🏗️ New commits pushed to Fleet: - jbelbo: Use the existing EULA endpoints for Windows (#55491) - eashaw: Website: add android support to profile generator (#55416) - raju249: Finish a running setup experience script step from its recorded result (#55362) - fleet-release: Update Fleet-maintained apps (#55541) - MagnusHJensen: Fix manual idp mapping reset on MDM renewal (#55225) - raju249: Keep the /enroll QR code in step with the Personal/Company-owned toggle (#55431) - MagnusHJensen: Update policy automation resend guide (#55550) - MagnusHJensen: AMDS: Renewals (#55219) - allenhouchins: Remove RingCentral Windows FMA (#55552) - allenhouchins: Fix ForkLift (darwin) Fleet-maintained app bundle identifier (#55553) - lucasmrod: Cap CVE list length in vulnerability-scan Slack notifications (#55430) - fleet-release: Update Fleet-maintained apps (#55557) - lucasmrod: Use

edge

for workstations to test osquery 5.24.0 sooner vs later (#55558) - getvictor: Editing DigiCert CA variables now reissues certs if needed. (#55410) - lukeheath: Bump proxy-addr and compression in website and fleet-agent-downloader (#54976) - rynsatterlee: Add osquery to fleetd migration guide (#54455) - lucasmrod: Waive zizmor dangerous-triggers for dogfood-gitops.yml (#55567) - jkatz01: Remove stray ": " from unavailable Fleet-maintained app version error (#55487) - ebeahan: Fix duplicate text in daily standup guidelines (#55266) - mason-buettner: Update documentation to clarify duplicate package per-fleet behavior (#55028) - getvictor: The My device page now shows refetch errors only after the end user clicks Re... - allenhouchins: Update conditional access description for mobile devices (#55584) - eashaw: Website: add exit to modify-enterprise-app-policy android proxy endpoint (#55... - cdcme: Skip unchanged custom packages in GitOps (#55575) - fleet-release: Update Fleet-maintained apps (#55569) - marko-lisica: Docs: script-only packages support pre-install query, post-install and uninst... - fletcher-rudra: Add Parrot OS as a recognized Linux platform (#55228) - allenhouchins: Bump Evernote macOS FMA version to 11.38.5 (#55561) - allenhouchins: Bump Linux Claude Desktop patch policy to 2.37337.1 (#55517) - allenhouchins: Update Evernote macOS version to 11.38.5 (#55455) - allenhouchins: Redesign eM Client Windows FMA for eM Client 11 (#55209) - juan-fdz-hawa: Make Slider a non-submit button so Enter in form fields doesn't toggle it - cdcme: Fix installer delete deadlocks in GitOps (#55587) - allenhouchins: Add AppleCare warranty expiration custom host vital to dogfood (#55593) - jbelbo: Truncate long configuration profile names in the profile list (#55604) - juan-fdz-hawa: Remove Amazon Linux 2022 from goval-dictionary vulnerability scanning - fleet-release: Update Fleet-maintained apps (#55621) - nulmete: Show the end user's IdP external ID on the host details User card (#55555) - nulmete: Add $FLEET_VAR_HOST_END_USER_IDP_EXTERNAL_ID Fleet variable (#55451) - melpike: Consolidate assets into the configuration profiles list (#55397) - nulmete: Allow $FLEET_VAR_HOST_END_USER_IDP_EXTERNAL_ID in DigiCert certificate author... - fleet-release: Update Fleet-maintained apps (#55644) - allenhouchins: Add article: GitLab's CVSS 10.0 regex bug needs no login, and the fix is a ve... - lucasmrod: Run santactl and sentinelctl only from root-owned bundle paths on macOS (#55641) - nulmete: Fix policy automations table overflow at narrow widths (#55649) - RachelElysia: Fleet UI: Surface invalid Android configuration JSON error on app version for... - fleet-release: Update Fleet-maintained apps (#55653) - lucasmrod: Use WebSockets transport nudges for

orbit/config

functionality (#55505) - cdcme: Skip unchanged Fleet-maintained apps in GitOps (#55610) - nulmete: Coalesce concurrent live query cache reloads (#54792) - jkatz01: Fix flaky tests (#55671)

- RachelElysia: Activity feeds: Notify before patching shows software display name override (... - fleet-release: Update Fleet-maintained apps (#55673) - getvictor: Hardened Windows MDM device authentication (#55600) - nulmete: Fix misplaced tooltips in dashboard activity feed modals (#55693) - ShreyashAgare26: Fix Fleet-maintained app details modal squishing page content (#54179) - allenhouchins: Add article: 463 kernel CVEs cite Google's Sashiko this year. Which of your L... - allenhouchins: Unfreeze Claude for Windows FMA and bump to 2.19675.1 (#55696) - mikermcneil: Add Viktor Filipsson (Sonos) testimonial (#55695) - kc9wwh: Update apfs_crypto_users docs: per-user policy example and users join (#55475) - jbelbo: Keep Windows terms inside the enrollment web view (#55697) - robinedev: Add industry news article: Firefox Enterprise and the managed browser checkli... - kitzy: Add guide: Deploy Cloudflare One Agent on Android (#55535) - spalmesano0: Update Product Design handbook (#55566) - juan-fdz-hawa: Collect and store RPM package epoch in software_metadata - allenhouchins: Fix Okta Verify Windows FMA ingestion (x64-only 7.0.1.0) (#55699) - sharon-fdm: Fix SearchHosts excluding mobile hosts from label picker (#55650) - RachelElysia: Fleet UI: Surface server reason in Add/Edit version error toast (#55707) - RachelElysia: Fleet UI: Gate GitOps-managed conditional access settings (#55563) - allenhouchins: Bump Linux Claude Desktop patch policy to 2.42304.0 (#55705) - fleet-release: Update Fleet-maintained apps (#55706) - zwass: Add uptime table to fleetd-chrome (#55536) - ShreyashAgare26: Show GitOps IDs on software title details (#54354) - raju249: Verify Apple account provisioning IdP settings with the IdP when they change ... - raju249: Reject configuration_profiles/batch requests without a configuration_profiles... - raju249: Report wipe, lock, and clear passcode as not allowed for account-driven user ... - juan-fdz-hawa: Reject clear passcode for Apple hosts with MDM turned off - raju249: Require Apple MDM to list or add App Store (VPP) apps (#55543) - fleet-release: Update Fleet-maintained apps (#55745) - RachelElysia: Fleet UI: Fix command palette Manage software automations race (#55741) - melpike: Hide "Show hidden profiles" toggle when no profiles are hidden (#55721) - allenhouchins: Unfreeze Windows Firefox FMA and update to 157.0.1 (#55756) - alt-Rational: Add Azure Blob Storage support for software installers, bootstrap packages, a... - lucasmrod: Use multi-arch mailpit and docker-idp images for dev/test services (avoid vir... - juan-fdz-hawa: Integration tests breakdown - nulmete: Add getFieldProps and clear stale cross-field errors on blur (#54633) - nulmete: Prevent initial setup from reopening or racing after setup completes (#54825) - allenhouchins: Lift stale freezes: AnyDesk and LibreOffice (macOS) (#55762) - allenhouchins: Lift stale freeze: Pritunl (Windows) (#55764) - mikermcneil: Update README.md (#55770) - allenhouchins: Lift stale freezes: Adobe Acrobat Pro and NordPass (Windows) (#55763) - RachelElysia: Fleet UI: Show inline error when dropped file type is rejected (#55753) - RachelElysia: Fleet UI: Migrate conditional access modals to useFormValidation (#55574) - RachelElysia: DeviceUserPage: don't show mobile UI on shrunk desktop browser (#55742) - allenhouchins: Fix always-failing patch policies for macOS 4K (OpenMedia) FMAs (#55084) - allenhouchins: Guard custom macOS FMA install scripts against stale quit helpers (#55343) - RachelElysia: Fleet UI: Gate App Store version modals under GitOps mode (#55766) - cdcme: Clear removed installers after GitOps apply commits (#55782) - jkatz01: Return 502 with a clear message when the FMA manifest can't be fetched (#55800) - moojomoore: Fix public ACME endpoint path in internet exposure guide (#55785) - lukeheath: Allow lukeheath to self-approve .claude changes in confidential (#55812)

- eashaw: Website: remove get-est-device-certificate action (#55814) - getvictor: Fix Autopilot placeholder serials by matching on ZtdID (#55516) - allenhouchins: Rewrite the fleet-gitops skill and scaffold it for every major coding agent i... - eashaw: Website: update marketing attribution for users who visit from Google ads (#5... - marko-lisica: YAML docs: app_store_apps broken example links (#55758) - adriant172: Clarify login API token behavior and expiration (#55726) - fleet-release: Update Fleet-maintained apps (#55806) - eashaw: Website: track LI conversion on icp signups (#55825) - cdcme: Drop dummy replica foreign keys before the test starts (#55842) - cdcme: Activate fewer hosts per transaction (#55840) - fleet-release: Update Fleet-maintained apps (#55864) - allenhouchins: Unfreeze Default Folder X (darwin) (#55835) - allenhouchins: Unfreeze Google Gemini (darwin) (#55834) - allenhouchins: Unfreeze Garmin Express (darwin) (#55838) - allenhouchins: Unfreeze Adobe Acrobat Pro (darwin) (#55839) - allenhouchins: Add a per-host AI governance report to dogfood (#55867) - jkatz01: Fix flaky TestSetupNotRearmedByStaleReplica (#55810) - RachelElysia: Fleet UI: Disable self-service category add/edit/delete under GitOps mode (#5... - Dhvanit41: Record each transferred host once, with its own name, in the transfer… (#54407) - Dhvanit41: Log how many hosts the upcoming-activities unblock job freed (#54742) - github-actions[bot]: Fleet UI: Update osquery version options (#55296) - nulmete: Restrict Technician role to running saved scripts (#55784) - lucasmrod: Return 409 instead of 500 when concurrent initial setup loses the race (#55882) - lucasmrod: Remove management_site_key column from sentinelone table (#55876) - fleet-release: Update Fleet-maintained apps (#55883) - harrisonravazzolo: Add gitops revert article (#55863) - marko-lisica: Explain older macOS app copies at other paths in Update details modal (#55879) - getvictor: Updated Windows exe install scripts. (#55724) - getvictor: EJBCA datastore (PR 1) (#55752) - noahtalerman: Handbook: on-call assigns community PRs to the EM (#55889) - allenhouchins: Bump Linux Claude Desktop patch policy to 2.42304.2 (#55891) - marko-lisica: Docs: VPP app platforms aren't updated after the app is added (#55748) - harrisonravazzolo: FMA: Superhuman Docs (#55924) - github-actions[bot]: Update versions of fleetd components in Fleet's TUF [automated] (#55930) - lucasmrod: Release notes for fleetd

v1.62.0

(#55929) - allenhouchins: Handbook: add Anthropic as a sub-processor (#55898) - getvictor: EJBCA client (PR 2) (#55797) - getvictor: Fixed Windows hosts without BitLocker (#55783) - github-actions[bot]: Update versions of fleetd components in Fleet's TUF [automated] (#55933) - allenhouchins: Update Mellel macOS FMA to 6.8.0 (com.redlex.mellel.mac bundle ID) (#55866) - lucasmrod: Workstations back to osquery

stable

(#55934) - alt-Rational: Add Homebrew (BrewUI) as a macOS Fleet-maintained app (#55903) - lukeheath: Enable orbit config WebSocket notifications on dogfood (#55935) - allenhouchins: Add article: Execution Containers give Windows 11 two isolation modes for AI ... - allenhouchins: Unfreeze Disk Drill (darwin) (#55777) - Leanngove: Add period to host software library subheader (#55465) - lukeheath: Handbook: update steps to promote a workshop on LinkedIn (#55772) - mikermcneil: Handbook: add "Device management for Europe" slide deck (#55833) - mikermcneil: Website: update Microsoft Store availability to 2026 on software catalog (#55... - georgekarrv: Adding changes for Fleet v4.93.1 (#55715) - AndreyKizimenko: Add native Splunk integration to release smoke tests (#55948) Read more: https://github.com/fleetdm/fleet/commits/main