fleetctl ทุกเวอร์ชันและเวอร์ชันเก่า

Bug fixes
- Removed the emSign ECC Root CA - G3, emSign Root CA - C1, and emSign ECC Root CA - C3 root certificates from accepted certificates on the server matching curl's CA bundle, following the eMudhra intermediate CA key compromise.

Bug fixes
- Fixed GitOps reusing an MSI by hash or ETag dropping its upgrade code, which listed the package as deleted in dry runs and replaced its default uninstall script.
- Fixed GitOps runs that don't change a fleet's custom packages holding up the installs and scripts that policy automations queue for those packages until the run finished.
- Fixed GitOps and the Fleet-maintained app auto-update job keeping a cached installer after its file went missing from the installer store, which made installs fail. Fleet now downloads the installer again. GitOps checks the download against the app's SHA256 hash when the app has one.
- Fixed an issue on MDM renewals that would override any manual host user mapping set with the initial SSO user during ADE.
- Fixed GitOps runs that replace or remove a software package deadlocking with the installs that policy automations queue for it, which also skipped the host's other policy automations.
- Fixed policy automation script retries delaying script execution on other hosts due to database lock contention.
- Fixed the Fleet-maintained app auto-update job re-downloading apps without a published hash every hour for every fleet.
- Fixed the hourly policy stats refresh blocking policy result ingestion for its entire run on large deployments, which caused write latency spikes and lock wait timeout errors.
- Fixed GitOps runs that don't change a fleet's Fleet-maintained apps holding up installs queued for those apps, in that fleet and in other fleets with the same app, until the run finished.

Bug fixes
- Improved SSO session handling.

Bug fixes
- Fleet now retries Android Management API calls that fail because the API rate limit was exceeded (HTTP 429), waiting 60 seconds and then backing off exponentially, so user-initiated actions like lock, wipe, and custom commands are no longer dropped on a transient rate limit. Background jobs (profile delivery, device reconciliation, software jobs) still fail fast and retry on their next run.
- Fixed software title details pages and the hosts list software status filter timing out for software with a large install history.
- Added an hourly cleanup that deletes software install and uninstall records more than 30 days old, configurable with server.software_install_results_retention.
- Improved the performance of applying scripts through GitOps on Fleet instances with a large script-run history.
- Added an hourly cleanup that deletes script results more than 30 days old, configurable with server.script_results_retention.

Bug fixes
- Fixed GitOps re-downloading Fleet-maintained apps whose manifest carries no hash, such as 1Password, Google Chrome, Slack, Webex, and Zoom, on every run.
- Fixed software with an invisible reported name rendering as a blank row in Host details > Software, the Software page, and My device > Software. Some macOS system apps (e.g. MediaRemoteUI on macOS 27) hide themselves by setting their display name to a single zero-width character, which is neither empty nor trimmable; Fleet now falls back to the bundle identifier for these.
- Fixed the GitOps starter's CI jobs failing when the FLEET_URL secret ended in a slash.
- Fixed macOS hosts losing their IdP username, full name, groups, and department (and dropping out of IdP-group labels) after an MDM certificate renewal or re-enrollment when the IdP user had been set manually.

Bug fixes
- Fixed software title details pages and the hosts list software status filter timing out for software with a large install history.
- Fixed host activity queue getting stuck due to database transactions not retrying when getting MySQL error 1615
- Fixed deleting a host that was released from Apple Business reporting success while the host record stayed in Fleet. Fleet now checks the assignment with Apple before deleting, and returns an error instead of reporting success if Apple can't be reached.
- Fixed "Hosts enrolled" chart on the dashboard page to exclude pending hosts from per-platform counts.
- Fixed an issue where VPP and In House Apps would backdate and sometimes fall outside of the MDM command queue.
- Fixed a bug where updating a SCIM group's members could silently remove members that the identity provider did not ask to remove.
- Fixed script-only packages (.sh/.ps1/.py) with an uninstall script showing "Run/Rerun" and "Ran" instead of "Install/Reinstall", "Uninstall", and "Installed" on the host details and self-service pages.

Bug fixes
- Added a release budget for Fleet-initiated activities (policy-automation software installs and scripts, and iOS/iPadOS scheduled app updates): they are now queued immediately but released to hosts at a configurable rate (FLEET_ACTIVITY_FLEET_INITIATED_RELEASE_PER_MINUTE, default 1000 hosts/minute, 0 = unlimited), spreading out the install-execution and result-ingestion load when an automation fires for many hosts at once. User-initiated activities (self-service installs, admin-run scripts, lock/unlock/wipe, setup experience) are unaffected and now take precedence over queued Fleet-initiated activities on the same host.
- Fixed editing a policy on a large fleet stalling policy and software install result ingestion fleet-wide. The policy_membership wipe now runs after the policy update commits instead of inside its transaction, so its row locks are no longer held for the whole wipe. An interrupted wipe is completed by the policy membership cron.

Bug fixes
- Fixed a bug where the Fleet-maintained app auto-update job could keep an app's previous install script (which references the old installer filename) after downloading a newer version, causing the install to fail.
- Fixed automatic App Store app updates and policy automations queueing a duplicate install on a host whose upcoming activity queue was not draining. Fleet now skips an app that already has an install waiting in the queue, whether or not it has been sent to the device.
- Removed the duplicate App Store app installs Fleet had already queued, keeping the most recently queued install of each app on each host. Installs requested from the install button, self-service, or the setup experience are left in place.
- Fixed policy automations acting on an App Store app added for a platform other than the host's.
- Fixed an issue where the Apple reconciler would queue profiles for deleted hosts, that was pending in Fleet via Apple Business.
- Fixed Apple hosts losing built-in label memberships during Automated Device Enrollment (ADE), which prevented label-scoped profiles, software, and OS updates from being delivered.
- Fixed a bug where the batched Apple MDM profile and declaration reconcilers could skip hosts on deployments with more than 5000 Apple MDM hosts and one or more duplicate hosts.
- Fixed a database migration that could take hours to complete on deployments with many host certificates.
- Improved the error message shown when adding a Fleet-maintained app times out or is canceled by a proxy or load balancer while downloading a large installer.
- Fixed a Windows configuration profile staying listed on Host details > OS settings when it stopped applying to a host but another profile on that host still enforced all of the same settings. This affected deleting or renaming a profile, and transferring a host between fleets with matching profiles.
- Fixed 502 errors and timeouts on the software install endpoints caused by the hourly Fleet-maintained apps sync taking exclusive row locks on the entire software and software_titles tables while normalizing software names.
- Fixed a macOS Fleet-maintained app's name being applied to the iOS and iPadOS apps that share its bundle identifier.
- Fixed macOS Fleet-maintained app software names not being corrected when the catalog refresh failed.
- Fixed a 500 error during Apple MDM enrollment when a host had no DEP assignment yet (e.g. the enrollment request arrived before the host/DEP assignment row was created or replicated). The OS updates settings lookup now returns a not-found error so enrollment proceeds gracefully instead of failing.
- Fixed a bug where updating a Fleet-maintained app to a new build that uses the same shortened version did not update the file to the new installer, but did update some fields like install script.
- Fixed a bug where hosts that re-enrolled via DEP would sometimes have profiles with exclude-any labels attached installed before they had actually reported label results

Bug fixes
- Fixed a bug where a failed software install was reported as successfully installed when the install script exited with an error but a post-install script exited successfully.
- Fixed Windows Autopilot enrollments intermittently hanging on the Enrollment Status Page at "Account setup".
- Fixed an issue where devices given a mandatory update during ADE enrollment might display a failure or fail to display the update
- Fixed a bug where adding Windows software via GitOps could create a duplicate software title when a host had already reported the same program.
- Fixed a bug where Apple MDM devices re-enrolling manually with a pending SCEP renewal would not be treated as a new renewal and might skip apps, profiles, etc
- Fixed a bug where a Fleet-maintained app install could run a stale, previously-cached version after the app was auto-updated; installs (including automatic retries) now target the version Fleet currently displays.
- Fixed a bug where pinning a Fleet-maintained app to a different version didn't update the patch policy for it.

Bug fixes
- Fixed a bug where fresh Windows 11 25H2 (and other recent builds) failed MDM enrollment with error
80180006 because the device's discovery RequestVersion (e.g. "9.0") was rejected by an exact-match
allow-list. Fleet now accepts any MS-MDE2 discovery RequestVersion at or above the minimum supported
version ("4.0").

Bug fixes
- Fixed an issue where a configuration profile could be enqueued multiple times for a single host.
- Fixed recovery lock password being enforced on personally-owned (BYOD) macOS hosts, where it would always fail because personal enrollments have device lock rights stripped. These hosts are now skipped.
- Fixed a bug where a user's BYOD selection was not persisted through IdP authentication
- Fixed a bug where installing App Store (VPP) or in-house apps on an iOS/iPadOS host enrolled with the manual (profile-driven) BYOD enrollment profile failed while trying to look up a VPP user. These device-channel hosts now install apps to the device, the same as company-owned manual enrollment; user-scoped licensing is reserved for Account-Driven User Enrollment.

Bug fixes
- Added support for personal (BYOD) Apple MDM enrollment, tracking per-host enrollment permissions so that personal devices cannot be remotely wiped or locked, and preserving those permissions across SCEP/ACME certificate renewal.
- Fixed an issue where fleetd could intermittently fail to install during Windows MDM enrollment, which could cause the Windows Autopilot Enrollment Status Page to hang.

Bug fixes
- Fixed a bug where an Apple SCEP certificate profile backed by NDES could be marked "failed" and consume one of the host's limited profile retry attempts when its challenge password expired, instead of being automatically resent with a fresh challenge.
- Fixed GitOps runs failing with a software_categories duplicate-entry error when a software category's name differed only by characters MySQL's collation treats as equal (such as the Unicode variation selector in default categories like "🖥️ Productivity").
- Fixed the My device > Software tab appending a macos_applications query parameter to the URL when paginating, even though that page has no /Applications filter.

Bug fixes
- Fixed Fleet failing to start on a read-only root filesystem by storing custom org logos in the database when no S3 software installers bucket is configured, instead of writing to local disk.
- Fixed a bug where host vitals labels (e.g. IdP group/department labels) scoped to a fleet/team never got any hosts. The membership cron only looked at global labels, and team-scoped IdP labels also failed to populate due to an incorrect SQL join.
- Fixed a server out-of-memory crash that could occur when Apple's VPP (App and Book Management) API repeatedly returned transient errors (HTTP 500 with Retry-After, or error 9646) during VPP API operations (e.g., app installs, user registration, license seat releases).

Bug fixes
- Updated conditional access policy query to use parameter binding for platform filter.

Bug fixes
- Fixed fleetctl gitops rejecting Android or Windows configuration profiles when editing an existing team, even when the corresponding MDM platform was configured.
- Implement roaring bitmaps in historical data collection for improved performance.
- Fixed dynamic SCEP certificate issuance failing with an "Invalid NDES admin credentials" error when the NDES Admin URL is fronted by Okta or another gateway that uses HTTP Basic auth instead of NTLM.
- Remove unneeded call to get tracked CVEs when reading CVE chart data

IT Admins
- Added a dark theme to the Fleet UI, selectable in account settings with light, dark, and system options.
- Implemented Clear Passcode feature for iOS and iPadOS.
- Added support for Fleet variables in Apple's declaration profiles (DDM).
- Added support for passing end-user authentication context to the Fleet MSI installer during Windows MDM enrollment, so end users are not prompted to authenticate twice when EUA is enabled.
- Switched to Docker as the default WiX runtime on macOS (including Apple Silicon) when generating .msi packages via fleetctl package. Wine is no longer required on macOS for the default path.
- Updated macOS 15 CIS benchmark to include v2.0.0 changes.
- Updated the macOS 14 (Sonoma) CIS policy set to benchmark v3.0.0.
- Switched Fleet-maintained apps serving location from GitHub to https://maintained-apps.fleetdm.com/manifests. If this site is inaccessible, Fleet will fall back to the previous GitHub-hosted copies of manifest files.
- Added conditional HTTP downloads using ETag headers for software in GitOps, skipping re-download when content hasn't changed.
- Added always_download option for software in GitOps to bypass the new conditional download feature.
- Added automatic escaping of JSON special characters in GitOps variables used in .json configuration profiles (Apple DDM declarations and Android profiles).
- Updated fleetctl gitops to process Android certificates before Android profiles.
- Made fleet name uniqueness rules consistent across the UI, API, and GitOps paths. Fleet names must now differ by more than letter case, and conflicts return a 409 error on all code paths.
- Enabled renewing and deleting AB tokens in the UI in GitOps mode.
- Changed the team's script_execution_timeout in agent options to default to the global agent options value when unset.
- Added ability to save policies whose SQL is flagged as a syntax error.
- Withheld Android Wi-Fi configuration profiles (openNetworkConfiguration with ClientCertKeyPairAlias) until the referenced certificate is installed or terminally failed on the device.
- Updated the host OS settings detail column to show the reason when an Android profile is pending due to a certificate dependency.
- Added "Hosts online", "Vulnerability exposure", and "Hosts enrolled" charts to the dashboard.
- Added an admin setting to control retention of vulnerability-exposure data used by the dashboard chart.
- Added new policy details page with a read-only view of policy information.
- Updated edit policy page to redirect users with read-only access to the policy details page.
- Added dedicated /policies/:id/live route for running policies.
Security Engineers
- Added UI pages for creating and editing API-only users with support for fleet assignment, role selection, and API endpoint access control.
- Added new middleware (APIOnlyEndpointCheck) that enforces a 403 response for API-only users whose request either isn't in the API endpoint catalog or falls outside their configured per-user endpoint restrictions.
- Added POST /users/api_only endpoint for creating API-only users.
- Added PATCH /users/api_only/{id} endpoint for updating existing API-only users.
- Updated fleetctl user create --api-only to remove email and password field requirements.
- Added a new premium GET /api/_version_/fleet/rest_api endpoint that returns the contents of the embedded api_endpoints.yml artifact.
- Updated GET /users/{id} response to include the new api_endpoints field for API-only users.
- Added user_api_endpoints table to track per-user API endpoint permissions.
Bug fixes and improvements
- Updated Go to 1.26.3.
- Improved MySQL writer performance by skipping no-op UPDATE host_orbit_info and UPDATE host_disks writes when the stored values already match the incoming ingest values from osquery, cutting these writes to near zero at steady state.
- Improved Fleet-maintained apps (FMA) sync performance by adding an index on software.bundle_identifier that eliminates a full table s

Bug fixes
- Reduced database load from GET /api/latest/fleet/device/{token}/desktop and other Fleet Desktop endpoints when invalid or expired device auth tokens are presented, by resolving the token to a host id with a single-table indexed lookup before running the multi-join host-details query.

Bug fixes
- Fixed filtering in /api/v1/fleet/labels/:id/hosts endpoint.
- Fixed a dead SQL condition in hostVPPInstalls that was misleading but harmless: Android VPP apps never produce nano_command_results entries (they use Google's Android Management API, not nanoMDM), so the previous (hvsi.platform != 'android' OR ncr.id IS NULL) guard was a tautology. Replaced with a clarifying comment.
- Fleet UI > Settings > Variables: Fixed access to not allow adding custom variable while in gitops mode both in the empty state and when a variable already exists
- Fixed a bug where custom package installers were not removed when adding an FMA for the same title via GitOps, which caused setup experience to install duplicate software.
- Fixed a bug where host environment variables in script-only packages would cause gitops to fail
- Updated go to 1.26.2
- Fixed an issue where trying to wipe a device after its certificate was renewed could fail due to a missing bootstrap token. Note: The device might still have wiped
- Fixed a bug where duplicate software installers for linux could be added.
- Improved validation for invalid order_key values in /api/v1/fleet/commands, /api/v1/fleet/mdm/commands and /api/v1/fleet/mdm/apple/commands endpoints.
- Fixed a server panic when an Apple MDM DeviceInformation refetch response omitted DeviceName or other expected fields.

Bug fixes
- Fixed Fleet's Docker image failing to start in Kubernetes with an unknown userid error, triggered by a fleetctl dependency side effect.
- Use Docker as the default WiX runtime on macOS (including Apple Silicon) when generating .msi packages via fleetctl package. Wine is no longer required on macOS for the default path.

Bug fixes
- Fixed a crash on the "My device" page for Fleet Free instances. The page returned a 402 error when the host was assigned to a team because the device endpoint called a premium-only API, and also crashed when accessing undefined policies data.

Bug fixes
- Fixed policy creation failing when type was omitted.
- Fixed auth token not persisting when logging in via SSO.
- Fleet UI: Fixed infinite page loop pagination bug on software table page happening when viewing a subsequent page and then using the software filter dropdown to filter.
- Fleet UI: Fixed software table page number to be bookmarkable

Bug fixes
- Fixed the metadata extraction for .pkg macOS installers, which was introduced in 4.77.0 and could prevent updating some installers that were added in a previous Fleet version.
- NOTE: the fix may cause some installers that were added in Fleet 4.77.0 and later to fail to update with the message "The selected package is for different software". In this case, you will have to delete and re-add the installer. This will not only make it possible to update it successfully later, it will also create it with the correct metadata (name, version, bundle identifier).
- Fixed FMA apps not showing up for a fleet when added via GitOps after an automated FMA version update with an unchanged binary.

Bug fixes
- Fixed a crash on the "My device" page for Fleet Free instances. The page returned a 402 error when the host was assigned to a team because the device endpoint called a premium-only API, and also crashed when accessing undefined policies data.
- Stopped duplicate Fleet-maintained app entries from showing up in setup experience.
- Reduced database contention during the vulnerability cron.
- Added a secondary index on host_software(software_id) to improve query performance.
- Fixed an issue where the "add Fleet-maintained app" endpoint incorrectly added software to the Unassigned fleet.
- Muted deprecation warnings for body params when the "deprecated-field-names" topic is not enabled.
- Fixed custom app icons not getting set via GitOps when the same software title exists in multiple teams.

Bug fixes
- Fixed a bug where macOS systems previous enrolled in fleet wouldn't always go through setup experience after a wipe.
- Fixed issue where policy automation retries were potentially reading stale data from replica database.
- Updated the DEP syncer to properly reassign a profile when ABM unilaterally removes it

Bug fixes
- Fixed an issue where some UI users saw a blank gutter on the right side of parts of the UI.
- Updated UI to enable adding/removing multiple Microsoft Entra tenant ids.
- Fixed a hover style issue in the label filter close button.
- Fixed false positive CVE for Nextcloud Desktop.
- Fixed rare CPE error when software name sanitizes to empty (e.g. only special characters).
- Fixed false negative CVE-2026-20841 on Windows Notepad.
- Fixed issue with hosts incorrectly reporting policy failures after policy label targets changed.
- Updated storage of the auth token used in the UI; move if from local storage to a cookie.
- Improved spacing on the Controls > OS Settings page.
- Added the ability to specify allowed Entra tenant IDs for enrollments.
- Fleet UI: Show CTA to turn on Android MDM for Android software setup experience if MDM is not configured.
- Addded CVE alias for python visual studio code extension.
- Improved validation for host transfers.
- Fixed query results cleanup cron failing with "too many placeholders" error by filtering to only saved queries and batching the SQL IN clause.
- Moved the copy button for text areas out of the text area itself and in line with its label.
- Fixed some styling issues for the UI when no enroll secret is present on a fleet.
- Left-aligned "Critical" checkbox in Save policy form.
- Fixed query results cleanup cron failing with "too many placeholders" error by filtering to only saved queries and batching the SQL IN clause.
- Fixed matching logic on App component for pages titles.
- Fixed issue where the status name was wrapping at smaller viewport witdths on the mdm card on the Dashboard page.
- Fleet UI: Do not allow editing Fleet-maintained app in the UI while GitOps mode is enabled.

IT Admins
- Added support for dynamic SCEP challenges for Okta certs.
- Added a feature to allow IT admins to specify non-atomic Windows MDM profiles.
- Added GitOps support to fleet yaml to apply display_name to software package.
- Added enrollment support for iPod touch.
- Added hash_sha256 and package_name query parameters to the GET /api/v1/fleet/software/titles endpoint to allow checking if a custom software package already exists before uploading. Both parameters require team_id to be specified.
- Added ability to set default URL for Fleet Desktop.
- Added logic to skip setup experience for hosts that were enrolled > 1 day ago.
- Updated maximum software installer size to be configurable and bumped the default from 3 GB to 10 GiB.
- Added a check to fail any pending in-house app installs and cancel upcoming activities when unenrolling a host.
- Added gzip_responses server configuration option that allows the server to gzip API responses when the client indicates support through the Accept-Encoding: gzip request header.
- Allowed specifying an Apple Connect JWT for interacting directly with Apple APIs when retrieving VPP app metadata.
- Added logic to .pkg metadata extraction to match the root bundle identifier.
- Moved Windows automatic enrollment configuration instructions out of the UI and into the Windows MDM setup guide.
Security Engineers
- Added conditional_access.cert_serial_format server option to allow specifying the Okta conditional access certificate serial format.
- Improved authentication of POST /api/v1/osquery/carve/block requests by parsing and validating session_id and request_id before processing data.
- Redirected users to device policy page when failing conditional access requirements.
- Limited disk encryption key escrowing when global or team setting enabled.
- Differentiated IMP and Integrative Modeling Platform (IMP) while running vulnerability scanning.
- Fixed false negative for Adobe Reader DC CVE-2025-54257 & CVE-2025-54255.
Other improvements and bug fixes
- Added an environment variable to allow reverting to the old behavior of installing the bootstrap package during macOS MDM migration.
- Added --with-table-sizes option to prepare command to get approximate row counts of all database tables after a migration completes.
- Updated Fleet UI so that if software is detected as installed on software library page, hide any Fleet install/uninstall failures from page. Admin can view these failures from host details > activities.
- Updated Android certificate app to re-enroll if the host was deleted in Fleet.
- Updated fleetctl generate-gitops to output Fleet-maintained apps in a dedicated fleet_maintained_apps section of the YAML files.
- When a host is deleted, any associated VPP software installation records are also deleted.
- Global observers and maintainers can now officially read user details, which were already visible to them via the activity feed.
- Iru (Kandji's new name) added to the list of well-known MDM platforms.
- Improved error message when viewing disk encryption key fails because MDM has been turned off and the decryption certificate is no longer valid.
- Updated UI to show VPP version for adding software during setup.
- User sessions and password reset tokens are now cleared whenever a user's password is changed.
- Disallowed use of FLEET_DEV_* environment variables unless --dev is passed when serving Fleet.
- Handled the NotNow status from the device during DEP setup experience so it does not delay the release of the device.
- Allowed overriding individual configuration variables for MySQL and object storage when --dev is passed when serving Fleet.
- Updated DEP syncing code to use server-protocol-version 9 and handle THROTTLED responses.
- Updated UI styling to the Packs flow.
- Surfaced Google error message for Android profile failures after max retries instead of a generic error.
- Optimized recording of scheduled query results in the database.
- Improved API error message wh

Bug fixes
- Updated to Go 1.25.7.
- Fix issue where MySQL read replicas were not using TLS.

Bug fixes
- Optimizing certificate template batch delete auth
- Updated refetch logic for iPhone and iPad to only fetch location data if the host is locked.
- Fleet UI: Allow users to scroll through disabled yml fields
- Fleet UI: Update icon buttons for consistency
- Fleet UI: Fixed broken disk space sort header on hosts table
- Fleet UI: Fixed hover color of links in error flash messages
- Fleet UI: Clarify what happens to pending software installs when deleting VPP apps
- fixed an issue where fleetctl generate-gitops would panic if the google calendar integration was enabled
- Fixed false positive for CVE-2023-41036 for macvim
- the google calendar intergration api key json is now obfuscated in GET requests
- Fixed a UI bug where the host list was being pushed down when viewing with a platform filter.
- Fixed false negative CVE for 7-Zip installed with MSI installer.
- fixed libtiff false positive vulnerability
- Fixed CVE false positives for Microsoft 365 companion apps by targeting Microsoft 365 better
- Fixed a bug where certain iOS/iPadOS devices (enrolled prior to Fleet v4.68.0) are unable renew their
enrollment profiles because of mismatched server URLs (specifically, this bug occurs if the URL in
the original enrollment profile contains an enroll_reference query parameter).
- Added the FLEET_SERVER_TRUSTED_PROXIES configuration.
Updated lock modal for iPad hosts to display iPad screenshot in the end user experience section
Fixed false negative CVE for pgAdmin 4.
- Fixed git & gitk cve attributions due to mismatch between homebrew packaging and nvd feed attribution
- Fixed false positives for Safari CVE-2023-28205
- Fixed styling issues with long script names.
- Show error reason when trying to create or edit a label that conflicts with a built-in label name
- Fixed bug where certificate template parameters where not serialized

IT Admins
- Added ability to automatically uninstall managed apps when iOS/iPadOS devices are unenrolled from MDM.
- Added ability to schedule automated software updates for iOS/iPadOS VPP apps via the Fleet admin interface.
- Added the ability to get and set auto-update schedule for VPP apps via the API.
- Added scheduled updates functionality to iOS/iPadOS managed devices.
- Added custom VPP apps to available VPP apps listing.
- Added support for in-house apps to use Cloudfront signed URLs in manifest if Cloudfront is configured.
Security Engineers
- Added NATS as a logging destination.
- Updated NDES SCEP proxy to auto-detect response encoding, enabling compatibility with Okta CA and other UTF-8-based CAs.
- Implemented ingesting, persisting, and serving the sha256 hash and path for the CFBundleExecutable binaries of .app bundles on macOS.
Other improvements and bug fixes
- Added validation and harmonized the error message displayed when an installer (FMA, custom package, VPP app, in-house app) conflicts with another one on the same team targeting the same platform.
- Randomized APNS query to ensure all pending Apple hosts gets a push notification.
- Updated macOS bootstrap package to no longer install during MDM migration, only initial setup.
- Updated script and software installer policy automations will retry up to three times if attempts to run them fail.
- Improved host status tag styles on host details page.
- Improved error message for user-scoped profiles on iOS/iPadOS hosts.
- Surfaced Queries within the Details tab on the Host Details page.
- Updated software ingestion of manually-enrolled (BYOD) iPhone/iPad devices to only ingest (and display in software inventory) Fleet-installed software.
- Omitted software last_opened_at in API responses when the data source does not support it. Return an empty string when the source does have support but there is no value.
- Updated UI for Controls > Setup experience > Install software > Android to fix inconsistent loading state.
- Updated UI to show a generic error message when attempting to delete setup experience software.
- Improved error message when trying to apply certificate authorities via gitops without the correct license.
- Added space trimming of displayVersion when processing VPP apps (found in some production apps).
- Updated software version search to now include results that match the software title name in addition to the version name.
- Adjusted the read-only SQL editor to appear non-interactive.
- Added information about auto-update configuration to the "edited_app_store_app" activity.
- Refactored common endpoint_utils package to support bounded contexts inside Fleet codebase. Moved it to server/platform/endpointer.
- Updated UI to inform admins of the need to accept terms and conditions for multiple Apple Business Manager accounts.
- Removed Queries tab from Host Details page.
- Revised software batch upload timeout to be 4 minutes, refreshed as every software package is downloaded from source or uploaded to object storage, from 24 hours, allowing for quicker detection of when a software batch fails due to the underlying server going offline.
- Added a tooltip to an expired ABM token and also correctly removes the banner when an expired ABM token is deleted.
- Updated error message to clarify that Fleet requires Apple (macOS, iOS, and iPadOS) configuration profiles have a unique identifier (PayloadIdentifier) and scope (PayloadScope) across teams.
- Renamed "Disk space" to "Disk space available" in Host details > Vitals.
- Truncated long strings (Operating system and Hardware model) in Host details > Vitals.
- Rolled back the change to ingest legacy Entra "device ID" from the keychain (for silent migrations) because it's not supported by Entra.
Refactored common_mysql package to support bounded contexts inside Fleet codebase. Moved it to server/platform/mysql.
- Updated Go to 1.25.6.
- Fixed an issue that allowed uploading invalid Android profiles.
- Fix

Bug fixes
- Fixed bug in host activity card UI where activities related to MDM commands should be hidden when Apple MDM features are turned off in Fleet.

IT Admins
- Added ability to view past and upcoming MDM commands for a host in Fleet.
- Added ability to apply Android app configurations.
- Added support for resending Windows MDM profiles.
- Added support for renewal of custom SCEP profiles for Windows.
- Added support for team-specific labels. Currently team-specific labels must be created via spec endpoints, used by GitOps.
- Implemented ability to create, list, and delete Android certs from the UI.
- Added Android agent application (automatically deployed via Android MDM) to support automated installation of SCEP certificates on Android hosts.
- Added messaging around Apple VPP update failures due to the application being open.
- Added ability to indicate that new MacOS hosts enrolling via ADE should be updated to the latest operating system version.
- Added ability to edit Android software config in UI.
Security Engineers
- Added support for ingesting Windows certificates via osquery.
- Added activities for when certificates templates are created/deleted.
Other improvements and bug fixes
- Implemented streaming for the GET /hosts ("list hosts") API to improve performance.
- Updated API and GitOps to support AppleOSUpdateSettings.UpdateNewHosts.
- Added ability to search teams in dropdown when transferring teams.
- Added pagination metadata to the GET /mdm/commands endpoint.
- Updated the refresh_vpp_app_versions cron job to only attempt to refresh versions for Apple app store apps.
- Improved edit VPP UX by disabling a form that hasn't been edited.
- Updated logic used for determining whether to update a macOS host during DEP enrollment based solely on UpdateNewHosts flag.
- Added note to descriptions on schema tables using "count" as column name.
- Aligned Android MDM unenrollment endpoint with the already existing endpoint, DELETE /api/latest/fleet/hosts/{id}/mdm, for consistency across MDM platforms.
- Added migration for adding update_new_hosts flag to both App and Team configs.
- Changed the host details page to hide builtin labels in-line with other areas such as the label filter.
- Changed iOS/iPadOS and Android enrollment links on Add hosts modal to monospaced font to improve readability.
- Improved software upload progress modal.
- Improved consistency of gitops output language.
- Added loading state to turn off Android modal UI.
- Updated the migrate_to_per_host_policy cron job to no-op if Android MDM is not enabled.
- Updated software table so that all teams selection will now remove any unsupported url params.
- Improved unclear error message when uploading an APNS certificate if the CSR was not downloaded.
- Refactored RDS IAM authentication logic into a dedicated rdsauth package.
- Modified the automatic enrollment profile verification logic to only verify with Apple when a profile changes
- Updated S3 username/password when running in dev mode to remove outdated mentions of MinIO.
- Hid option to transfer hosts to their current team.
- Updated setup experience links to point to add software page relevant to platform.
- Revised auth requirements for /debug endpoints.
- Added additional validation to URL parameter for MS MDM auth endpoint.
- Improved SOAP message validation on Windows MDM endpoints.
- Fixed host query report to display "Report clipped" when a query has reached the 1k result limit.
- Fixed UI error message regarding adding software to a team with a duplicate title.
- Fixed an issue where batch uploading .mobileconfig profiles failed due to display name checks.
- Fixed an issue where certificate details modal overflowed the screen.
- Fixed click area of edit software file button.
- Fixed an issue where GitOps would fail if $FLEET_SECRET contained XML characters in XML files, due to not escaping the value.
- Fixed query behind fleetctl get mdm-commands to correctly get completed Windows MDM commands.
- Fixed MDM install command output to correctly display UTF-8 characters in the UI.
- Fixed missing upgrade code persistence when adding Windows s

Bug fixes
- Improved SOAP message validation on Windows MDM endpoints
- Revised auth requirements for /debug endpoints

Bug fixes
- Added additional validation to URL parameter for MS MDM auth endpoint

Bug fixes
- Fixed duplicate entry error when updating upgrade_code during software ingestion
- Fixed case sensitivity mismatches causing duplicate titles during software ingestion
- Added missing upgrade code persistence when adding Windows software to Fleet via GitOps
- Fixed a bug where iOS and iPadOS hosts enrolling via ABM MDM Migration would not have VPP apps installed

IT Admins
- Added support for Android setup experience software installation.
- Added support for Android self-service apps to fleetctl gitops.
- Added support for Android systemUpdate profiles.
- Added ability to create/view/delete Google Play Store software for Android in UI.
- Added $FLEET_VAR_HOST_PLATFORM for Apple platforms (macos, ios, ipados).
- Added support for installation of setup-experience VPP apps on manually-enrolled iOS/iPadOS devices.
- Added ability to deploy user-scoped SCEP profiles for Windows hosts.
- Added a configuration option to require Windows users turn on MDM manually via work or school account, rather than have enrollment happen automatically.
- Added UI to allow Windows hosts to manually enroll into Fleet MDM.
- Added support for $FLEET_VAR_HOST_HARDWARE_SERIAL and $FLEET_VAR_HOST_PLATFORM in Windows profiles.
Security Engineers
- Added ability to filter the activites on the dashboard page.
- Updated to regenerate FileVault profile when Apple MDM is turned on if the device's team has disk encryption enabled.
- Added Okta conditional access configuration to the Fleet UI under Settings → Integrations → Conditional access.
- Added endpoint for hosts to update certificate status.
- Added detail column to host_certificate_template table and added certificate_templates property with GitOps support.
- Updated fleetd/certificates/<id> and fleetd/certificates/<id>/status to authenticate using the orbit_node_key provided in the Authentication header.
- Updated MDM-enrolled Android devices to receive certificate templates in managedConfigurations.
Other improvements and bug fixes
- Improved performance by making the host_count property optional in the GET /labels API endpoints.
- Improved performance by avoiding unneeded extra queries when fetching team information.
- Improved request validation by returning an informative error when trying to filter software_titles with platform without a team_id.
- Allowed users to save Fleet queries even if their SQL is deemed invalid by the Fleet UI.
- Added a new error UI for file uploaders, and applied it in the Okta Conditional Access modal.
- Returned pre-install query output in Install Details modal.
- Translated idp to mdm_idp_accounts on API responses.
- Updated last_restarted_at property for hosts to be more reliable.
- Added Mosyle to the list of well-known MDM platforms.
- Changed where mdm_enrolled activity is created so it occures after the inital Token Update command to allowa the webhook to fire after the host can recieve additonal commands from Fleet MDM.
- Improved MDM command result endpoint response for pending Windows commands.
- Switched configurations referencing Redis 5 to Redis 6. Fleet is no longer verified to work with Redis 5 or below.
- Redacted API tokens in fleetctl config set to prevent accidental logging.
- Updated error message when attempting to run software install script on host with scripts disabled to refer to --enable-scripts flag (instead of --scripts-enabled).
- Updated queries APIs that drive the OS Settings UI to include the status of host cert templates.
- Updated the layout and styling of file uploader buttons across the UI.
- Updated built-in SVG icons to avoid rendering issues when certain combinations of icons are on the same page.
- Added consistant spacing to UI elements on the MDM page.
- Updated Go to 1.25.5.
- Fixed an issue where using bitwise operators in a query incorrectly marked the query as invalid.
- Fixed issue where MDM profile retry limits were interfering with Smallstep SCEP proxy renewal attempts, particularly in cases of expired SCEP challenges.
- Fixed incorrect status code on failure to interpolate certificate template variables.
- Fixed Android configuration profiles downloading as unusable .xml files with content [object Object]. Android profiles now download correctly as .json files with properly formatted JSON content, matching what was originally uploaded.
- Fixed the tab order of elements in the l

Security Engineers
- Added integration for Okta conditional access, where Fleet acts as a factor and blocks end users from logging into third-party apps, via Okta, if they are failing specific policies.
- Added activity log entries for: host deletion and expiration, updating or deleting host IdP mappings.
- Resolved multiple false positive vulnerability matches for the VSCode golang extension.
- Resolved false positive CVE matches for Logi Bolt.app.
- Detected vulnerabilities in JetBrains IDE plugins.
IT Admins
- Updated MDM enrollment flow for BYOD macOS hosts to enable end user authentication prior to downloading the MDM profile via the "My device" page.
- Added self-service install support for custom IPA apps on iOS and iPadOS.
- Added support for in-house (".ipa") apps to fleetctl gitops.
- Updated existing POST /setup_experience/script endpoint to allow updating the macOS setup experience script in-place, and modified GitOps to remove the DELETE call.
- Added support for Custom EST certificate authorities.
- Added ability to deploy certificates from Custom SCEP certificate authorities on Windows.
- Added status counts to batch script detail page tabs.
- Added InstallAnywhere as a self-extracting archive for PE metadata extraction.
- Added ingestion of upgrade_codes from Windows software, and provided to all relevant software endpoints.
Other improvements and bug fixes
- Improved performance of /api/latest/fleet/software/versions API endpoint.
- Updated host expiry logic to not delete macOS hosts that checkin via MDM protocol but not via fleetd.
- Optimized the cleanup Apple host profiles query to reduce probability of DB locking.
- Implemented UI logic to call existing manual update IdP API functionality.
- Implemented UI logic and new DELETE endpoint to manually remove host IdP mappings.
- Added experimental FLEET_MDM_ENABLE_CUSTOM_OS_UPDATES_AND_FILEVAULT configuration to allow deploying custom OS settings including Filevault payloads and macOS and Windows update settings.
- Added ability to change software display names in the UI.
- Fixed table styling for selecting table rows.
- Simplified setup experience configuration UI.
- Added better error messages when using build-in labels on GitOps and on the LabelSpecs endpoint.
- Hid software host count and version table when no hosts have the software installed.
- Adjusted UI section headers and layout of Settings > Integrations in Fleet Free.
- Added vulnerability seeding and performance testing tools.
- Moved end user authentication SSO settings under Integrations > SSO in global settings.
- Removed the premium check for host OS settings in host summary UI.
- Reduced Android device reconciler frequency to 1 hour.
- Reduced Android API usage by listing devices instead of getting and checking Android Enterprise disconnects hourly.
- Set the order of software installed during the setup experience to alphanumeric.
- Updated Go to 1.25.3.
- Fixed a layout issue on the script batch details page.
- Fixed installer for Cisco Secure Client not showing as installed in inventory/library due to using the wrong bundle identifier. This application should show up correctly now in the software inventory.
- Fixed errors when trying to run the apple_mdm_iphone_ipad_refetcher cron job.
- Fixed bug that prevented users from editing custom EST certificates URLs.
- Fixed incorrect UI placeholder element by replacing it with it's actual value.
- Fixed issue where vulnerabilities would occasionally show as missing.
Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.
Fleet's agent
The following version of Fleet's agent (fleetd) support the latest changes to Fleet:
1. orbit-v1.50.1
2. fleet-desktop-v1.50.1 (included with Orbit)
3. osquery-5.20.0 (included with Orbit)
4. fleetd-chrome-v1.3.3
While newer versions of fleetd still function with older versions of the Fleet server (and vice versa), Fleet does not actively test these scenarios and some newer feat

Bug fixes
- Updated existing /setup_experience/script POST endpoint to allow updating the macOS setup experience script in-place, and modified gitops to remove the DELETE call

Security Engineers
- Added support for software inventory on Android hosts.
- Added support for npm packages in software inventory and vulnerability matching for macOS and Linux hosts.
- Added support for JetBrains inventory on hosts.
- Added vulnerbaility detection in JetBrains plugins.
- Added support for VSCode fork (Cursor, Windsurf, VSCodium, VSCodium Insiders, and Trae) extensions in software inventory.
- Added Santa tables to fleetd.
IT Admins
- Added ability to install software for iOS and iPadOS hosts during the setup experience.
- Added ability to specify VPP apps for automatic installation during ADE iOS and iPadOS host enrollment.
- Added the ability to lock iOS and iPadOS devices through lost mode.
- Added support for locking and unlocking iOS and iPadOS devices from the UI.
- Added configuration option to setup experience for macOS hosts to halt if any software install fails.
- Added gigs_all_disk_space vital collection, storage, service, and UI rendering for Linux hosts.
- Added new server config flag for specifying the cleanup age for completed distributed targets.
Other improvements and bug fixes
- Added link component shown in the host column to the host details page.
- Added flash warning when an unauthorized user tries to access teams settings.
- Added descriptive error in cases of manual MacOS profile download failure.
- Updated the MacOS setup experience to use the new web UI.
- Updated the UI for adding new scripts to the scripts library.
- Changed display logic for the organization logo component on the My Device page to prevent flickering.
- Improved performance of /api/latest/fleet/os_versions endpoint, especially for deployments with Linux hosts.
- Optimized MySQL queries on /api/latest/fleet/vulnerabilities and /api/latest/fleet/software/versions to improve performance for Fleet UI use cases.
- Optimized /config API endpoint to use the primary DB node for both persisting changes and fetching modified app config.
- Improved live query response times by adding a new server config flag for specifying the cleanup age for completed distributed targets.
- Improved query performance by using a lighter-weight query for checking if a team is enabled for conditional access.
- Changed license warning to only show one time during GitOps runs.
- Updated to allow setting an org support url to use the "file" protocol in the url.
- Changed the default name of Host Identity CA to 'Fleet Host Identity CA' to avoid conflict with Fleet's Apple MDM CA.
- Updated host details run script user flows to include a confirmation step.
- Applied singular word form to GitOps log messages when a single entity is referenced in the message.
- Updated the "Setting up your device" page to show status of setup script run.
- Deprecate browser in favor of extension_for in API responses and JSON/YAML outputs.
- Added migration to clear the platform field on all builtin labels.
- Added migration to relink missing SCIM user data to hosts.
- Updated host certificate renewal flow for NDES, Smallstep, custom scep proxy CAs to support $FLEET_VAR_SCEP_RENEWAL_ID in the OU field rather than CN.
- Updated device mapping API to allow an "idp" source to manually set IDP user mappings.
- Updated styling to be more consistent in edit policies view for FireFox.
- Replaced outdated Firefox icon with a new one that follows brand guidelines.
- Allowed testing a new or edited policy query via live query while in GitOps Mode.
- Fixed missing "failed" VPP app install activities when installation is canceled due to MDM being turned off for a host.
- Fixed bug where uploading a software installer failed because it was "not found in the datastore".
- Fixed missing aboslute timestamp tooltips on script creation date in script list, query modification date in query list.
- Fixed bug with the ChangeManagement component where the GitOps checkbox local UI state was being reset due to GET request after PATCH request.
- Fixed MySQL deadlocks when multiple hosts are u

Bug fixes
- Fixed fleetctl generate-gitops when MDM is not turned on.
- Reduced load on migration from 4.74.0 and below.

Security Engineers
- Added support for Smallstep certificate authority.
- Added false-positive filtering for Linux vulnerability scanning.
- Added support for Arch Linux hosts.
- Added software inventory ingestion from Arch Linux hosts.
- Added new rate limiting implementation for Fleet Desktop API endpoints to support all/many hosts of a deployment behind NAT (single IP).
- Added support for reading server private_key from AWS Secrets Manager.
- Added support for vulnerabilities feed CPE translation JSON to override sw_edition field.
- Added filter for removing duplicate RPM python packages and renaming pip packages to match OVAL definitions (same as Ubuntu).
- Added ability to specify a Fleet host ID when declaring a manual label in a Gitops YAML file.
- Added a dedicated page, table, and logical integrations with other parts of the UI for managing labels.
IT Admins
- Added configuration profile support for Android hosts.
- Added activity logging for Android profile creation, modification, and deletion.
- Added support for software installation during Windows setup experience.
- Added support for Arch Linux hosts.
- Added software inventory ingestion from Arch Linux hosts.
- Added support to fleetctl to generate fleetd installers for Arch Linux (.pkg.tar.zst).
- Added software name into checksum calculation for macOS apps.
- Added ability to specify a Fleet host ID when declaring a manual label in a Gitops YAML file.
- Added a dedicated page, table, and logical integrations with other parts of the UI for managing labels.
- Added OpenTelemetry instrumentation to scheduled jobs and several API endpoints.
- Added CRON job to reconcile Android profiles.
- Added retries with backoff when Apple's assets API fails with a timeout error.
- Added ability to unenroll personal iOS/iPadOS devices from Fleet.
- Added support for assigning host labels based on idP attributes for iOS and iPadOS hosts.
- Added ability to turn off MDM for iOS and iPadOS devices when refetcher returns device token is inactive.
Note: The package will need to be updated out-of-band once, because the pre-removal script from previously-generated packages is called upon an upgrade. The old pre-removal script stopped Orbit unconditionally.
- Added support for hosts enrolled with Company Portal using the legacy SSO extension (for Entra's conditional access).
Other improvements and bug fixes
- Updated DEB and RPM packages generated by fleetctl package to now be safe to upgrade in-band through the Software page.
- Updated to return count in list host certificates API response, and use it in the certificate table.
- Updated setup experience to try software installs up to 3 times by default in case of intermittent failures.
- Modified the Apple profile reconciliation CRON logic to query for installs and removals within a transaction to avoid race conditions around team or label changes.
- Fixed inconsistent spacing in Controls OS settings headers.
- Validated setting manual_agent_install option on the server.
- Ignore warning when LastOpenedAt for software is nil on macOS.
- Improved install action tooltips and modals including timestamps to VPP successful installs.
- Changed the response code for UserAuthenticate checkin messages, which are unsupported, from a 5XX to "410 Gone" as specified in the Apple MDM protocol docs for servers that do not implement this method.
- Ensured UI consistency by adding a border to the empty state of End User Authentication section.
- Added easy to understand error messages when configuring Entra conditional access in Fleet.
- Updated docs for the pwd_policy table to better reflect the meaning of days_to_expiration.
- Improved the layout of the IdP-driven label form.
- Updated Hosts table > hostname column to truncate overflowing hostnames and place the full name in a tooltip on hover.
- Removed duplicate tar.gz copies of osqueryd and Fleet Desktop from built packages (DEB/RPM/PKG).
- Extended the number of errors Fleet looks for when det

Security Engineers
- Added support for Hydrant as a Certificate Authority and added an experimental API that can be used to have Fleet request a certificate from a Hydrant.
- Added a check to disallow FLEET_SECRET variables in Apple configuration profile <PayloadDisplayName> fields for security.
- Added /batch/{batch_execution_id:[a-zA-Z0-9-]+}/host-results API endpoint to list hosts targeted in batch.
- Added POST /api/v1/fleet/configuration_profiles/batch API endpoint to batch modify MDM configuration profiles.
- Added a new page in the UI for batch script run details.
- Added support for AWS RDS (MySQL) IAM authentication.
- Added support for AWS ElastiCache (Redis) IAM authentication.
- Added support for hosts enrolled with Company Portal using the legacy SSO extension for Entra's conditional access.
IT Admins
- Added setup experience software items for Linux devices.
- Added API endpoints for Linux setup experience.
- Device API endpoints for fleetd: POST /api/fleet/orbit/setup_experience/init and POST /api/v1/fleet/device/{token}/setup_experience/status.
- PUT /api/v1/fleet/setup_experience/software and GET /api/v1/fleet/setup_experience/software now have a platform argument (linux or macos, defaults to macos).
- Added IdP fullname attribute as a valid Fleet variable for Apple configuration profiles.
- Added the username of the managed user account user-scoped profiles are delivered to for macOS hosts.
- Enabled configuring webhook and ticket policy (Jira/Zendesk) automations for "No team".
- Added support for writing multiple packages in a single GitOps YAML file included under software.packages.
- Moved self_service, labels_include_any, labels_exclude_any, categories, and setup_experience declarations to team level for software in GitOps; setup_experience can now be set on a software package, Fleet Maintained App, or App Store app.
- Changed GET /host/:id to return an empty array for software field when exclude_software=true.
- Updated generate-gitops command to output filenames with emojis and other special characters where applicable.
- Added a Fleet-maintained app for macOS: Omnissa Horizon Client.
- Added opening instructions to self-service macOS apps and Windows programs.
Other improvements and bug fixes
- Added index to distributed_query_campaign_targets table to speed up DB performance for live queries.
WARNING: For deployments with millions of rows in distributed_query_campaign_targets, the database migration to add the index may take significant time. We recommend testing migration duration in a staging environment first. The initial cleanup of old campaign targets will occur progressively over multiple hours to avoid database overload.
- Added clean up of live query campaign targets 24 hours after campaign completion. This keeps the DB size in check for performance of large and frequent live query campaigns.
- Improved OpenTelemetry integration to add tracing to async tasks (host seen, labels, policies, query stats) and improve HTTP span naming, enabled gzip compression, reduced batch size to prevent gRPC errors.
- Updated output from packages_only=true so that it only returns software with available installers.
- Added tarballs summary card back into UI.
- Improved the sorting of batch scripts in the Batch Progress UI. Batches in the "started" state now sort by started date, and batches in the "finished" state now sort by the finished date.
- Removed inaccurate host count timestamp on the software version details page.
- Downgraded "distributed query is denylisted" error to a warning on the Fleet server since this message indicates a likely issue on the host and not the server. We will surface this issue in the UI in the future.
- Improved performance for YARA rules: when modifying config (PATCH /api/latest/fleet/config) with a large number of yara rules and when large numbers of hosts fetch rules via /api/osquery/yara/ endpoint.
- Improved performance when updating multiple policies in the UI. The policies

Bug fixes
- Added logic to detect and fix migration issues caused by improperly published Fleet v4.73.2 Linux binary
- Removing the software renaming fix introduced in 4.73.4 due to MySQL DB performance issues.

Bug fixes
- Improved software ingestion DB lock times by pre-inserting software/titles in smaller batches when hosts check in.
- Re-added and optimized fix for macos software ingestion to prevent duplicate software due to end user renaming software on host.

Bug fixes
- Optimized the query used to list a host’s script results so it performs well with large result sets.
- Fixed MySQL DB performance regressions introduced in Fleet 4.73.0/4.73.1 affecting OS versions and software titles read queries.

Bug fixes
- Changed MDM Enrollment logic so that devices identified as having a Migration deadline by ABM will not run Setup Experience on the next enrollment(the migration) but will on subsequent enrollments.

Security Engineers
- Added new detail query, only executed if TPM PIN enforcement is required, for determining whether a BitLocker PIN is set.
- Added host identity certificate renewal support for TPM-backed certificates (Linux-only). When a certificate is within 180 days of expiration, orbit will automatically renew it using proof-of-possession with the existing certificate's private key.
- Added new global activity created when a new disk encryption key is escrowed.
- Added issuer and issued cells to the host details and my device page certificates table.
- Allowed filtering host and team software by minimum and maximum CVSS score in the Fleet UI.
- Updated UI to display kernel vulnerabilities in the operating system details page for Linux systems.
- Updated macOS 13 CIS policies to align with CIS Benchmark v3.1.0 (from v3.0.0).
- Updated macOS 14 CIS policies to align with CIS Benchmark v2.1.0 (from v2.0.0).
- Updated macOS 15 CIS policies to align with CIS Benchmark v1.1.0 (from v1.0.0).
- Updated Fleet's certificate ingestion to accept non-standard country codes of longer than 2 characters. In addition, updated ingestion of other fields to truncate long values and log an error instead of failing.
IT Admins
- Added API endpoints for adding, deleting and listing secret variables.
- Added ability to add and delete custom variables in the UI.
- Added APIendpoints to get and list batch scripts.
- Added cron job to launch scheduled batch scripts.
- Added API endpoint to cancel scheduled batch script run.
- Added the ability to cancel batch script runs directly from the UI summary modal.
- Added ability to schedule batch script runs in advance to the "Run scripts" modal.
- Added the ability to filter the hosts list to those hosts that were incompatible with the script in a batch run.
- Added side navigation on the Controls > Scripts page, with the previous Scripts page content under the "Library" tab and a new "Batch progress" tab containing details about started, scheduled, and finished scripts.
- Added batch execution IDs to script run activities.
- Added IdP SSO authentication to the BYOD mobile devices enrollment if that option is enabled for the team.
- Allowed overriding install/uninstall scripts, and specifying pre-install queries and post-install scripts, for Fleet-maintained apps in GitOps.
- Added support of $FLEET_VAR_HOST_UUID in Windows MDM configuration profiles.
- Added additional logging information for Windows MDM discovery endpoint when errors occur.
- Added support for last opened time for Linux software (DEB & RPM packages).
- NOTE: Package will need to be updated out-of-band once, because the pre-removal script from previously-generated packages is called upon an upgrade. The old pre-removal script stopped Orbit unconditionally. fleet-osquery can safely be updated through the Software page only after a new package generated with this version of fleetctl has been installed through other means.
- Added indication of whether software on a host was never opened, vs. being a software type where last opened time collection is not supported.
- Added automatic install policies into host software responses.
- Updated fleetctl api to now support sending data in the body of non-GET requests using the -F flag. (Thanks @fuhry!)
Other improvements and bug fixes
- Added permissions to OS updates page so that only global admins and the team admin can see the page.
- Cleared label membership when label platform changes (via GitOps).
- Improved public IP extraction for Fleet Desktop requests.
- Marked DDM profiles as failed if response comes back with Unknown Declaration Type error, and improve upload validation for declaration type.
- Modified PUT /api/v1/fleet/spec/secret_variables endpoint to only accept secret variables with uppercase letters, numbers and underscores.
- Updated software inventory so that when multiple version of a software are installed the last used timestamp for each version is properly returned.
- Revi

Bug fixes
- Fixes a potential race condition issue, where a host might get released because no profiles has been sent for installation before releasing the device, by checking the currently installed profiles against what is expected.

Security Engineers
- Added support for issuing host identity certificates through SCEP (Simple Certificate Enrollment Protocol) that fleetd can use with TPM 2.0 hardware to cryptographically sign all HTTP requests.
- Added flag --fleet-managed-host-identity-certificate to generate fleetd packages for linux that use TPMs to sign HTTP requests.
- Added sso_server_url configuration option to support SSO setups with separate URLs for admin access vs agent/API access. When set, SSO authentication will only work from the specified URL. This fixes SSO authentication errors for organizations using dual URL configurations.
IT Admins
- Added support for Apple Account Driven User Enrollment for iOS/iPadOS when end user authentication is configured.
- Added support for MS-MDE2 v7.0 Windows MDM Enrollments.
- Added the following Fleet-maintained apps for macOS: iTerm2, Yubikey Manager, VNC Viewer, Beyond Compare.
- On the host details > software > library page and Fleet Desktop > Self-service page, show installer status and installer actions based on what software is detected in software inventory.
- On the host details > software > library page and Fleet Desktop > Self-service page, show user's when a software can be updated, allowing users to easily trigger a software update and see fresh data after an update completes.
- Updated VPP apps reported by osquery to retain their last install information when viewed in host software library.
- Switched to more comprehensive UpgradeCode based uninstall scripts when an UpgradeCode can be extracted from an MSI custom package.
Other improvements and bug fixes
- Added support for fleetd TUF extensions on Linux arm64 and Windows arm64 devices.
- Added a fallback to package install path for extracting app names from uploaded PKG packages.
- Added special handling for version extraction of Fleet-maintained app manifests that reference a download URL that isn't version-pinned.
- Improved fleetctl gitops type error mesages.
- Improved accuracy of auto-install queries for custom MSI packages by using a better identifier.
- Label created_at no longer factored in when scoping software packages by "exclude any" manual labels.
- Refactored AddHostsToTeam method to fix race condition introduced by global var.
- Changed enable_software_inventory to default to true if missing from gitops config.
- Modified backend for GET /api/v1/fleet/commands when filtering by host_identifier to address performance concerns and exhausting database connections when API is called concurrently for many hosts.
- Allowed users of Fleet in Primo mode to access Software automations and failing policy ticket & webhook automations.
- Update UI to support personally enrolled MDM devices.
- Removed DEB and RPM installers from installable software lists on hosts with incompatible Linux distributions (e.g. Ubuntu for an RPM).
- Revised MSI uninstall scripts to wait for an uninstall to complete before returning and avoid restarting after an uninstall.
- Added back software mutation on ingestion to fix non-semver-compliant software versions, starting with DCV Viewer.
- Increased timeouts on /fleet/mdm/profiles/batch to better support customer workflows with large numbers of profiles.
- Made consistent and update the Install and Uninstall detail modals for VPP and non-VPP apps across the Fleet UI.
- Updated go to 1.24.6.
- Fixed issue with package ids ordering causing software installers' scripts to be inconsistently generated.
- Fixed incorrectly displayed status in controls OS Settings page, if a host was only pending or failing on declaration for removal.
- Fixed bug with mdm_bridge Orbit table that caused panics due to invalid COM initialization.
- Fixed bug where a certificate Distinguished Name (DN) parser did not allow forward slashes in the value which resulted in parsing error.
- Fixed an issue where the detected date for software vulnerabilities was not being pulled correctly from the database.
- Fixed missing empty host lists on m

Bug fixes
- Added sso_server_url configuration option to support SSO setups with separate URLs for admin access vs agent/API access. When set, SSO authentication will only work from the specified URL. This fixes SSO authentication errors for organizations using dual URL configurations.
- Fixed an issue where SSO URLs with trailing slashes would cause authentication failures due to double slashes in the ACS URL. Both regular SSO and MDM SSO URLs now properly handle trailing slashes.
- Added support for MS-MDE2 v7.0 Windows MDM Enrollments

Security Engineers
- Updated CIS benchmarks for Windows 10 to version 3.
- Added support for IdP-based labels.
- Added last opened time for Windows applications.
- Updated GET /hosts/:id/encryption_key to return most recently archived encryption key if current key is not available.
- Added support for ingesting user's "Department" via SCIM and added support to set the FLEET_VAR_HOST_END_USER_IDP_DEPARTMENT variable on configuration profiles.
- Cleaned up false-positive vulnerabilities on Amazon Linux 2 hosts reported in Fleet ⇐ 4.55.
IT Admins
- Added the verification of user-scoped profiles on macOS.
- Added last opened time for Windows applications.
- Updated Windows Custom OS Settings including Win32/Desktop Bridge ADMX policies to now be marked verified after the host has acknowledged the MDM install command.
- Added support for "Host Vitals" label, starting with IdP-based labels which update automatically including after software installs.
- Displayed VPP apps installed on a host in the UI after command is acknowledged.
- Updated GET /hosts/:id/encryption_key to return most recently archived encryption key if current key is not available.
- Increased how often Fleet checks for new Fleet-maintained apps, from once per day to once per hour.
- Improved GitOps speed when managing software with hashes on a large number of teams.
- Separated host details software list into two separate sections: Inventory (software installed on a host) and Library (software available for installation on a host).
- Updated Apple profile verification code to disallow uploading profiles with the same identifier but differing PayloadScopes.
- Recorded installer URL when a Fleet-maintained app is added via the web UI or REST API.
- Added support for ingesting user's "Department" via SCIM and added support to set the FLEET_VAR_HOST_END_USER_IDP_DEPARTMENT variable on configuration profiles.
- Added support for the Apple MDM user channel. When a mobileconfig with a payloadscope of User is targeted for a host with a user channel connection, it will now be sent to the user channel.
- Added ability to add EULA end user sees during setup experience via gitops.
Other improvements and bug fixes
- Added user property api_only to backend activity details.
- Replaced email with user full name for login activity.
- Added a new avatar for API-only users in the activity feed.
- Updated side navigation styles across the app.
- Added premium tier messaging to the certificates section on the integrations page.
- Removed ability to upload a EULA in the UI if gitops is enabled.
- Migrated from aws-sdk-go v1 to aws-sdk-go-v2.
- Optimized database queries for MDM enrollment checks when one host is being checked at a time.
- Replaced own SAML implementation with https://github.com/crewjam/saml.
- Increased page size for software versions shown on the software view page from 5 to 10.
- Added retries in PATCH policies API requests to fix deadlock errors in "Manage automations" page.
- Added missing team_name property on /api/v1/fleet/hosts/identifier/:id endpoint.
- Added missing "url" parameter when exporting YAML on software packages that have a URL specified (thanks @drvcodenta!)
- Improved performance when pulling team settings on osquery config and distributed read endpoints.
- Allowed team selection and name updates when saving a copy of an existing query as a new query.
- Updated Fleet maintained apps uninstall script to use pkgutil to remove applications files.
- Added functionality for verifying installation of VPP apps.
- Moved the SSO and Host status webhook settings from Settings > Organization to Settings > Integrations.
- Updated software installed activities created during setup experience correctly categorized as from automation.
- Fixed cases where valid operating system vulnerabilities would be periodically incorrectly purged.
- Fixed details not showing when the device page URL was edited.
- Fixed an issue where the fleetctl codesignature requirements co

Bug fixes
- Fixed host certificate source recording (including associated performance/database load issues) when multiple hosts share the same certificate on user keychains with differing usernames.
- Fixed fleetctl panic caused by missing SSO settings during gitops generate.
- Fixed SSO settings page returning 500 when SSO settings are undefined.

Security Engineers
- Added support for Microsoft Entra ID conditional access.
- Updated vulnerabilities feed to fall back to non-primary CVSSv2/v3 sources when primary (NVD) data is not available, instead of omitting scores entirely.
- Updated custom SCEP proxy implementation to include one-time challenges.
- Added the source and username fields for host certificates, reporting 'system' or 'user' based on which keychain it was from (for macOS, it will be 'user' if coming from the "login" keychain), and the corresponding username if the source is 'user'.
- Updated certificates card on the host details and my device page to show a new keychain column.
IT Admins
- Added support for Microsoft Entra ID conditional access.
- Enabled Android MDM support. The functionality is limited to turning on Android MDM and enrolling a BYOD device.
NOTE: If your server was already using Android via the experimental DEV_ANDROID_ENABLED=1 flag, please turn off Android MDM before updating your Fleet server.
- Added support for filtering the hosts page for hosts with any of the 3 batch script execution statuses.
- Extended POST /api/v1/fleet/hosts/:id/wipe endpoint to allow users to specify the type of remote wipe for windows hosts.
- Improved releasing a macOS device during ADE enrollment, by increasing the frequency of checks for readiness.
- Added an audit log activity item for automatic install policy creation.
Other improvements and bug fixes
- Updated the Open Policy Agent (OPA) dependency to v1.4.2.
NOTE: This upgrade drops support for YAML 1.1 in configuration files. If you use the -c option to specify a configuration file when starting the Fleet server, you will need to update any yes or on values in the file to true, and any no or off values to false.
- Improved error and loading state for self-service page.
- Implemented searching the teams dropdown.
- Removed sort column buttons for host software columns that do not support sorting.
- Updated migrations to use the utf8mb4_unicode_ci collation across all tables and added a test to validate that new migrations use this collation.
- Added new optional parameter --outfile to fleetctl package to override the filename being generated.
- Updated software detection so that a new installer uploaded over an FMA app does not report as an FMA app.
- Improved error when trying to apply builtin labels.
- Updated copy and remove platform callout in manage automations modal.
- Update UI references to "Frequency" to now say "Interval".
- Prevented editing the UI MDM > End user migration section when GitOps mode is enabled, since this is GitOps-configurable.
- Made the gap between characters in password fields consistent.
- Updated to consistent 14px font size across all input and dropdown fields.
- Removed username requirements for certain MDM CIS policies.
- Added macOS redis cluster support.
- Changed to using DeleteObject S3 api for GCP interoperability.
- Updated to use the Source Code Pro font in the Disk encryption key modal for clear differentiation betweenvthe letter oh and the number zero.
- Updated go to 1.24.4
- Fixed result count shown when running a policy.
- Fixed bug with the 'Observers can run this query' tooltip due to missing styling rules.
- Fixed possible user invite race condition.
- Fixed issue where NDES SCEP admin page was parsed using wrong UTF16 endianness.
- Fixed manual labels in gitops not selecting hosts by hardware serial or uuid.
- Fixed a database bug where the host_uuid column was too small in some secondary tables related to ADE-enrollment and IdP accounts.
- Fixed missing CORS header check for JSON requests.
- Fixed bug when listing software titles for 'All teams' which caused duplicated entries.
- Fixed a bug that caused custom OS settings targeted using "include any" label rules to never verify on hosts that only included a subset of the targeted labels
- Fixed the Docker Fleet-maintained app install script to prevent a successful install from showing
up as a failure

Security Engineers
- Added vulnerability detection via OVAL for Ubuntu 24.10 and 25.04.
- Added ability to sync end user's IdP information with Microsoft Entra ID using SCIM protocol.
- Added ability to sync end user's IdP information with Authentik using SCIM protocol.
- Updated Windows 11 Enterprise CIS policies to version 4.0.
- Added new Detail Query 'luks_verify' used to verify if the stored LUKS key is valid.
- Added additional checks to vulnerability feed validation to prevent deploying an un-enriched NVD feed.
- Added SHA256 hash of Mac applications to signature information in host software response.
- Added FLEET_AUTH_SSO_SESSION_VALIDITY_PERIOD environment variable for overriding how long end users have to complete SSO.
- Added ability to execute scripts on up to 5,000 hosts at a time using filters.
- Added ability to run a script on all hosts that match the current set of supported filters.
- Added a new API GET /scripts/batch/summary/:batch_execution_id endpoint for retrieving a summary of the current state of a batch script execution.
- Added the endpoint POST /api/v1/fleet/configuration_profiles/resend/batch to resend a profile to all hosts that satisfy the filter.
- Added a starter library that is automatically applied to all new Fleet instances during setup.
IT Admins
- Added ability to execute scripts on up to 5,000 hosts at a time using filters.
- Added ability to run a script on all hosts that match the current set of supported filters.
- Added a new API GET /scripts/batch/summary/:batch_execution_id endpoint for retrieving a summary of the current state of a batch script execution.
- Added the endpoint POST /api/v1/fleet/configuration_profiles/resend/batch to resend a profile to all hosts that satisfy the filter.
- Added ability to uninstall software via Self-service tab of My device.
- Added a starter library that is automatically applied to all new Fleet instances during setup.
- Added FLEET_MDM_SSO_RATE_LIMIT_PER_MINUTE environment variable to allow increasing MDM SSO endpoint rate limit from 10 per minute. When supplied, this parameter also splits MDM SSO into its own rate limit bucket (default is shared with login endpoints).
- Added ability to sync end user's IdP information with Microsoft Entra ID using SCIM protocol.
- Added ability to sync end user's IdP information with Authentik using SCIM protocol.
- Updated Apple MDM enrollment to skip webview popup when end user authentication is disabled.
- Added SHA256 hash of Mac applications to signature information in host software response.
- Added UI to filter hosts by config profile status.
- Added UI for seeing custom profile status and to batch resend to hosts its failed on.
- Added filtering for hosts endpoints by MFM config profile and status.
- Added immediate cancellation of profile delivery when a profile is deleted; if it had already been installed then its removal will be pending.
- Added ability to turn off MDM for iPhone and iPad hosts on the hosts details page.
- Added ability for gitops mode to add a custom package on the software page to then copy/paste the YAML needed for packages that cannot be referenced with a URL.
Other improvements and bug fixes
- Fixed issue where SSO settings, SMTP settings, Features and MDM end-user authentication settings would not be cleared if they were omitted from YAML files used in a GitOps run.
GITOPS USERS: If you have these settings configured via the Fleet web application and you use GitOps to manage your configuration, be sure settings are present in your global YAML settings file before your next GitOps run.
- Added Neon to the list of platforms that are detected as Linux distributions.
- Updated scripts so that editing will now cancel queued executions.
- Warn users of consequences when updating script contents.
- Improved effectiveness of app-wide text-truncation-into-tooltip functionality.
- Prevented misleading UI when a saved script's contents have changed by only showing a run script activity's 

Bug fixes
Added FLEET_MDM_SSO_RATE_LIMIT_PER_MINUTE environment variable to allow increasing MDM SSO endpoint rate limit from 10 per minute. When supplied, this parameter also splits MDM SSO into its own rate limit bucket (default is shared with login endpoints).

Security Engineers
- Built Fleet integration with Microsoft Entra to conditionally prevent single sign-on for hosts failing policies.
- Added ability to set conditional access per policy, and update host policy UI to incorporate conditional access data.
- Added CVE ID as matching criteria for host software queries, in addition to software name. Also rebuild host software querying for better maintainability.
- Updated Fleet-managed DigiCert, NDES, and SCEP certificates to be renewed 30 days before expiry for those valid longer than 30 days or when half the validity period remains for certificates valid 30 days or less. Applies to certificates requested using this release or later.
- Added webhook as a logging configuration option.
- Added webhook query automation logging.
- Added shell and Powershell syntax highlighting when editing scripts.
- Added ability to run a script on a batch of hosts with a single user flow.
- Added download validation and existing-installer matching in GitOps via a new hash_sha256 field in software YAML.
- Added hash_sha256 field to the response for the GET /software/titles API.
- Added fleetctl generate-gitops command to generate gitops YAML files based on current Fleet configuration.
- Enabled saving Integrations > Advanced in GitOps mode.
IT Admins
- Added ability to run a script on a batch of hosts with a single user flow.
- Added the ability to upload and install tarball archives (.tar.gz).
- Added support for Fleet-maintained apps in GitOps.
- Added ability to add FMA via fleetctl YAML files.
- Added shell and Powershell syntax highlighting when editing scripts.
- Added query ID to query automation logs.
- Added UI for the manual agent install of a bootstrap package.
- Added categorization for self-service software, including filtering on the "My device" page.
- Added number of policies triggering automatic install of software in software table.
- Added webhook as a logging configuration option.
- Added webhook query automation logging.
- Added download validation and existing-installer matching in GitOps via a new hash_sha256 field in software YAML.
- Added hash_sha256 field to the response for the GET /software/titles API.
- Added support for FLEET_VAR_HOST_END_USER_IDP_USERNAME, FLEET_VAR_HOST_END_USER_IDP_USERNAME_LOCAL_PART and FLEET_VAR_HOST_END_USER_IDP_GROUPS fleet variables in macOS MDM configuration profiles.
- Added last_mdm_enrolled_at and last_mdm_checked_in_at to host detail endpoints to return the last time a host enrolled, or re-enrolled in MDM and the last time a host checked in via MDM, respectively.
- Added fleetctl generate-gitops command to generate gitops YAML files based on current Fleet configuration.
- Updated Fleet-managed DigiCert, NDES, and SCEP certificates to be renewed 30 days before expiry for those valid longer than 30 days or when half the validity period remains for certificates valid 30 days or less. Applies to certificates requested using this release or later.
- Updated host certificates with serial numbers below 2^63 will now display the decimal represntation of the serial number in addition to hex so that it is easier to match them up to what is displayed in the macOS keychain.
- Updated Install Status to correctly display available for self-service VPP apps.
- Logged invalid Windows MDM SOAP message and return 400 instead of 5XX. This change helps debug Windows MDM issues.
- Added macos_setup.manual_agent_install option in Mac setup experience to bypass fleetd install. Instead, fleetd should be installed via customer-customized bootstrap package.
- Allowed uploading VPP apps when GitOps mode is enabled.
- Allowed viewing the status details for an (un)install via the "My device" page.
- Updated Apple MDM enrollment flow to improve device-to-user mapping.
- Updated verification of Windows Wireless profiles to avoid resending already-applied profiles.
- Enabled saving Integrations > Advanced in GitOps mode.
Other improvements and bug fixes
- Added hover curs

- Removed error caused by macOS electron helper apps during ingestion.
- Added a temporary index during macOS software names migration to speed up host software installed paths cleanup introduced in 4.67.2. This change only affects upgrades from pre-4.67.0 versions.
Fleet's agent
The following version of Fleet's agent (fleetd) support the latest changes to Fleet:
1. orbit-v1.40.1
2. fleet-desktop-v1.41.0 (included with Orbit)
3. fleetd-chrome-v1.3.1
While newer versions of fleetd still function with older versions of the Fleet server (and vice versa), Fleet does not actively test these scenarios and some newer features won't be available.

- Fixed software deduplication when migrating from < 4.67.0 for cases where exactly two software entries would be merged into one, and for cases where the same bundle ID has more than one version, each with more than one that needs to be converted into a single software entry.
- Included host software installed paths migration in the above database migration, instead of waiting for software ingestion to repopulate/clean up affected rows.
Fleet's agent
The following version of Fleet's agent (fleetd) support the latest changes to Fleet:
1. orbit-v1.40.1
2. fleet-desktop-v1.41.0 (included with Orbit)
3. fleetd-chrome-v1.3.1
While newer versions of fleetd still function with older versions of the Fleet server (and vice versa), Fleet does not actively test these scenarios and some newer features won't be available.

- Removed updates of existing macOS software names on software ingestion to remediate a significant database performance regression introduced in 4.67.0.
Fleet's agent
The following version of Fleet's agent (fleetd) support the latest changes to Fleet:
1. orbit-v1.40.1
2. fleet-desktop-v1.41.0 (included with Orbit)
3. fleetd-chrome-v1.3.1
While newer versions of fleetd still function with older versions of the Fleet server (and vice versa), Fleet does not actively test these scenarios and some newer features won't be available.

Security Engineers
- Added ability to set labels on policies via GitOps.
- Added backend support for labels on policies.
- Added ability to cancel upcoming host activities in the UI.
- Added the DELETE /api/latest/fleet/hosts/:id/activities/upcoming/:activity_id endpoint to cancel an upcoming activity for a host.
- Added support for native Windows ARM64 in fleetd (fleetctl package --arch=arm64 --type=msi).
IT Admins
- Added SCIM integration, which allows IdP email, full name, and groups to be visible in host vitals. SCIM data is also used for getting the end user's full name during end user authentication of macOS setup flow, if needed. Currently, only Okta IdP is supported.
- Added a new IDP section to the integrations page where users can see their SCIM connection status.
- Added new users card on host details and my device page that shows host end user and IDP information.
- Added ability to set labels on policies via GitOps.
- Added backend support for labels on policies.
- Added ability to cancel upcoming host activities in the UI.
- Added the DELETE /api/latest/fleet/hosts/:id/activities/upcoming/:activity_id endpoint to cancel an upcoming activity for a host.
- Added support for native Windows ARM64 in fleetd (fleetctl package --arch=arm64 --type=msi).
- Added logging for invalid Windows MDM SOAP message and return 400 instead of 5XX to help debug Windows MDM issues.
- Removed Apple MDM profile validation checks for com.apple.MCX keys (dontAllowFDEDisable and dontAllowFDEEnable) due to customer feedback.
- Fixed a bug where BYOD iDevices deleted in Fleet but still enrolled in MDM were not re-created on the next MDM checkin.
- Fixed an issue with how names for macOS software titles were calculated and prevents duplicate entries being created if the software is renamed by end users.
Other improvements and bug fixes
- Added support for vmodule hidden osquery flag to assist with debugging.
- Added an additional statistic item to count ABM pending hosts.
- Added a timeout so the desktop app retries if not displayed after 1 minute.
- Updated UI to allow adding labels when saving or editing polices.
- Included newly created host ids in activities generated when hosts enroll in fleet.
- Moved view all host link onto host count of software, OS, and vulnerability details pages
- Updated Go to v1.24.1.
- Updated UI tables to truncate with tooltips for software, query, and policy names and improved keyboard accessibility to those clickable elements.
- Updated to accept any "http://" or "https://" prefixed URL to allow for easier testing.
- Updated apmhttp package to fix upload of medium/big sized software packages in environments where APM tracing is enabled.
- Fixed UI Gitops Mode getting cleared when other settings are modified.
- Fixed invalid default serial numbers being displayed for some hosts.
- Fixed pagination resetting the platform filter on the operating system UI table.
- Fixed issue where fleetctl gitops --dry-run would sometimes fail when creating and using labels in the same run.
Fleet's agent
The following version of Fleet's agent (fleetd) support the latest changes to Fleet:
1. orbit-v1.40.1
2. fleet-desktop-v1.41.0 (included with Orbit)
3. fleetd-chrome-v1.3.1
While newer versions of fleetd still function with older versions of the Fleet server (and vice versa), Fleet does not actively test these scenarios and some newer features won't be available.

Security Engineers
- Added integration with DigiCert Trust Lifecycle Manager. Fleet admins can now deploy DigiCert certificates to their macOS devices via configuration profiles.
- Updated activity log UI for new certificate authority features.
- Updated host details > software table to filter by vulnerability severity and known exploit.
- Return more granular data for live query and policy runs so it can be displayed to users.
- Allowed adding labels when saving or editing queries in the UI.
- Added support for queries with LabelsIncludeAny in backend.
- Added author_id to labels DB table to track who created a label.
- Removed duplicate download/delete attempts for MSRC bulletins when hosts are enrolled spanning multiple builds of the same version of Windows.
- Split up expired query deletion to avoid deadlocks in zero-trust flows.
- Moved software version transformations for vulnerability matching out of software ingestion to ensure software inventory versions match what osquery reports.
- Modified host software query to apply the vulnerability filter on VPP apps and latest software installs & uninstalls.
- Fixed false positive on macOS 15.3 by making sure we match the version format reported by Vulncheck.
- Fixed false positive for CVE-2024-6286 on non-Windows hosts.
IT Admins
- Added support for Fleet-maintained apps for Windows.
- Added integration with a custom SCEP server. Fleet admins can now deploy certificates from their own SCEP server to their macOS devices via configuration profiles. The SCEP server will only see traffic from the Fleet server.
- Return more granular data for live query and policy runs so it can be displayed to users.
- Added support for queries with LabelsIncludeAny in backend.
- Allowed adding labels when saving or editing queries in the UI.
- Updated macOS setup experience to show an error if an App Store app installation fails due to lack of licenses.
- Added platform key to software_package and app_store_app keys throughout API.
- Improved error messages when Fleet admin tries to upload a FileVault (macOS) or a BitLocker (Windows) configuration profile.
- Ignored compatible Linux hosts in disk encryption statistics and filters if disk encryption is disabled.
- Allowed for any number of comments at the top of XML files for Windows MDM profile CSPs.
- Disabled unsupported automatic install option during add flow of .exe custom packages.
- Updated Fleet to treat software installer download errors as a failure for that installation attempt, which prevents the software installation from remaining in "pending".
- Added Apple Root Certificate for HTTP requests to https://gdmf.apple.com/v2/pmv. This solves the issue of minimum macOS version not being enforced at enrollment.
- Removed unreliable default (un)install scripts for .exe software packages; install and uninstall scripts are now required when adding .exe packages.
- Added software URL validation in GitOps to catch URL parse errors earlier.
Other improvements
- Updated the empty states when choosing a label scope for new software, queries, and profiles.
- Clarified meanings of various types and fields involved in live query/policy infrastructure, document, and refactor for improved code clarity.
- Added configuration to Fleet server to enable H2C (forcing http2) to get around a limitation in GCP Cloud Run for upload file sizes.
- Added validation to both org logo URL fields, and accept data URIs as valid.
- Removed redundant json array parsing in osquery pack report handler.
- Added took field (request duration) on server logs for requests that fail (non-2XX).
- Unified all pagination logic and styling.
- Updated the new policy flow and associated UI elements.
- Updated UI to cleanly truncate two overflowing values and display full values in a tooltip.
- Removed extra space above Next and Previous buttons in host activity feeds.
- Allowed team GitOps to run without global config.
- Added support for displaying scheduled query labels in fleetct

Security engineering
- Added UI for viewing certificate details on the host details and my device pages.
- Added new features to include certificates in host vitals for macOS, iOS, and iPadOS.
- Added the list host certificates (and list device's certificates) endpoints.
- Improved the copy for the delete and transfer host modal to be more clear about the disk encryption key behavior.
- Permit setting SSO metadata and metadata_url in gitops and UI.
- Fixed an issue where the Show Query modal would truncate large queries.
Vulnerability management
- Fixed Python for Windows software version mutation to avoid panics on software ingestion in some cases.
- Prevented an invalid FLEET_VULNERABILITIES_MAX_CONCURRENCY value from causing deadlocks during vulnerability processing.
- Updated default for vulnerabilities max concurrency from 5 to 1.
- Updated CPE generation to more closely align with CPEs use in vulnerability feeds.
- Changed software version CVE resolved in version parsing and comparison to use custom code rather than semver.
- Added new (as of 2025-03-07) archives page to data source for MS Mac Office vulnerability feed (applies to vulnerabilities feed rather than a specific Fleet release).
- Fixed an issue with Fleet's processing of Python versions to ensure that the correct CPEs are checked for vulnerabilities.
- Fixed an issue with increased resource usage during vulnerabilities processing by adding database indexes.
- Fixed false-positives on released PowerShell versions for CVE-2025-21171 and all PowerShell versions on CVE-2023-48795.
IT engineering
- Implemented GitOps mode that locks settings in the UI that are managed by GitOps.
- Allowed VPP apps to be automatically installed via a Fleet-created policy.
- Added ability for users to automatically install App Store Apps without writing a policy in the Fleet UI.
- Updated the UI for adding and editing software for a cleaner, cohesive experience.
- Added auto-install to FMA via the API, replacing a more brittle client-side implementation.
- Added pagination inside each of the Manage Automations modals for policies.
- Added script execution to the new upcoming_activities table.
- Added software installs to the new upcoming_activities table.
- Added vpp apps installs to the new upcoming_activities table.
- Updated the list upcoming activities endpoint to use the new upcoming_activities table as source of truth.
- Added support to activate the next activity when one is enqueued or when one is completed.
- Added UI to the BYOD enrollment page to support enrolling Android devices into Fleet MDM.
- Added UI to turn on and off Android MDM.
- Added Android MDM activities.
NOTE: Android features are currently experimental and disabled by default. To enable, set ANDROID_FEATURE_ENABLED=1.
- Updated UI for device user page with improved instructions for turning on MDM.
- Added PATCH /api/latest/fleet/software/titles/:id/name endpoint for cleaning up incorrect software titles for software that has a bundle ID.
- Added a daily job that keeps the App Store app version displayed in Fleet in sync with the actual latest version.
- Properly re-routed deleting a app on no team to no team software page insteal of all teams software page.
- Added a DB migration to migrate existing pending activities to the new unified queue.
- Added created_at timestamp for when a VPP app was added to a specific team.
NOTE: The database migration for the above hydrates timestamps for existing VPP app team associations based on when the associated VPP apps were first added to the database. To hydrate more accurate timestamps by pulling from VPP app add/edit activities, you can run the following query manually. It is not included in migrations as it requires full table scans of the activities table, which may result in long migration times.
UPDATE vpp_apps_teams vat
LEFT JOIN (SELECT MAX(created_at) added_at, details->>"$.app_store_id" adam_id, details->>"$.platform" platform, details->>"$.team_id" team_id

Bug fixes
- Improve validation handling.

Bug fixes
- Fixed an issue where the ABM token teams were being reset when making updates to the app config.

Device management (MDM)
- Included current host status and pending action in lock, unlock, and wipe API calls.
- Disk encryption keys are now archived when they are created or updated. They are never fully deleted from the database.
- Hosts that are restored from ABM no longer have old activities in their feed.
Orchestration
- Added bash interpreter support for script execution.
- Updated the activities feed with new design.
- Added fleetctl on Linux ARM binary to releases.
- Added clearer error states to metadata-related fields in the SSO settings form.
- Enforced consistency of on-click behavior of table rows.
- Added gzip compression for static CSS and JS assets to decrease bundle download times.
- Added API endpoint for updating script contents.
- Implemented various UI improvements to the scripts list.
- Added option to populate users and labels on list hosts endpoint.
- Checked the server for validity of any Fleet invites on load.
- Updateed user form validation to require a password be present when switching a user from SSO to password authentication.
- Updated the way new manual labels are created to better support adding large numbers of hosts at one time.
- Replaced "Include Fleet desktop" with host type radio selection buttons when adding Windows or Linux hosts.
- Disabled webhooks if not present in gitops.
Software
- Added ability to target app store apps with include/exclude labels.
- Added ability to edit targets or self service option for app store apps.
- Added details modal for add, edit, and delete app store app global activities.
- Added modal to edit script contents.
- Added download url for fleet maintained apps as url property on fleet/software/fleet_maintained_apps/:id.
- Added "exclude_fleet_maintained_apps" option to GET /api/v1/fleet/software/titles.
- Surfaced download URL for Fleet-maintained app when adding the software to Fleet.
- Surfaced cleaner errors when adding Fleet-maintained apps.
- Revised software installer package validation to mark installers with no version as "unknown" for version rather than rejecting them.
- Resolved false negatives on vulnerabilities for IntelliJ IDEA Community Edition on Windows.
- Resolved false-positives for the pass Homebrew package and jira Python package via a vulnerability feed update available to all Fleet versions on 2025-01-22.
- Fixed a false negative vulnerability reporting for iTerm2 (available to all recent Fleet releases as of January 17th via a vulnerability feed update).
Bug fixes and improvements
- Removed duplicate Linux lock and wipe scripts from repository.
- Clarified text on the policies and queries pages when no policies/queries exist for the selected team (or All Teams).
- Updated the help text for 3 tabs of the Add hosts modal.
- Improved the look and feel of dropdowns in the UI.
- Improved look and feel of dashboard host count cards including hiding platforms with 0 count.
- Added util wrapper func around semver package to allow for custom preprocessing. Upgraded semver library to 3.3.1 and usage everywhere to version 3.
- Added link to information about installing fleetd when packages are generated.
- Optimized software ingestion queries to use existing DB indexes in the software titles table.
- Normalized padding spacing for list headers, lists, and help text across various modals.
- Removed the resend button for failed windows disk encryption profiles and add messaging that tells the user that Fleet with automatically retry this profile again.
- Refactored upstream error logic to allow disabling submit button when form errors are present.
- Improved the verified and verifying tooltips on the Profile Status on OS settings page.
- Improved settings context so that user's updates to the team agent options form when they navigate away and back again.
- Improved the teams dropdown so that it gracefully hides overflow from long team names.
- Updated the os settings Target form deadline input tooltip to make it more clear how the deadline wo

Bug fixes
- Fixed issue verifying Windows CSP profiles that contain ADMX policies.
- Archived disk encryption keys when they were created or updated. They were never fully deleted from the database.
- Fixed issue where some Windows MDM profiles were not sent to hosts when hosts came back online.
- Removed the resend button for failed Windows disk encryption profiles and added messaging that tells the user that Fleet will automatically retry the profile again.
- Fixed bug where iOS devices were being removed prematurely by expiration policy.
- Removed request timeout on bootstrap package uploads for consistency with software package upload endpoints.

Bug fixes
- Removed request timeout on bootstrap package uploads for consistency with software package upload endpoints.
- Fixed bug where iOS devices were being removed prematurely by expiration policy.

Bug fixes
- Fixed issue when identical MDM commands were sent twice to the same device when replica DB was being used.

Endpoint operations
- Updated macos 13, 14 per latest CIS documents. Added macos 15 support.
- Updated queries API to support above targeted platform filtering.
- Updated UI queries page to filter, sort, paginate, etc. via query params in call to server.
- Added searchable query targets and cleaner UI for uses with many teams or labels.
Device management (MDM)
- Added ability to use secrets ($FLEET_SECRET_YOURNAME) in scripts and profiles.
- Added ability to scope Fleet-maintained apps and custom packages via labels in UI, API, and CLI.
- Added capability to automatically generate "trigger policies" for custom software packages.
- Added UI for scoping software via labels.
- Added validation to prevent label deletion if it is used to scope the hosts targeted by a software installer.
- Added ability to filter host software based on label scoping.
- Added support for Fleet secret validation in software installer scripts.
- Updated fleetctl gitops to support scope software installers by labels, with the labels_include_any or labels_exclude_any conditions.
- Updated fleetctl gitops to identify secrets in scripts and profiles and saves them on the Fleet server.
- Updated fleetctl gitops so that when it updates profiles, if the secret value has changed, the profile is updated on the host.
- Added /fleet/spec/secret_variables API endpoint.
- Added functionality for skipping automatic installs if the software is not scoped to the host via labels.
- Added the ability to click a software row on the my device page and see the details of that software's installation on the host.
- Allowed software uninstalls and script-based host lock/unlock/wipe to run while global scripts are disabled.
Vulnerability management
- Added missing vulncheck data from NVD feeds.
- Fixed MSI parsing for packages including long interned strings (e.g. licenses for the OpenVPN Connect installer).
- Fixed a panic (and resulting failure to load CVE details) on new installs when OS versions have not been populated yet.
- Fixed CVE-2024-10004 false positive on Fleet-supported platforms (vuln is iOS-only and iOS vuln checking is not supported).
Bug fixes and improvements
- Added license key validation on fleetctl preview if a license key is provided; fixes cases where an invalid license key would cause fleetctl preview to hang.
- Increased maximum length for installer URLs specified in GitOps to 4000 characters.
- Stopped older scheduled queries from filling logs with errors.
- Changed script upload endpoint (POST /api/v1/fleet/scripts) to automatically switch CRLF line endings to LF.
- Fleshed out server response from queries endpoint to include count and meta pagination information.
- Updated platform filtering on queries page to refer to targeted platforms instead of compatible platforms.
- Included osquery pre-releases in daily UI constant update GitHub Actions job.
- Updated to send alert via SNS when a scheduled "cron" job returns errors.
- SNS topic for job error alerts can be configured separately from the existing monitor alert by adding "cron_job_failure_monitoring" to sns_topic_arns_map, otherwise defaults to the using the same topic.
- Improved validation workflow on SMTP settings page.
- Allowed team policy endpoint (PATCH /api/latest/fleet/teams/{team_id}/policies/{policy_id}) to receive explicit null as a value for script_id or software_title_id to unset a script or software installer respectively.
- Aliased EAP versions of JetBrains IDEs to "last release version plus all fixes" (e.g. 2024.3 EAP -> 2024.2.99) to avoid vulnerability false positives.
- Removed server error if no private IP was found by detail_query_network_interface.
- Updated fleetctl dependencies that cause warnings.
- Added service annotation field to Helm Chart.
- Updated so that on policy deletion any associated pending software installer or scripts are deleted.
- Added fallback to FileVersion on EXE installers when FileVersion is set but ProductVersion isn't to allow more custom pack