

edge

(#55427) - Taraan03: Update README.md: typo (#55471) - allenhouchins: Unfreeze MacWhisper (darwin) (#55476) - fleet-release: Update Fleet-maintained apps (#55466) - cdcme: Check upload role before reading the body (#55440) - cdcme: Re-download missing FMA installers (#55443) - RachelElysia: Fleet UI: App Store app with failed update shows failure in install details m... - getvictor: Added DigiCert variables support and resend (#55401) Read more: https://github.com/fleetdm/fleet/commits/main