Fleet Release Notes

Bug fixes

Fixed a bug where the Fleet-maintained app auto-update job could keep an app's previous install script (which references the old installer filename) after downloading a newer version, causing the install to fail.

Fixed automatic App Store app updates and policy automations queueing a duplicate install on a host whose upcoming activity queue was not draining. Fleet now skips an app that already has an install waiting in the queue, whether or not it has been sent to the device.

Removed the duplicate App Store app installs Fleet had already queued, keeping the most recently queued install of each app on each host. Installs requested from the install button, self-service, or the setup experience are left in place.

Fixed policy automations acting on an App Store app added for a platform other than the host's.

Fixed an issue where the Apple reconciler would queue profiles for deleted hosts, that was pending in Fleet via Apple Business.

Fixed Apple hosts losing built-in label memberships during Automated Device Enrollment (ADE), which prevented label-scoped profiles, software, and OS updates from being delivered.

Fixed a bug where the batched Apple MDM profile and declaration reconcilers could skip hosts on deployments with more than 5000 Apple MDM hosts and one or more duplicate hosts.

Fixed a database migration that could take hours to complete on deployments with many host certificates.

Improved the error message shown when adding a Fleet-maintained app times out or is canceled by a proxy or load balancer while downloading a large installer.

Fixed a Windows configuration profile staying listed on Host details > OS settings when it stopped applying to a host but another profile on that host still enforced all of the same settings. This affected deleting or renaming a profile, and transferring a host between fleets with matching profiles.

Fixed 502 errors and timeouts on the software install endpoints caused by the hourly Fleet-maintained apps sync taking exclusive row locks on the entire software and software_titles tables while normalizing software names.

Fixed a macOS Fleet-maintained app's name being applied to the iOS and iPadOS apps that share its bundle identifier.

Fixed macOS Fleet-maintained app software names not being corrected when the catalog refresh failed.

Fixed a 500 error during Apple MDM enrollment when a host had no DEP assignment yet (e.g. the enrollment request arrived before the host/DEP assignment row was created or replicated). The OS updates settings lookup now returns a not-found error so enrollment proceeds gracefully instead of failing.

Fixed a bug where updating a Fleet-maintained app to a new build that uses the same shortened version did not update the file to the new installer, but did update some fields like install script.

Fixed a bug where hosts that re-enrolled via DEP would sometimes have profiles with exclude-any labels attached installed before they had actually reported label results

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

98d936e3b3055c40de64f442218ba894ad32a1682adb6a3716041b74001e0d14 fleet_v4.90.1_linux.tar.gz
c8ccac7479d89cc8772e13ba445189e9266d6cbb5a3fce0376661362abd73791 fleetctl_v4.90.1_linux_amd64.tar.gz
adf86cabdc399b64f69aff4b8d5d2c8b04d10634cdfa02ad14a7b493f112eed6 fleetctl_v4.90.1_linux_amd64.zip
d031eaeebc0f4fd483ea2e206e58f0d93a8804806944d1f8169ca1d3e6624346 fleetctl_v4.90.1_linux_arm64.tar.gz
d4022f340cbd3f88e2e722e6039462765176b1de13d484e7398b2488fe8a560c fleetctl_v4.90.1_linux_arm64.zip
439e00f33710f57d4586b0141dce3c032fc3eb4c1997550de80568e8bfa8bbc2 fleetctl_v4.90.1_macos.tar.gz
9e3f41fb8db4107208262d7b0c24c364100b3d705ee2ac6146cb7b04c6517dcb fleetctl_v4.90.1_macos.zip
da733b273f48765487f84ee774655490acb4978344f195a62b079a9abaab2d09 fleetctl_v4.90.1_windows_amd64.tar.gz
009380c7efdde3f0ac2170cd3b3ef6269e0f18fe338a7a02cc60a85bdaa4036c fleetctl_v4.90.1_windows_amd64.zip
5d8b669ac914baaa3ad048eb2b5afa30552d4e81d322568228328824df0aa261 fleetctl_v4.90.1_windows_arm64.tar.gz
2768ac7f53b7fe4da3d9c88736ed9752daac92a31e7e1bd3ba75688de0883c13 fleetctl_v4.90.1_windows_arm64.zip

Original source

Fleet 4.90.0 (Aug 05, 2026)

IT Admins

Added the ability to upload multiple custom packages (up to 10) for the same software title on a team, so IT admins can deploy different versions or architectures (for example, Arm vs. Intel builds or staged rollouts) to label-scoped hosts instead of splitting them across teams. When a host matches more than one package, the first-added package is installed.

Added support for editing existing configuration profiles (Apple .mobileconfig, Apple DDM declarations, Windows, and Android) in place via PATCH /api/v1/fleet/configuration_profiles/:profile_uuid.

Added custom host vitals: admins can define custom host fields, set their values per host manually or via the API, and reference them as $FLEET_HOST_VITAL_<id> variables in scripts and configuration profiles.

Added the ability to enforce a host naming template on macOS, iOS, and iPadOS hosts under Controls > OS settings > Host names, for a fleet or for "No team" (Fleet Premium).

Added POST /api/v1/fleet/host_name_template to set or clear the naming template (fleet_id omitted or 0 targets "No team"); an empty template clears it without renaming any host.

Added a name_template key under controls in GitOps for fleets and "No team", and included it in fleetctl generate-gitops output.

Added a "Host name" row with enforcement status (Enforcing, Verifying, Verified, Failed) to the host details OS settings modal, including a resend action via POST /api/v1/fleet/hosts/{id}/name_template/resend.

Added host name enforcement statuses to the Controls OS settings aggregate cards and the os_settings host filter.

Added the edited_host_name_template activity.

Added support for Python (.py) script-only software packages, which can be uploaded as custom packages (the file contents become the install script) and installed on macOS and Linux hosts, via the UI, REST API, and GitOps.

Added support for provisioning macOS users during setup and keeping passwords in sync with any OAUTH ROPG supporting IdP via the Fleet Desktop app on macOS 26+ hosts.

Added UI for configuring Apple account provisioning (FPSSO) in the integrations settings.

Enabled Microsoft Entra conditional access for self-hosted Fleet Premium instances (previously available only on Fleet Cloud). The microsoft_compliance_partner.proxy_api_key server configuration has been removed; the feature is now gated on the Fleet Premium license tier.

Added native Splunk HEC log destination for osquery status, result, and audit logs.

Added support for escrowing disk encryption recovery keys from Linux hosts that use TPM-backed full-disk encryption (e.g. Ubuntu 26). On these hosts, orbit escrows a dedicated Fleet-owned snapd recovery key silently, without prompting the end user for a passphrase.

Added FLEET_MDM_ENABLE_CUSTOM_DISK_ENCRYPTION (mdm.enable_custom_disk_encryption) as a cross-platform alias for FLEET_MDM_ENABLE_CUSTOM_FILEVAULT. When set, it allows both custom Apple MDM profiles for FileVault and custom Windows configuration profiles for BitLocker.

Enabled "Turn off MDM" button for offline macOS hosts. The unenroll command is now queued and delivered when the device comes back online, consistent with iOS/iPadOS behavior.

Added enrollment profile URL to the macOS tab in the "Add hosts" modal, with enrollment type selection (company-owned or personal/BYOD) for MDM users.

Added support for targeting declarations to the user channel on macOS.

Added the ability to handle DDM assets, and unblocked more declaration types.

Added the certificates list to the host details page for Windows hosts, showing each certificate's scope (System or User). This requires osquery 5.23.1 or higher on the host.

Added a "View certificate" modal to Controls > OS settings > Certificates so admins can inspect and copy an existing certificate's details.

Surfaced hardware-bound ACME certificates on macOS host vitals by retrieving them via the MDM CertificateList command when an ACME-bearing configuration profile is installed or re-installed.

Added "Targeted platforms" column and platform filter dropdown to the Policies page.

Added optional platform query parameter to GET /api/v1/fleet/policies and GET /api/v1/fleet/fleets/{id}/policies to filter policies by targeted platform.

Added public IP address to host search, so that searching by IP now matches both the primary (private) IP and the public IP.

Added Zorin OS as a recognized Linux platform. Hosts running Zorin OS now enroll with platform=zorin, appear in the Linux disk-encryption summary, support .deb software installs, can be targeted by label platform filters, and have CVEs matched against the underlying Ubuntu LTS OVAL feed (Zorin 16 → Ubuntu 20.04, 17 → 22.04, 18 → 24.04). Unknown future Zorin versions fall through to an unsupported platform string so vulnerability scanning is skipped rather than served stale data from an aging LTS feed.

Added support for CachyOS (an Arch-based Linux distribution) as a recognized Linux platform.

Added an "Operating systems" card to the dashboard when Linux or Android is selected.

Added installed version and available version columns to the self-service software table on the My device page.

Added the "Applications" / "Full inventory" software filter to the Fleet Desktop My device > Software tab for macOS hosts, matching the host details page.

Added the asynchronous live query endpoint (POST /api/v1/fleet/reports/run) to the API endpoints catalog so it can be granted to API-only users that have a restricted API endpoint allowlist.

Added audit activities when secret variables are created or updated through the PUT /api/latest/fleet/spec/secret_variables endpoint.

Security Engineers

Added vulnerability (CVE) reporting for Android OS versions on the Software > OS page, where Android previously showed as "Not supported."

Folded the Android security patch level into the host's OS version so Android versions read as "Android 16 (2026-05-01)", giving vulnerability-relevant granularity per patch level.

Updated CIS Benchmark policies for Windows 10 Enterprise to align with the CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 (added, removed, and updated policies per the v4.0.0 change history).

Added automatic renewal for SCEP and ACME certificates issued by external certificate authorities (Okta Conditional Access, Okta Verify, Hydrant ACME). Add $FLEET_VAR_CERTIFICATE_RENEWAL_ID to the certificate's Subject OU to enable.

Renamed $FLEET_VAR_SCEP_RENEWAL_ID to $FLEET_VAR_CERTIFICATE_RENEWAL_ID. The legacy name still works.

Enabled automatic renewal by default in Fleet's generated Conditional Access profile. Existing customers can opt in by redeploying the User scope profile.

Windows configuration profiles that use a Fleet-proxied SCEP certificate (custom SCEP proxy, NDES, or Smallstep) now report "Verified" only after Fleet observes the issued certificate on the host, instead of reporting "Verified" as soon as the host acknowledged the profile. They report "Failed" when the SCEP proxy request returns an upstream error, or when the certificate is still missing from the host an hour after delivery (once Fleet can confirm the certificate's store was readable).

Removed the validation, added in Fleet 4.89.0, that rejected custom SCEP proxy certificate authority challenges containing characters outside the ASN.1 PrintableString set (for example, an underscore). Apple devices can enroll certificates using such challenges, so they are accepted again. A fix for Windows certificate enrollment failing with these challenges will ship separately.

Rejected empty and whitespace-only enroll secrets when creating or updating teams.

Restricted SCIM endpoint access to global admin users only.

Removed the unused /api/mdm/microsoft/auth Windows MDM STS endpoint. Fleet always advertises the OnPremise auth policy, so no device ever contacted this endpoint. It now returns a 404. Windows MDM enrollment (Autopilot, Settings app, and fleetd-initiated) is unaffected.

Added a server_bypass_network_blocking server config option to allow disabling all outbound network blocking protections for integration HTTP requests in production, for environments where egress is already constrained by external infrastructure.

Bug fixes and improvements

Improved software ingestion performance by removing a full table scan of software_titles table.

Optimized memory usage of CVE chart cron job.

Reduced MySQL reader load when listing hosts with device_mapping=true and a search query by evaluating device mapping as a per-row correlated subquery instead of a fully-materialized derived-table join, and by skipping it entirely in the host count query.

Improved the performance of Windows MDM profile installation across large numbers of hosts by reducing database lock contention when recording command results.

Improved performance of Orbit config endpoint by batching extension label-membership checks into a single database query.

Improved performance of host config endpoint by caching scheduled query configuration.

Improved efficiency of the scheduled query stats aggregation cron job.

Added better indexing for the Get Next Apple MDM command query.

Added a long-lived immutable Cache-Control header to content-hashed static assets under /assets/ so browsers and CDNs can cache them across loads instead of refetching the JS/CSS bundle from origin every time.

Removed the fleetdm/bomutils Docker dependency for generating macOS .pkg fleetd installers; the Bill of Materials and xar archive are now written by pure-Go code, so fleetctl package --type pkg no longer requires Docker, mkbom, or xar.

Updated the Render deployment blueprint to use MySQL 8.0.44 (previously 8.0.24), fixing an "Error 1235 ... nesting of unions at the right-hand side" error on Render deployments.

Improved GitOps consistency by validating batch-applied Windows configuration profiles against the server's current MDM configuration state, while continuing to support previewing (dry run) a config that enables Windows MDM and applies profiles in a single run.

Added a check for duplicate patch policies when applying GitOps.

Added an error when fleet_maintained_app_slug is set on a non-patch policy in a GitOps yaml file.

Surfaced a more detailed error message in GitOps if user doesn't have server_private_key configured.

Improved error message when a mobileconfig profile contains unescaped special characters (e.g. &, <, ', >) that cause illegal base64 data errors during plist parsing.

Updated the invalid NDES admin credentials SCEP error message to point to the correct UI location (Settings > Integrations > Certificate enrollment).

Improved the Windows MDM enrollment server log for unsupported username and password (OnPremise) enrollment: a device that is not joined to Microsoft Entra ID now receives a clear server log message to join Microsoft Entra ID or enroll with fleetd.

Added anonymous usage statistics reporting the number of macOS and Windows hosts enrolled in Fleet's MDM.

Renamed "Create" buttons and links to "Add" across the Fleet UI for consistency.

Updated link styles in the UI.

Updated the 404 page with a new illustration and copy consistent with the rest of the app.

Updated the 500 and 403 error pages to match the design system and reuse the app navigation so the 500 page no longer shows broken image elements.

Improved the user menu to show individual settings sections for admins.

Updated Windows MDM end user experience radio button labels from Automatic/Manual to Fleet agent-driven/End user-driven to reduce confusion with MDM status terminology.

Updated relative "time ago" timestamps to show days instead of months when the timestamp is less than 90 days ago.

Updated the message shown when refetching a host's vitals takes longer than expected to reflect uncertainty rather than failure, on the host details page, the My device page, and the dashboard's "Welcome to Fleet" card.

Clarified the delayed host vitals refetch banner to reflect that a refetch was sent and the UI will update when the host responds.

Removed the default platform filter on the "hosts online" chart, so iOS, iPadOS, and Android hosts are now included by default alongside desktop platforms.

Removed the elevated white background container from the loading spinner for a flatter, more consistent look.

Removed the blue active-state background flash when clicking a row in a single-select data table (e.g., My device > Policies).

Updated missed ABM references to AB.

Hid the Self-service "Install all" button on the unfiltered "All" category so end users can't queue an install of the entire catalog in one click. The button still appears when a specific category is selected.

Hid self-service categories that have no available software from the category filter on the My device page, so users only see categories they can actually install from.

Added a "no custom SCEP CA configured" empty state to the certificates card.

Made form validation consistent across more forms (#40410 follow-up): validation errors now appear when leaving a field (on blur) and no longer appear before any input. This covers the policy automations "Other workflows" Destination URL, the add/edit user Email field, and the host status webhook Destination URL (both global settings and fleet settings).

Fixed recurring Redis MOVED errors and silently-dropped report result-count increments on Redis Cluster deployments by grouping query_results_count keys by hash slot before pipelining.

Fixed newly created or updated reports not appearing in the host details "Live report" modal or the reports list until a hard refresh.

Fixed an issue where an identity provider (IdP) user associated with multiple hosts only had IdP host vitals populated on one of them. All matching hosts are now linked when the SCIM/IdP user is created.

Fixed a bug where the Add software > App Store picker failed with an error for maintainer and technician roles because listing VPP tokens required admin access.

Fixed an issue where the tooltip size of "Require BitLocker PIN" was bigger than normal.

Fixed a bug where the DEP syncer could silently drop device enrollment events when interrupted mid-run (e.g. context cancelled). The sync cursor now only advances after device records are successfully written, ensuring affected devices are replayed on the next sync rather than lost.

Fixed high memory usage (and occasional osquery watchdog worker restarts) on macOS hosts running the software_macos detail query, caused by an unbounded recursive filesystem walk used to de-duplicate Homebrew casks against the apps table. The check now uses bounded, non-recursive globs matching the standard cask layout. This also fixes casks that ship no .app bundle (e.g. gcloud-cli) being incorrectly dropped from software inventory.

Fixed the "Missing hosts" summary card not showing on the Fleet Free dashboard when a platform other than "All" was selected.

Fixed an issue where ACME urls would throw a 500 error on malformed URLs.

Fixed macOS software titles being displayed with an embedded login-helper's name (e.g. "AmphetamineLoginHelper") instead of the parent app's name when the helper bundle shares a bundle identifier with the main app. Embedded .app bundles nested under Contents/ are now excluded at ingestion, and existing mis-named titles are renamed by a one-shot migration that recomputes the name from the title's sibling software rows.

Fixed long certificate names overflowing the delete certificate modal in Controls > OS settings > Certificates.

Fixed the policies and users tables intermittently reloading and clearing the current selection or resetting to the first page when the browser window regained focus.

Fixed a timeout when editing existing Windows configuration profiles for a large team via POST /api/latest/fleet/mdm/profiles/batch (GitOps). Now the request stays fast regardless of host count.

Fixed label membership being incorrectly cleared when a label's query errors out on a host (e.g. the extension socket is unavailable) instead of returning zero rows; existing membership is now left unchanged when a label query fails.

Fixed observers not seeing the "Show managed account" action on a macOS host's details page, even though the API already allows them to view the managed local account password.

Fixed an issue where the truncated vulnerabilities list in the Update details modal did not show a tooltip listing the remaining CVEs.

Fixed an incorrect error message where an msix file was parsed as an ipa file.

Fixed sorting of fleets for fleet-level users.

Fixed stale policy results inflating a host's failing policies count (shown in Fleet Desktop and the host's "Issues" column) after the policy no longer applied to the host (e.g. the host changed teams, or the policy's platform or label scope changed). Stale results are now cleaned up when the host reports its policy results.

Fixed missing hover state on buttons and dropdowns inside cards in dark mode.

Fixed the Policies page automations filter disappearing from the UI when switching to the "Unassigned" fleet and selecting a different automation type.

Fixed the SSO sign-on button text overflowing by using a fixed "Sign in with SSO" label and showing the configured IdP name in a tooltip.

Fixed an issue where premium MDM calls were being made on a Fleet Free license.

Fixed cron jobs getting stuck in "expired" when a run is interrupted mid-flight (e.g. during server shutdown); the run now records a terminal "canceled" status, preserving any job errors, instead of being left "pending" until reaped to "expired".

Fixed several styling issues on the end user enrollment page (BYOD info banner icon, active tab color, banner border, uneven QR code spacing) and added a "Learn more" link to the BYOD info banner. Also fixed enroll secret text incorrectly rendering in blue instead of black in the Add hosts modal.

Fixed error in re-enrollment to Fleet with EUA on Linux with a different e-mail than the one used in the first enrollment.

Fixed the vulnerability automations webhook "Destination URL" field to validate on blur (when the user clicks out of the field), consistent with other URL fields in Fleet, instead of only showing an error on save.

Fixed Google Translate extension causing a 500-page when running live reports.

Fixed a bug where some symbols changed height based on nearby characters in input fields.

Fixed the Add certificate modal (Controls > OS settings > Certificates) to only list custom SCEP CAs in the "Certificate authority (CA)" dropdown, matching the modal's help text.

Fixed an issue where tooltips for full name did not always show.

Fixed server-side paginated tables (e.g. policies) landing on an empty state after deleting the last row on a page. The table now navigates back to a page with data instead.

Fixed a server panic ("assignment to entry in nil map") when a host checked in for its osquery config while its agent options had a null config.

Fixed team write endpoints (modify team, modify team agent options, and create team) so that they no longer return plaintext enroll secrets to users who cannot read them (such as GitOps), and applied the same secret masking to the list teams response.

Fixed a bug where a custom Windows configuration profile/command could bypass Fleet's checks by using a scope-less LocURI.

Fixed vulnerability detection for Citrix Workspace on Windows by normalizing the software version (e.g. 25.7.1.6 to 2507.1.6) for Citrix Workspace entries whose name does not include the YYMM release, so the generated CPE matches NVD.

Fixed Citrix Workspace LTSR detection on Windows to include cumulative updates (e.g. 2203 LTSR CU4), so their vulnerabilities report the correct LTSR resolved_in_version (e.g. 2402 for CVE-2024-6286) instead of the Current Release version.

Fixed missing resolved_in_version for CVE-2025-63389 on Ollama (resolved in v0.12.4), which was absent because the NVD record only provides a versionEndIncluding constraint.

Fixed vulnerability detection for Python packages on Ubuntu/Debian devices by stripping the "python3-" name prefix during CPE matching.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

orbit-v1.58.0
fleet-desktop-v1.58.0 (included with Orbit)
osquery-5.23.1 (included with Orbit)
fleetd-chrome-v1.3.5
fleetd-android-v1.5.0

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

f70530247af40cdb7a240d5586a9c1403e0b950934f6f60e9d959c28380670fc fleet_v4.90.0_linux.tar.gz
72702a57e26c0440143592a248767d323d61a26a7f9e1f1250dbf6f94803c59a fleetctl_v4.90.0_linux_amd64.tar.gz
19b300688019fc13d3566aee1bb1f3d40d5a9287d5d83be17dd947201bd91bea fleetctl_v4.90.0_linux_amd64.zip
47d78cae6a424c821f1de93731c5fd33c29ad8e4d3eda5df3baaaf24416241c7 fleetctl_v4.90.0_linux_arm64.tar.gz
7fa247777fc5b9ccbec6aea1831c4375eb6e78e9e1f56ae29d86b7a17d59ef27 fleetctl_v4.90.0_linux_arm64.zip
02e171f89d8146c5f732b9f1b3569a9acbf874db89fff063d3cc82de9b5bcd6c fleetctl_v4.90.0_macos.tar.gz
95e89e3ca10b1f72946bfa11b5ba0b7fa591d896504916038299ec716df6d8b8 fleetctl_v4.90.0_macos.zip
7cd9a81227e1a3dda0fd717dc8eb9f23101fe50d18218287ff0cee32f52db53d fleetctl_v4.90.0_windows_amd64.tar.gz
886bc083dbb682777886df3246529fe88c2736b626cfbc85886153d2306e441f fleetctl_v4.90.0_windows_amd64.zip
a38f591c4fe1758e741bca9823f548dfb8700b2ca3b319ba3bfa35d77c3f72cf fleetctl_v4.90.0_windows_arm64.tar.gz
6e12b641986e98551b5c6ec689e45fa77599228a99ec06d2f52431035d5aceaa fleetctl_v4.90.0_windows_arm64.zip

Original source

Highlights

• Windows: custom BitLocker configuration profiles
• Android: OS versions and vulnerabilities on Software > OS
• Support for all DDM profiles and assets
• Custom host vitals for every platform
• Rename macOS, iOS, and iPadOS hosts
• macOS local account creation and password sync with any IdP
• Edit a configuration profile's labels or contents without deleting it
• Upload multiple custom packages for the same software title
• New log destination: Splunk

Windows: custom BitLocker configuration profiles

IT Admins can now upload a custom BitLocker configuration profile for Windows hosts, using FLEET_MDM_ENABLE_CUSTOM_DISK_ENCRYPTION server configuration option. This means Windows disk encryption can be customized beyond Fleet's built-in BitLocker controls, matching the flexibility already available for macOS.

Only self-managed users and customers can modify Fleet server configuration. If you're a managed-cloud customer, please reach out to Fleet about modifying the configuration.

For users that already have FLEET_MDM_ENABLE_CUSTOM_FILEVAULT enabled, no changes are necessary. Fleet just added a second, cross-platform name for this key.

GitHub issue: #43518

Android: OS versions and vulnerabilities

The Software > OS page now shows Android OS versions and their known vulnerabilities alongside every other platform Fleet tracks. Security Engineers get one place to see OS-level exposure across a fleet that includes personally-owned (BYOD) Android hosts, with the Android security update version formatted as a date (for example, 2026-07-01) for easier tracking against Google's monthly security bulletins.

GitHub issue: #35075

Support for all DDM profiles and assets

Fleet now supports uploading any Apple declarative device management (DDM) configuration or asset, for both the device and user channel. IT Admins can deploy DDM profiles like the Safari extensions settings declaration and reference DDM assets from those profiles. This way, anytime Apple ships new DDM features, IT Admins can use them on day one.

GitHub issue: #38986

Custom host vitals for every platform

IT Admins can now define custom host vitals, like an asset tag or warranty expiration, for all platforms (macOS, Windows, Linux, iOS/iPadOS, and Android). Custom vitals appear on the Host details page and can be used to create labels and as variables in scripts and configuration profiles, so values from another system can drive automation everywhere in your fleet. Learn more.

GitHub issue: #44954

Rename macOS, iOS, and iPadOS hosts

IT Admins can now set a host name template on the Controls page for a fleet that applies to macOS, iOS, and iPadOS hosts. This gives every Apple host a standard naming convention, often including its serial number, without having to build a custom automation that sends an MDM rename command to each host. Learn how.

GitHub issue: #38806

macOS local account creation and password sync with any IdP

During automated (ADE) enrollment, Fleet can now create the end user's macOS local account and keep its password in sync with any identity provider that supports OAuth Resource Owner Password Grant (ROPG) (e.g. Okta). End users get one password, meeting your organization's requirements, to unlock their Mac, their keychain, and third-party tools. Learn more.

The Fleet Desktop app is required for local account creation and password sync. Add the app from the Fleet-maintained catalog and configure it to install during new Mac setup. Learn how.

GitHub issue: #45524

Edit a configuration profile's labels or contents without deleting it

IT Admins can now edit a configuration profile. This includes the profile's labels (switching between include any, include all, and exclude any) or its contents directly from Controls > OS settings > Configuration profiles, without deleting and re-uploading it. This works across macOS, Windows, and Android profiles, and it makes staged rollouts easier since editing a profile no longer requires removing the older version from the hosts that already have it.

GitHub issue: #38869

Upload multiple custom packages for the same software title

IT Admins can now upload up to 10 custom packages for the same software title in the same fleet. This makes it possible to deploy different versions or architectures, like Arm versus Intel builds, or run staged rollouts, using labels to target the right package instead of maintaining separate fleets for each variant.

GitHub issue: #28108

New log destination: Splunk

Fleet can now send reports and other osquery logs directly to Splunk, without setting up Firehose as a middleman first. Learn how to send reports directly to Splunk.

GitHub issue: #26333

Changes

IT Admins

• Added the ability to upload multiple custom packages (up to 10) for the same software title on a team, so IT admins can deploy different versions or architectures (for example, Arm vs. Intel builds or staged rollouts) to label-scoped hosts instead of splitting them across teams. When a host matches more than one package, the first-added package is installed.
• Added support for editing existing configuration profiles (Apple .mobileconfig, Apple DDM declarations, Windows, and Android) in place via PATCH /api/v1/fleet/configuration_profiles/:profile_uuid.
• Added custom host vitals: admins can define custom host fields, set their values per host manually or via the API, and reference them as $FLEET_HOST_VITAL_ variables in scripts and configuration profiles.
• Added the ability to enforce a host naming template on macOS, iOS, and iPadOS hosts under Controls > OS settings > Host names, for a fleet or for "No team" (Fleet Premium).
• Added POST /api/v1/fleet/host_name_template to set or clear the naming template (fleet_id omitted or 0 targets "No team"); an empty template clears it without renaming any host.
• Added a name_template key under controls in GitOps for fleets and "No team", and included it in fleetctl generate-gitops output.
• Added a "Host name" row with enforcement status (Enforcing, Verifying, Verified, Failed) to the host details OS settings modal, including a resend action via POST /api/v1/fleet/hosts/{id}/name_template/resend.
• Added host name enforcement statuses to the Controls OS settings aggregate cards and the os_settings host filter.
• Added the edited_host_name_template activity.
• Added support for Python (.py) script-only software packages, which can be uploaded as custom packages (the file contents become the install script) and installed on macOS and Linux hosts, via the UI, REST API, and GitOps.
• Added support for provisioning macOS users during setup and keeping passwords in sync with any OAUTH ROPG supporting IdP via the Fleet Desktop app on macOS 26+ hosts.
• Added UI for configuring Apple account provisioning (FPSSO) in the integrations settings.
• Enabled Microsoft Entra conditional access for self-hosted Fleet Premium instances (previously available only on Fleet Cloud). The microsoft_compliance_partner.proxy_api_key server configuration has been removed; the feature is now gated on the Fleet Premium license tier.
• Added native Splunk HEC log destination for osquery status, result, and audit logs.
• Added support for escrowing disk encryption recovery keys from Linux hosts that use TPM-backed full-disk encryption (e.g. Ubuntu 26). On these hosts, orbit escrows a dedicated Fleet-owned snapd recovery key silently, without prompting the end user for a passphrase.
• Added FLEET_MDM_ENABLE_CUSTOM_DISK_ENCRYPTION (mdm.enable_custom_disk_encryption) as a cross-platform alias for FLEET_MDM_ENABLE_CUSTOM_FILEVAULT. When set, it allows both custom Apple MDM profiles for FileVault and custom Windows configuration profiles for BitLocker.
• Enabled "Turn off MDM" button for offline macOS hosts. The unenroll command is now queued and delivered when the device comes back online, consistent with iOS/iPadOS behavior.
• Added enrollment profile URL to the macOS tab in the "Add hosts" modal, with enrollment type selection (company-owned or personal/BYOD) for MDM users.
• Added support for targeting declarations to the user channel on macOS.
• Added the ability to handle DDM assets, and unblocked more declaration types.
• Added the certificates list to the host details page for Windows hosts, showing each certificate's scope (System or User). This requires osquery 5.23.1 or higher on the host.
• Added a "View certificate" modal to Controls > OS settings > Certificates so admins can inspect and copy an existing certificate's details.
• Surfaced hardware-bound ACME certificates on macOS host vitals by retrieving them via the MDM CertificateList command when an ACME-bearing configuration profile is installed or re-installed.
• Added "Targeted platforms" column and platform filter dropdown to the Policies page.
• Added optional platform query parameter to GET /api/v1/fleet/policies and GET /api/v1/fleet/fleets/{id}/policies to filter policies by targeted platform.
• Added public IP address to host search, so that searching by IP now matches both the primary (private) IP and the public IP.
• Added Zorin OS as a recognized Linux platform. Hosts running Zorin OS now enroll with platform=zorin, appear in the Linux disk-encryption summary, support .deb software installs, can be targeted by label platform filters, and have CVEs matched against the underlying Ubuntu LTS OVAL feed (Zorin 16 → Ubuntu 20.04, 17 → 22.04, 18 → 24.04). Unknown future Zorin versions fall through to an unsupported platform string so vulnerability scanning is skipped rather than served stale data from an aging LTS feed.
• Added support for CachyOS (an Arch-based Linux distribution) as a recognized Linux platform.
• Added an "Operating systems" card to the dashboard when Linux or Android is selected.
• Added installed version and available version columns to the self-service software table on the My device page.
• Added the "Applications" / "Full inventory" software filter to the Fleet Desktop My device > Software tab for macOS hosts, matching the host details page.
• Added the asynchronous live query endpoint (POST /api/v1/fleet/reports/run) to the API endpoints catalog so it can be granted to API-only users that have a restricted API endpoint allowlist.
• Added audit activities when secret variables are created or updated through the PUT /api/latest/fleet/spec/secret_variables endpoint.

Security Engineers

• Added vulnerability (CVE) reporting for Android OS versions on the Software > OS page, where Android previously showed as "Not supported."
• Folded the Android security patch level into the host's OS version so Android versions read as "Android 16 (2026-05-01)", giving vulnerability-relevant granularity per patch level.
• Updated CIS Benchmark policies for Windows 10 Enterprise to align with the CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 (added, removed, and updated policies per the v4.0.0 change history).
• Added automatic renewal for SCEP and ACME certificates issued by external certificate authorities (Okta Conditional Access, Okta Verify, Hydrant ACME). Add $FLEET_VAR_CERTIFICATE_RENEWAL_ID to the certificate's Subject OU to enable.
• Renamed $FLEET_VAR_SCEP_RENEWAL_ID to $FLEET_VAR_CERTIFICATE_RENEWAL_ID. The legacy name still works.
• Enabled automatic renewal by default in Fleet's generated Conditional Access profile. Existing customers can opt in by redeploying the User scope profile.
• Windows configuration profiles that use a Fleet-proxied SCEP certificate (custom SCEP proxy, NDES, or Smallstep) now report "Verified" only after Fleet observes the issued certificate on the host, instead of reporting "Verified" as soon as the host acknowledged the profile. They report "Failed" when the SCEP proxy request returns an upstream error, or when the certificate is still missing from the host an hour after delivery (once Fleet can confirm the certificate's store was readable).
• Removed the validation, added in Fleet 4.89.0, that rejected custom SCEP proxy certificate authority challenges containing characters outside the ASN.1 PrintableString set (for example, an underscore). Apple devices can enroll certificates using such challenges, so they are accepted again. A fix for Windows certificate enrollment failing with these challenges will ship separately.
• Rejected empty and whitespace-only enroll secrets when creating or updating teams.
• Restricted SCIM endpoint access to global admin users only.
• Removed the unused /api/mdm/microsoft/auth Windows MDM STS endpoint. Fleet always advertises the OnPremise auth policy, so no device ever contacted this endpoint. It now returns a 404. Windows MDM enrollment (Autopilot, Settings app, and fleetd-initiated) is unaffected.
• Added a server_bypass_network_blocking server config option to allow disabling all outbound network blocking protections for integration HTTP requests in production, for environments where egress is already constrained by external infrastructure.

Bug fixes and improvements

• Improved software ingestion performance by removing a full table scan of software_titles table.
• Optimized memory usage of CVE chart cron job.
• Reduced MySQL reader load when listing hosts with device_mapping=true and a search query by evaluating device mapping as a per-row correlated subquery instead of a fully-materialized derived-table join, and by skipping it entirely in the host count query.
• Improved the performance of Windows MDM profile installation across large numbers of hosts by reducing database lock contention when recording command results.
• Improved performance of Orbit config endpoint by batching extension label-membership checks into a single database query.
• Improved performance of host config endpoint by caching scheduled query configuration.
• Improved efficiency of the scheduled query stats aggregation cron job.
• Added better indexing for the Get Next Apple MDM command query.
• Added a long-lived immutable Cache-Control header to content-hashed static assets under /assets/ so browsers and CDNs can cache them across loads instead of refetching the JS/CSS bundle from origin every time.
• Removed the fleetdm/bomutils Docker dependency for generating macOS .pkg fleetd installers; the Bill of Materials and xar archive are now written by pure-Go code, so fleetctl package --type pkg no longer requires Docker, mkbom, or xar.
• Updated the Render deployment blueprint to use MySQL 8.0.44 (previously 8.0.24), fixing an "Error 1235 ... nesting of unions at the right-hand side" error on Render deployments.
• Improved GitOps consistency by validating batch-applied Windows configuration profiles against the server's current MDM configuration state, while continuing to support previewing (dry run) a config that enables Windows MDM and applies profiles in a single run.
• Added a check for duplicate patch policies when applying GitOps.
• Added an error when fleet_maintained_app_slug is set on a non-patch policy in a GitOps yaml file.
• Surfaced a more detailed error message in GitOps if user doesn't have server_private_key configured.
• Improved error message when a mobileconfig profile contains unescaped special characters (e.g. &, <, ', >) that cause illegal base64 data errors during plist parsing.
• Updated the invalid NDES admin credentials SCEP error message to point to the correct UI location (Settings > Integrations > Certificate enrollment).
• Improved the Windows MDM enrollment server log for unsupported username and password (OnPremise) enrollment: a device that is not joined to Microsoft Entra ID now receives a clear server log message to join Microsoft Entra ID or enroll with fleetd.
• Added anonymous usage statistics reporting the number of macOS and Windows hosts enrolled in Fleet's MDM.
• Renamed "Create" buttons and links to "Add" across the Fleet UI for consistency.
• Updated link styles in the UI.
• Updated the 404 page with a new illustration and copy consistent with the rest of the app.
• Updated the 500 and 403 error pages to match the design system and reuse the app navigation so the 500 page no longer shows broken image elements.
• Improved the user menu to show individual settings sections for admins.
• Updated Windows MDM end user experience radio button labels from Automatic/Manual to Fleet agent-driven/End user-driven to reduce confusion with MDM status terminology.
• Updated relative "time ago" timestamps to show days instead of months when the timestamp is less than 90 days ago.
• Updated the message shown when refetching a host's vitals takes longer than expected to reflect uncertainty rather than failure, on the host details page, the My device page, and the dashboard's "Welcome to Fleet" card.
• Clarified the delayed host vitals refetch banner to reflect that a refetch was sent and the UI will update when the host responds.
• Removed the default platform filter on the "hosts online" chart, so iOS, iPadOS, and Android hosts are now included by default alongside desktop platforms.
• Removed the elevated white background container from the loading spinner for a flatter, more consistent look.
• Removed the blue active-state background flash when clicking a row in a single-select data table (e.g., My device > Policies).
• Updated missed ABM references to AB.
• Hid the Self-service "Install all" button on the unfiltered "All" category so end users can't queue an install of the entire catalog in one click. The button still appears when a specific category is selected.
• Hid self-service categories that have no available software from the category filter on the My device page, so users only see categories they can actually install from.
• Added a "no custom SCEP CA configured" empty state to the certificates card.
• Made form validation consistent across more forms (#40410 follow-up): validation errors now appear when leaving a field (on blur) and no longer appear before any input. This covers the policy automations "Other workflows" Destination URL, the add/edit user Email field, and the host status webhook Destination URL (both global settings and fleet settings).
• Fixed recurring Redis MOVED errors and silently-dropped report result-count increments on Redis Cluster deployments by grouping query_results_count keys by hash slot before pipelining.
• Fixed newly created or updated reports not appearing in the host details "Live report" modal or the reports list until a hard refresh.
• Fixed an issue where an identity provider (IdP) user associated with multiple hosts only had IdP host vitals populated on one of them. All matching hosts are now linked when the SCIM/IdP user is created.
• Fixed a bug where the Add software > App Store picker failed with an error for maintainer and technician roles because listing VPP tokens required admin access.
• Fixed an issue where the tooltip size of "Require BitLocker PIN" was bigger than normal.
• Fixed a bug where the DEP syncer could silently drop device enrollment events when interrupted mid-run (e.g. context cancelled). The sync cursor now only advances after device records are successfully written, ensuring affected devices are replayed on the next sync rather than lost.
• Fixed high memory usage (and occasional osquery watchdog worker restarts) on macOS hosts running the software_macos detail query, caused by an unbounded recursive filesystem walk used to de-duplicate Homebrew casks against the apps table. The check now uses bounded, non-recursive globs matching the standard cask layout. This also fixes casks that ship no .app bundle (e.g. gcloud-cli) being incorrectly dropped from software inventory.
• Fixed the "Missing hosts" summary card not showing on the Fleet Free dashboard when a platform other than "All" was selected.
• Fixed an issue where ACME urls would throw a 500 error on malformed URLs.
• Fixed macOS software titles being displayed with an embedded login-helper's name (e.g. "AmphetamineLoginHelper") instead of the parent app's name when the helper bundle shares a bundle identifier with the main app. Embedded .app bundles nested under Contents/ are now excluded at ingestion, and existing mis-named titles are renamed by a one-shot migration that recomputes the name from the title's sibling software rows.
• Fixed long certificate names overflowing the delete certificate modal in Controls > OS settings > Certificates.
• Fixed the policies and users tables intermittently reloading and clearing the current selection or resetting to the first page when the browser window regained focus.
• Fixed a timeout when editing existing Windows configuration profiles for a large team via POST /api/latest/fleet/mdm/profiles/batch (GitOps). Now the request stays fast regardless of host count.
• Fixed label membership being incorrectly cleared when a label's query errors out on a host (e.g. the extension socket is unavailable) instead of returning zero rows; existing membership is now left unchanged when a label query fails.
• Fixed observers not seeing the "Show managed account" action on a macOS host's details page, even though the API already allows them to view the managed local account password.
• Fixed an issue where the truncated vulnerabilities list in the Update details modal did not show a tooltip listing the remaining CVEs.
• Fixed an incorrect error message where an msix file was parsed as an ipa file.
• Fixed sorting of fleets for fleet-level users.
• Fixed stale policy results inflating a host's failing policies count (shown in Fleet Desktop and the host's "Issues" column) after the policy no longer applied to the host (e.g. the host changed teams, or the policy's platform or label scope changed). Stale results are now cleaned up when the host reports its policy results.
• Fixed missing hover state on buttons and dropdowns inside cards in dark mode.
• Fixed the Policies page automations filter disappearing from the UI when switching to the "Unassigned" fleet and selecting a different automation type.
• Fixed the SSO sign-on button text overflowing by using a fixed "Sign in with SSO" label and showing the configured IdP name in a tooltip.
• Fixed an issue where premium MDM calls were being made on a Fleet Free license.
• Fixed cron jobs getting stuck in "expired" when a run is interrupted mid-flight (e.g. during server shutdown); the run now records a terminal "canceled" status, preserving any job errors, instead of being left "pending" until reaped to "expired".
• Fixed several styling issues on the end user enrollment page (BYOD info banner icon, active tab color, banner border, uneven QR code spacing) and added a "Learn more" link to the BYOD info banner. Also fixed enroll secret text incorrectly rendering in blue instead of black in the Add hosts modal.
• Fixed error in re-enrollment to Fleet with EUA on Linux with a different e-mail than the one used in the first enrollment.
• Fixed the vulnerability automations webhook "Destination URL" field to validate on blur (when the user clicks out of the field), consistent with other URL fields in Fleet, instead of only showing an error on save.
• Fixed Google Translate extension causing a 500-page when running live reports.
• Fixed a bug where some symbols changed height based on nearby characters in input fields.
• Fixed the Add certificate modal (Controls > OS settings > Certificates) to only list custom SCEP CAs in the "Certificate authority (CA)" dropdown, matching the modal's help text.
• Fixed an issue where tooltips for full name did not always show.
• Fixed server-side paginated tables (e.g. policies) landing on an empty state after deleting the last row on a page. The table now navigates back to a page with data instead.
• Fixed a server panic ("assignment to entry in nil map") when a host checked in for its osquery config while its agent options had a null config.
• Fixed team write endpoints (modify team, modify team agent options, and create team) so that they no longer return plaintext enroll secrets to users who cannot read them (such as GitOps), and applied the same secret masking to the list teams response.
• Fixed a bug where a custom Windows configuration profile/command could bypass Fleet's checks by using a scope-less LocURI.
• Fixed vulnerability detection for Citrix Workspace on Windows by normalizing the software version (e.g. 25.7.1.6 to 2507.1.6) for Citrix Workspace entries whose name does not include the YYMM release, so the generated CPE matches NVD.
• Fixed Citrix Workspace LTSR detection on Windows to include cumulative updates (e.g. 2203 LTSR CU4), so their vulnerabilities report the correct LTSR resolved_in_version (e.g. 2402 for CVE-2024-6286) instead of the Current Release version.
• Fixed missing resolved_in_version for CVE-2025-63389 on Ollama (resolved in v0.12.4), which was absent because the NVD record only provides a versionEndIncluding constraint.
• Fixed vulnerability detection for Python packages on Ubuntu/Debian devices by stripping the "python3-" name prefix during CPE matching.

Ready to upgrade?

Visit our Upgrade guide in the Fleet docs to update to Fleet 4.90.0.

Original source

Bug fixes

Fixed a bug where a failed software install was reported as successfully installed when the install script exited with an error but a post-install script exited successfully.

Fixed Windows Autopilot enrollments intermittently hanging on the Enrollment Status Page at "Account setup".

Fixed an issue where devices given a mandatory update during ADE enrollment might display a failure or fail to display the update

Fixed a bug where adding Windows software via GitOps could create a duplicate software title when a host had already reported the same program.

Fixed a bug where Apple MDM devices re-enrolling manually with a pending SCEP renewal would not be treated as a new renewal and might skip apps, profiles, etc

Fixed a bug where a Fleet-maintained app install could run a stale, previously-cached version after the app was auto-updated; installs (including automatic retries) now target the version Fleet currently displays.

Fixed a bug where pinning a Fleet-maintained app to a different version didn't update the patch policy for it.

Upgrading

Please note this upgrade has an elevated migration time for a one time table rebuild that could take up to 30m

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

6939f39a5a3290e9254b8dd030e48ebe34eb1ca757f84c252116cece082a2bb7 fleet_v4.89.2_linux.tar.gz
a60f0bdef6940a97500f589221c037400ae2827ffecadd86a6de9185a6366306 fleetctl_v4.89.2_linux_amd64.tar.gz
7753dbdca016bb68d5f2b8975902c8f1dc3677ad3aa33a8d6421bdaac6123202 fleetctl_v4.89.2_linux_amd64.zip
d7e463a015beb0c22818b96284bcef017737fa3b1a2a5b983af22c37638d1e10 fleetctl_v4.89.2_linux_arm64.tar.gz
2d4e9e3099ef5d7986771c8050175d7f5110020646b41df91d13f4e62b556a77 fleetctl_v4.89.2_linux_arm64.zip
38222bb2a5cb010e3de1337e6cd500a4d8773f68da1f74696850ed4ec1b18270 fleetctl_v4.89.2_macos.tar.gz
2b458368f444f8b352a42afd3b16e37085a9bcc6262800523e0d6c0337805644 fleetctl_v4.89.2_macos.zip
aa5d5083b94cc0bf166e70a01a62604f1a48554a2dfd2d88f4c7d09f0db2d904 fleetctl_v4.89.2_windows_amd64.tar.gz
89fb65ea511a49b85331ee74b1b1acc029750f85eb1972115c5fbbe23c65a775 fleetctl_v4.89.2_windows_amd64.zip
a36936f41280ff13c8c2364254b57d2fb08f6888626cd01e1e700c429d55d37d fleetctl_v4.89.2_windows_arm64.tar.gz
9d5ac115c810d8a9db30254e3bfb1362e5549a21c27114217032d224c3947a73 fleetctl_v4.89.2_windows_arm64.zip

Original source

Related issue: Resolves #45524

Checklist for submitter

If some of the following don't apply, delete the relevant line.

No changes file as this is purely workflow/release changes

Testing

Will be testing this on github as that's the only way and since this
requires testing with a tagged build I'll have to merge to main, tag,
then manually trigger

QA'd all new/changed functionality manually

Summary by CodeRabbit

Summary by CodeRabbit

New Features

Introduced an automated macOS Fleet Desktop release workflow for
version-tagged releases.

Publishes the installer plus accompanying meta.json download
metadata, including SHA256 checksums.

Bug Fixes

Added stronger pre-release validation (tag/version match and immutable
release enforcement).

Verifies the downloaded package and metadata against the expected
SHA256 to ensure the published artifacts are consistent.

Co-authored-by: Copilot Autofix powered by AI [email protected]

Original source

Bug fixes

Fixed a bug where fresh Windows 11 25H2 (and other recent builds) failed MDM enrollment with error 80180006 because the device's discovery RequestVersion (e.g. "9.0") was rejected by an exact-match allow-list. Fleet now accepts any MS-MDE2 discovery RequestVersion at or above the minimum supported version ("4.0").

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

72fb53b632048d94a475082050a3fb9ee147c120b90b4bd03407668b0643eb2f fleet_v4.89.1_linux.tar.gz
5fdccf39237db3c96fa69468539e22c2cd69cfff5a4b147fdbcb5ca22ea1f2be fleetctl_v4.89.1_linux_amd64.tar.gz
7a2316437e9183cfaf1b18047df6245e8a88b338f8879fbe2ebaf06a39a00cda fleetctl_v4.89.1_linux_amd64.zip
ff6e4225004fb2db43d5f1f178ea780d82db0925258015a67379d52056aed092 fleetctl_v4.89.1_linux_arm64.tar.gz
62617b3fec54ccf4d458b1f69ab0d82b91299594e802c9d27f5e3ce61789d5f2 fleetctl_v4.89.1_linux_arm64.zip
a13f88800e59792af3480feb1ac0e6fe4f63775e87f237b5a47264a5e05f85e6 fleetctl_v4.89.1_macos.tar.gz
faee6f1383eb9c745c8d225e2d8972b5c51c89b86db68da14e1cc84c641722ba fleetctl_v4.89.1_macos.zip
e57afa95adbb86592495583fb61f6669d40629dd8ee16aebce426ab3443580c2 fleetctl_v4.89.1_windows_amd64.tar.gz
1d9a5a250d5367a8252a3eefc016c3d83edfb5a1ef795809a215f6ad84df5948 fleetctl_v4.89.1_windows_amd64.zip
39d7a5b4fe7533cb696bb6de6da42928801f96315bb98719d9225add5d650263 fleetctl_v4.89.1_windows_arm64.tar.gz
df97595ce284ccb1ff86e27644ad337ed34af17b12350cefd12a0d4654ec7eb4 fleetctl_v4.89.1_windows_arm64.zip

Original source

Fleet 4.89.0 (Jul 15, 2026)

IT Admins

Added the ability to target a policy to hosts using a combination of "include" and "exclude" labels.

Added the ability to run a policy check before installing Windows and Linux setup experience software. When a team policy's install-software automation points at a setup experience installer, Fleet runs that policy during setup and skips the install when it passes (the software is already installed and up to date), speeding up the end user setup experience. When the policy fails, the software is installed as part of setup experience.

Changed calendar remediation events to be scheduled on the next business day (skipping weekends) after a policy failure, instead of always being scheduled on the next Tuesday.

Updated policy details page to show automations and labels as a single property. Also changed the layout of policy properties.

Added automation runs table to the policy details page, showing per-host automation outcomes with filtering, search, and a reset policy action.

Added per-host activity log entries when policy automations (webhook, tickets, Google Calendar, and Microsoft conditional access) fail or succeed.

Added POST /api/v1/fleet/policies/:policy_id/reset endpoint to reset a policy's pass/fail results, clearing counts and membership immediately.

Added GET /api/v1/fleet/policies/:id/automation_activities endpoint to list automation activities for a policy.

Added the ability to keep Fleet-maintained apps automatically updated to the latest version, pin them to a specific version or major version, or roll back to a previously cached version, from the UI and via GitOps (Fleet Premium).

Surfaced .sh script-only software packages on the macOS tab of Controls > Setup experience > Install software, with selections tracked independently from the Linux tab.

Added setup_experience_platform on software packages in GitOps YAML so .sh script-only installers can be selected for the macOS setup experience declaratively, matching the per-platform UI selection. The value is authoritative on every batch apply and reconciles the cross-platform selection table.

Added support for pre-install query, post-install script, and uninstall script on script-only packages (.sh and .ps1) via the UI, REST API, and GitOps.

Added an error on the Windows enrollment status page (ESP) when setup experience software fails to install during automatic enrollment (Autopilot and other OOBE flows) and "Cancel setup if software fails" is turned off.

Added "🛟 Support" as a new default self-service software category.

Added support for $FLEET_VAR_HOST_* variables in Android configuration profiles.

Added support for $FLEET_VAR_HOST_* variables in Android managed app configuration.

Android certificate templates and managed app configurations are now automatically resent when IdP variable values change.

Added support for defining the default fleet BYO Apple devices enroll into.

Added a Google Workspace integration that maps identity provider (IdP) users to hosts, populating IdP host vitals directly from your Google Workspace directory.

Added an activity feed entry when a user runs a custom Apple or Windows MDM command, visible in both the global activity feed and the host's activity feed.

Added an activity when editing the managed local account setting using the update fleet endpoint or GitOps.

Enabled tracking of mobile devices for the "hosts online" chart, and added default filtering to that chart that excludes mobile platforms.

Added tooltips on the Settings > Users and My account pages to show assigned fleets and roles when a user has multiple.

Security Engineers

Started collecting non-critical CVEs, filtering them out of charts by default.

Added the ability to filter vulnerable software by severity (CVSS score) and known exploit status on the Fleet Desktop My device > Software tab (Fleet Premium). The corresponding min_cvss_score, max_cvss_score, and exploit query parameters were added to the GET /device/{token}/software API endpoint.

Added more filtering options for the Vulnerability Exposure chart.

Added ability to set default Vulnerability Exposure chart filters via GitOps.

Improved certificate renewal validation in the host identity SCEP service.

Added support for all IdP variables and host platform in certificate template subject names and SANs.

Improved input validation for conditional access SCEP enrollment.

Validated that a custom SCEP proxy certificate authority challenge contains only printable characters, so Windows certificate enrollment no longer fails with "The string contains a non-printable character" (for example, when the challenge contains an underscore). Existing challenges are only re-validated when changed.

Restricted authorization for team membership management operations.

Made authorization more robust when creating labels from manual hosts.

Improved fleet scope validation for software title lookups.

Restricted authorization for conditional access Okta IdP asset endpoints so that observer and observer+ roles can no longer read them.

Improved session handling during password reset flows.

Cleared the SSO authentication cookie after successful authentication for fully-managed Android enrollment.

Added private network IP blocking to Fleet's HTTP client. Loopback and cloud metadata addresses (127.0.0.0/8, 169.254.0.0/16) are always blocked. RFC 1918 and other private ranges are blocked by default; use --allow_private_network_integrations to allow them for environments with on-prem integrations (e.g. EJBCA, Jira, SCEP servers on private networks).

Added the s3.carves_cleanup_disabled server setting to skip S3 file carve reconciliation for deployments that rely solely on the bucket's lifecycle policy to remove carve objects.

Added the s3.carves_cleanup_max_per_run and s3.carves_cleanup_concurrency server settings to tune how many carves the S3 cleanup reconciles per run and how many concurrent S3 requests it makes.

Updated the SigNoz OTEL dashboards under tools/signoz/ to template and filter on the deployment.environment resource attribute, with the environment variable defaulting to default, so multiple Fleet environments reporting to the same SigNoz backend can be scoped per environment.

Bug fixes and improvements

Updated Go to 1.26.5.

Updated checkbox labels in the Fleet UI to use positive language, making it clearer what each setting enables rather than what it disables.

Improved Windows MDM configuration profile performance. Changes to Windows profiles now reach hosts more quickly. Large changes that affect many hosts at once, such as adding or removing profiles across a team or transferring many hosts between teams, now finish faster and put significantly less load on Fleet's database, keeping the server responsive at scale.

Improved validation on batch script executions.

Updated golang.org/x/image to v0.42.0 to resolve CVE-2026-33813 (WebP decoder denial of service on 32-bit platforms).

Redesigned in-app success and error notifications as toasts. Error notifications now persist until dismissed and can be expanded to show the server's raw response.

Added configurable batch size FLEET_MDM_ANDROID_BATCH_SIZE (default: 1000 hosts) for Android MDM operations to prevent overwhelming the Google Android Management API.

Added batching and staggered scheduling for Android software installation jobs to spread AMAPI load across multiple worker ticks.

Improved the error message shown when saving a custom variable without the required server private key configured.

Improved software tooltips on the host details page to display the human-friendly software name and correct action labels for scripts.

Improved orbit check-in performance by deriving the Fleet MDM connection state from existing host MDM data instead of running a separate 3-table JOIN query on every check-in for every host.

Improved fleetctl to detect when SSO is enabled on the Fleet server and display a helpful message directing users to authenticate using an API token instead of email and password.

Refactored makeAndroidAppAvailable to use staggered job queuing instead of sleeping between batches inside a single worker job.

Updated the checkerboard graph to make it clearer which square represents the current time and which squares are in the future.

Windows configuration profiles are now queued immediately when a host enrolls in Windows MDM, instead of waiting for the next profile reconciliation cron pass.

Improved query validation logic around policy creation.

Updated the "installed during setup" tooltip on Controls > Setup experience > Install software to clarify that installation order depends on software name (0-9, then A-Z), and that software without a policy is installed before software with a policy.

Navigate back to the report details page after saving changes to a report.

Enabled automatic refreshing of report results when the window is refocused and every 5 seconds while waiting for results to arrive (skipped when report caching is disabled).

Reduced database write pressure on the Windows MDM check-in path by gzip-compressing stored device response envelopes.

Updated the Fleet-maintained apps item count to reflect the total number of apps, counting an app's macOS and Windows versions separately (for example, a search for "Zoom" that returns Zoom and Zoom Rooms on both platforms shows 4 items).

Moved and updated tooltip from the Vulnerabilities column on the Software > OS page to "Not supported", explaining which platforms support vulnerability detection.

Improved some GitOps error messages around bootstrap packages, setup assistant and scripts.

Fixed fleet-scoped context when retrieving a list of users in a fleet.

Fixed an issue where cleanup of expired file carves stored in S3 could stall on buckets containing a large number of objects, which prevented other scheduled cleanup and aggregation tasks from running.

Fixed the MDM command details modal showing a generic error, instead of a clear message, for a command sent to a host that was later wiped and re-enrolled.

Fixed SAML SSO callback URLs (both login and MDM end user authentication) duplicating the subpath when Fleet is deployed under a URL prefix, which broke authentication. The callback URL is now built so the subpath appears exactly once whether or not the server URL was configured with the prefix.

Fixed the My device > Self-service page briefly showing the "Update" button again on apps that had just finished updating, instead of holding the "Updated" state while the software inventory refreshes.

Fixed a bug where selecting a policy on the host details or self-service policies page reset the list back to the first page.

Fixed a 500 error when a host reported a software install result for a deleted software installer. When an installer is deleted, records of its pending installations will be set to canceled instead of completely deleted.

Fixed Copied! confirmation badges showing the wrong border color and clipping in dark mode.

Fixed installers, VPP apps, and in-house apps sometimes missing from a host's software details page when more than one install or uninstall was queued for the same item.

Fixed a server panic when validating a Windows configuration profile that mixes SCEP and non-SCEP <LocURI> elements with a non-SCEP element first. The profile is now rejected with a clear validation error.

Fixed a bug where selected hosts could not be removed (the "X" did nothing) on the live report target selection screen.

Fixed a bug where if a script-only package was provided with spaces in the path name in a GitOps run, it would fail validation.

Fixed the GitOps mode tooltip on disabled settings fields so it points at the field's label instead of the center of the label, input, and help text.

Fixed the dashboard "Hosts enrolled" chart showing an incorrect platform percentage breakdown.

Fixed Windows MDM not re-installing fleetd on a wiped or re-imaged device that re-enrolls through Autopilot/Entra (OOBE). The server previously treated stale host orbit info as proof fleetd was present and skipped the install, leaving the device MDM-enrolled but without fleetd and hanging the Enrollment Status Page; it now re-delivers fleetd when the host has not checked in since the current enrollment.

Fixed "My device" page to sort software by display name instead of installer filename when a custom display name is set.

Fixed a bug where running many concurrent live queries that each target a small number of hosts could overload Redis and slow down host check-ins.

Fixed browser Back button being trapped on the script batch progress and details pages.

Fixed a bug where all MDM commands in the command list were incorrectly displayed as "custom MDM command". Only commands run via the custom MDM command API now display this label.

Fixed fleet-mcp run_live_query returning a 403 error for users with the observer+ role. Multi-host live queries now run as an ad-hoc live query campaign (raw SQL, streamed over the results websocket) instead of creating a temporary saved query, so they require only the live-query permission that observer+ already has.

Fixed GitOps volume_purchasing_program failing when using All fleets for the fleets field.

Fixed Fleet-maintained apps that share a macOS bundle identifier (for example Firefox and Firefox ESR) so that adding one no longer renames its software title to the other, and no longer shows the other as already added.

Fixed a generic error in the software install activity modal when using Fleet Free to show a Fleet Premium message instead.

Fixed an unclear error message that happened when running fleetctl generate-gitops with an existing patch policy for an installer that no longer references a Fleet-maintained app because it was deleted from the catalog.

Fixed the configuration profiles batch endpoint timing out when removing many Windows profiles from a team with a large number of hosts. Deleting Windows profiles (including clearing a team's profiles via GitOps, deleting individual profiles, and deleting a team) now returns quickly and the profiles are removed from hosts in the background by Fleet, the same way profile changes are already delivered.

Fixed the policy and report details pages briefly showing the previously-viewed policy/report's content when navigating between them.

Fixed horizontal scrollbar showing up when there is nothing to scroll in report and policy results tables.

Fixed an issue where Windows and Linux hosts that had already enrolled were prompted for end user authentication (an SSO browser tab) when fleetd re-enrolled after a service restart. Re-enrollment of an already-enrolled host no longer requires end user authentication; only genuinely new devices are prompted.

Fixed a bug where adding a script-only package via path in GitOps made fleetctl generate-gitops produce an invalid file.

Fixed an issue where Missing hosts filter and dashboard card incorrectly reported iOS, iPadOS, and Android hosts.

Fixed password reset, user invite, MFA login, change-email confirmation, and SMTP test emails to no longer duplicate the URL prefix in their links when Fleet is deployed under a subpath.

Fixed software title details pages timing out for installers, VPP apps, and in-house apps with a large backlog of pending host activities.

Fixed macOS configuration profiles getting stuck in "Verifying" when a host reported a profile install date in a 12-hour time format.

Fixed the Fleet-maintained apps list being cut off so that apps near the end of the alphabet were unreachable. The list is now paginated (100 apps per page), and the platform and "Hide added apps" filters are applied across the full library instead of only the loaded apps.

Fixed GitOps relative path lookup for controls.setup_experience.(apple_setup_assistant, macos_script, software.package_path) in unassigned.yml, and org_logo_paths under org_settings.

Fixed a bug where a script executed in a scheduled batch would still execute on hosts that had been transferred to a different fleet between the time the batch was scheduled and the time it later executed

Fixed a bug where the MDM command results endpoint might not return hostnames for all returned hosts

Fixed the activity feed showing a focus outline when an activity was clicked. The outline now appears only when tabbing to an activity with the keyboard, matching the focus behavior used elsewhere in the UI.

Fixed the agent settings YAML editor (global and fleet-level) hiding command_line_flags behind a comment when set to {} or null. Those values now render as-is, since they have special semantics (they clear all local osquery flags on hosts).

Fixed "Select all matching hosts" to display the actual total host count instead of "50+" in both the hosts table header and the delete hosts modal.

Fixed an issue where the macOS "Update new hosts to latest" OS update setting could stay enabled in GitOps after minimum_version and deadline were cleared; when update_new_hosts isn't explicitly set, it now defaults to enabled only while a minimum version and deadline are configured.

Fixed an issue where more than 8 entries for OS versions would not be paginated.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

• orbit-v1.57.0
• fleet-desktop-v1.57.0 (included with Orbit)
• osquery-5.23.1 (included with Orbit)
• fleetd-chrome-v1.3.5
• fleetd-android-v1.5.0

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

d715f4992d2769d7ab52647913598d454a7421d1db9f00ec4a1d1df453ca1723 fleet_v4.89.0_linux.tar.gz

e77bee9862c630620ec17ace9cb4b0a206464c3dbe8e5e87098a0af5e850eea7 fleetctl_v4.89.0_linux_amd64.tar.gz

a742a0dcc7d9d4b9018efc762ec296b0549c8b27ac973d46878fb41bb2c863d0 fleetctl_v4.89.0_linux_amd64.zip

ed576fc4a644d31c1ea2ae439b43b7b91b1231d514d43235a85fd415bae7a266 fleetctl_v4.89.0_linux_arm64.tar.gz

4bed2143c01a7ee0c77f71ba949a241d4d9d63555cdde5e0b8dcc03d566f5a7b fleetctl_v4.89.0_linux_arm64.zip

acad49ecf66fbfe660951052011e902f4e5188fc069950f1c6405e794f1303e0 fleetctl_v4.89.0_macos.tar.gz

c413a5d40b6f2183cc4791b14ed3e8fc7afc8223714c24b2788ab78edb6e4c67 fleetctl_v4.89.0_macos.zip

c7485e2a5f50483482353461036f429048b6395b2b8e1e0dab44a451a5471a69 fleetctl_v4.89.0_windows_amd64.tar.gz

1a8d686eae85afc63fe2c2323ccf6790b05b9e8f0d4bad3dfd3d340f19b65962 fleetctl_v4.89.0_windows_amd64.zip

1a905eeaa14f3c9aa9799024b3870b5736691c4995076558da2fa6bccff5a996 fleetctl_v4.89.0_windows_arm64.tar.gz

0943d521c18861abd37d6afe3c528074bcf86a89934e0c33ab14f5e5adb706d8 fleetctl_v4.89.0_windows_arm64.zip

Original source

Highlights

• Windows setup experience: continue past a failed install
• Android: host vital variables everywhere
• Default fleet for BYOD iOS/iPadOS enrollment
• Auto-update, pin, and roll back Fleet-maintained apps
• Filter and save the vulnerability exposure chart
• Policy status page
• Script-only packages: pre-install query, post-install, and uninstall scripts
• IdP host vitals from Google Workspace

Windows setup experience: continue past a failed install

Available in Fleet Premium

When required setup software fails to install during Windows automatic enrollment (Autopilot or non-Autopilot), end users now see exactly which software failed. If the IT admin hasn't checked Cancel setup if software fails, the end user can continue past the failure and install the missing software later from self-service. If that option is checked, setup stops and the end user is told to reset the device and try again. Either way, end users get a clear next step instead of a stuck setup screen, which means fewer support tickets for IT admins.

GitHub issue: #45948

Android: host vital variables everywhere

IT admins can now use any host vital variable ($FLEET_VAR_HOST_), like a host's UUID or the end user's IdP email, in Android configuration profiles, certificate templates, and managed app configuration. This makes it possible to deploy a host-specific value as part of an app's configuration, for example, passing a host's UUID to Duo as a trusted endpoint identifier, or a user's email as the identity for EAP-TLS Wi-Fi authentication. For certificates, Fleet also detects when a host vital variable's value changes and automatically resends the certificate so it stays accurate. See all host vital variables in the built-in variables guide.

GitHub issues: #45353, #41968, #37406

Default fleet for BYOD iOS/iPadOS enrollment

IT admins can now choose a default fleet for iOS and iPadOS hosts that enroll via Account-driven User Enrollment (BYOD). This means personal iPhones and iPads automatically land in the right fleet on enrollment, so they get the correct configuration profiles and software without an admin having to move them manually.

GitHub issue: #30871

Auto-update, pin, and roll back Fleet-maintained apps

Available in Fleet Premium

IT admins can now control exactly which version of a Fleet-maintained app their hosts run. Pin a Fleet-maintained app to a specific version to stop it from auto-updating, or roll back to the previous version if a new release causes problems, all from the software title's page. If you're relying on auto-update, Fleet checks for new versions hourly, so hosts stay current without an IT admin re-adding the app.

GitHub issue: #38504

Filter and save the vulnerability exposure chart

Available in Fleet Premium

Security Engineers can now filter the vulnerability exposure chart by software category (operating system, browsers, Microsoft Office, or Adobe apps), EPSS exploit probability, known active exploits (CISA KEV), and specific CVEs to exclude, so the chart reflects the risk registry they actually track instead of every vulnerability Fleet detects. These default filters can now be set and persisted via GitOps (YAML), so they load automatically the next time the chart opens. Filters changed directly in the Fleet UI aren't saved, whether GitOps mode is on or off.

GitHub issues: #44746, #47327

Policy status page

IT admins get a historical view of policy automation runs: pass/fail status for every host, alongside the output of the software install or script run that the automation triggered. This makes it much faster to troubleshoot a host that keeps failing a policy, since admins no longer have to dig through separate activity logs to piece together what happened.

GitHub issue: #38670

Script-only packages: pre-install query, post-install, and uninstall scripts

Available in Fleet Premium

IT admins can now add a pre-install query, a post-install script, and an uninstall script to script-only software packages, matching the behavior already available for custom packages. This means script-only packages can now offer an uninstall option and the same install verification other packages already have.

GitHub issue: #42797

IdP host vitals from Google Workspace

Available in Fleet Premium

Fleet users who use Google Workspace (GW) as their identity provider (IdP) can now populate IdP host vitals (group, department, username, email, and full name) directly from GW, without building a custom integration. Since Google Workspace doesn't support the SCIM protocol, Fleet pulls directory data from Google's API on a schedule. Once connected, IT admins can scope configuration profiles, software, and policies using IdP host vital labels, the same way they would with an Okta or Entra SCIM integration.

GitHub issue: #42915

Changes

IT Admins

• Added the ability to target a policy to hosts using a combination of "include" and "exclude" labels.
• Added the ability to run a policy check before installing Windows and Linux setup experience software. When a team policy's install-software automation points at a setup experience installer, Fleet runs that policy during setup and skips the install when it passes (the software is already installed and up to date), speeding up the end user setup experience. When the policy fails, the software is installed as part of setup experience.
• Changed calendar remediation events to be scheduled on the next business day (skipping weekends) after a policy failure, instead of always being scheduled on the next Tuesday.
• Updated policy details page to show automations and labels as a single property. Also changed the layout of policy properties.
• Added automation runs table to the policy details page, showing per-host automation outcomes with filtering, search, and a reset policy action.
• Added per-host activity log entries when policy automations (webhook, tickets, Google Calendar, and Microsoft conditional access) fail or succeed.
• Added POST /api/v1/fleet/policies/:policy_id/reset endpoint to reset a policy's pass/fail results, clearing counts and membership immediately.
• Added GET /api/v1/fleet/policies/:id/automation_activities endpoint to list automation activities for a policy.
• Added the ability to keep Fleet-maintained apps automatically updated to the latest version, pin them to a specific version or major version, or roll back to a previously cached version, from the UI and via GitOps (Fleet Premium).
• Surfaced .sh script-only software packages on the macOS tab of Controls > Setup experience > Install software, with selections tracked independently from the Linux tab.
• Added setup_experience_platform on software packages in GitOps YAML so .sh script-only installers can be selected for the macOS setup experience declaratively, matching the per-platform UI selection. The value is authoritative on every batch apply and reconciles the cross-platform selection table.
• Added support for pre-install query, post-install script, and uninstall script on script-only packages (.sh and .ps1) via the UI, REST API, and GitOps.
• Added an error on the Windows enrollment status page (ESP) when setup experience software fails to install during automatic enrollment (Autopilot and other OOBE flows) and "Cancel setup if software fails" is turned off.
• Added "🛟 Support" as a new default self-service software category.
• Added support for $FLEET_VAR_HOST_* variables in Android configuration profiles.
• Added support for $FLEET_VAR_HOST_* variables in Android managed app configuration.
• Android certificate templates and managed app configurations are now automatically resent when IdP variable values change.
• Added support for defining the default fleet BYO Apple devices enroll into.
• Added a Google Workspace integration that maps identity provider (IdP) users to hosts, populating IdP host vitals directly from your Google Workspace directory.
• Added an activity feed entry when a user runs a custom Apple or Windows MDM command, visible in both the global activity feed and the host's activity feed.
• Added an activity when editing the managed local account setting using the update fleet endpoint or GitOps.
• Enabled tracking of mobile devices for the "hosts online" chart, and added default filtering to that chart that excludes mobile platforms.
• Added tooltips on the Settings > Users and My account pages to show assigned fleets and roles when a user has multiple.

Security Engineers

• Started collecting non-critical CVEs, filtering them out of charts by default.
• Added the ability to filter vulnerable software by severity (CVSS score) and known exploit status on the Fleet Desktop My device > Software tab (Fleet Premium). The corresponding min_cvss_score, max_cvss_score, and exploit query parameters were added to the GET /device/{token}/software API endpoint.
• Added more filtering options for the Vulnerability Exposure chart.
• Added ability to set default Vulnerability Exposure chart filters via GitOps.
• Improved certificate renewal validation in the host identity SCEP service.
• Added support for all IdP variables and host platform in certificate template subject names and SANs.
• Improved input validation for conditional access SCEP enrollment.
• Validated that a custom SCEP proxy certificate authority challenge contains only printable characters, so Windows certificate enrollment no longer fails with "The string contains a non-printable character" (for example, when the challenge contains an underscore). Existing challenges are only re-validated when changed.
• Restricted authorization for team membership management operations.
• Made authorization more robust when creating labels from manual hosts.
• Improved fleet scope validation for software title lookups.
• Restricted authorization for conditional access Okta IdP asset endpoints so that observer and observer+ roles can no longer read them.
• Improved session handling during password reset flows.
• Cleared the SSO authentication cookie after successful authentication for fully-managed Android enrollment.
• Added private network IP blocking to Fleet's HTTP client. Loopback and cloud metadata addresses (127.0.0.0/8, 169.254.0.0/16) are always blocked. RFC 1918 and other private ranges are blocked by default; use --allow_private_network_integrations to allow them for environments with on-prem integrations (e.g. EJBCA, Jira, SCEP servers on private networks).
• Added the s3.carves_cleanup_disabled server setting to skip S3 file carve reconciliation for deployments that rely solely on the bucket's lifecycle policy to remove carve objects.
• Added the s3.carves_cleanup_max_per_run and s3.carves_cleanup_concurrency server settings to tune how many carves the S3 cleanup reconciles per run and how many concurrent S3 requests it makes.
• Updated the SigNoz OTEL dashboards under tools/signoz/ to template and filter on the deployment.environment resource attribute, with the environment variable defaulting to default, so multiple Fleet environments reporting to the same SigNoz backend can be scoped per environment.

Bug fixes and improvements

• Updated Go to 1.26.5.
• Updated checkbox labels in the Fleet UI to use positive language, making it clearer what each setting enables rather than what it disables.
• Improved Windows MDM configuration profile performance. Changes to Windows profiles now reach hosts more quickly. Large changes that affect many hosts at once, such as adding or removing profiles across a team or transferring many hosts between teams, now finish faster and put significantly less load on Fleet's database, keeping the server responsive at scale.
• Improved validation on batch script executions.
• Updated golang.org/x/image to v0.42.0 to resolve CVE-2026-33813 (WebP decoder denial of service on 32-bit platforms).
• Redesigned in-app success and error notifications as toasts. Error notifications now persist until dismissed and can be expanded to show the server's raw response.
• Added configurable batch size FLEET_MDM_ANDROID_BATCH_SIZE (default: 1000 hosts) for Android MDM operations to prevent overwhelming the Google Android Management API.
• Added batching and staggered scheduling for Android software installation jobs to spread AMAPI load across multiple worker ticks.
• Improved the error message shown when saving a custom variable without the required server private key configured.
• Improved software tooltips on the host details page to display the human-friendly software name and correct action labels for scripts.
• Improved orbit check-in performance by deriving the Fleet MDM connection state from existing host MDM data instead of running a separate 3-table JOIN query on every check-in for every host.
• Improved fleetctl to detect when SSO is enabled on the Fleet server and display a helpful message directing users to authenticate using an API token instead of email and password.
• Refactored makeAndroidAppAvailable to use staggered job queuing instead of sleeping between batches inside a single worker job.
• Updated the checkerboard graph to make it clearer which square represents the current time and which squares are in the future.
• Windows configuration profiles are now queued immediately when a host enrolls in Windows MDM, instead of waiting for the next profile reconciliation cron pass.
• Improved query validation logic around policy creation.
• Updated the "installed during setup" tooltip on Controls > Setup experience > Install software to clarify that installation order depends on software name (0-9, then A-Z), and that software without a policy is installed before software with a policy.
• Navigate back to the report details page after saving changes to a report.
• Enabled automatic refreshing of report results when the window is refocused and every 5 seconds while waiting for results to arrive (skipped when report caching is disabled).
• Reduced database write pressure on the Windows MDM check-in path by gzip-compressing stored device response envelopes.
• Updated the Fleet-maintained apps item count to reflect the total number of apps, counting an app's macOS and Windows versions separately (for example, a search for "Zoom" that returns Zoom and Zoom Rooms on both platforms shows 4 items).
• Moved and updated tooltip from the Vulnerabilities column on the Software > OS page to "Not supported", explaining which platforms support vulnerability detection.
• Improved some GitOps error messages around bootstrap packages, setup assistant and scripts.
• Fixed fleet-scoped context when retrieving a list of users in a fleet.
• Fixed an issue where cleanup of expired file carves stored in S3 could stall on buckets containing a large number of objects, which prevented other scheduled cleanup and aggregation tasks from running.
• Fixed the MDM command details modal showing a generic error, instead of a clear message, for a command sent to a host that was later wiped and re-enrolled.
• Fixed SAML SSO callback URLs (both login and MDM end user authentication) duplicating the subpath when Fleet is deployed under a URL prefix, which broke authentication. The callback URL is now built so the subpath appears exactly once whether or not the server URL was configured with the prefix.
• Fixed the My device > Self-service page briefly showing the "Update" button again on apps that had just finished updating, instead of holding the "Updated" state while the software inventory refreshes.
• Fixed a bug where selecting a policy on the host details or self-service policies page reset the list back to the first page.
• Fixed a 500 error when a host reported a software install result for a deleted software installer. When an installer is deleted, records of its pending installations will be set to canceled instead of completely deleted.
• Fixed Copied! confirmation badges showing the wrong border color and clipping in dark mode.
• Fixed installers, VPP apps, and in-house apps sometimes missing from a host's software details page when more than one install or uninstall was queued for the same item.
• Fixed a server panic when validating a Windows configuration profile that mixes SCEP and non-SCEP elements with a non-SCEP element first. The profile is now rejected with a clear validation error.
• Fixed a bug where selected hosts could not be removed (the "X" did nothing) on the live report target selection screen.
• Fixed a bug where if a script-only package was provided with spaces in the path name in a GitOps run, it would fail validation.
• Fixed the GitOps mode tooltip on disabled settings fields so it points at the field's label instead of the center of the label, input, and help text.
• Fixed the dashboard "Hosts enrolled" chart showing an incorrect platform percentage breakdown.
• Fixed Windows MDM not re-installing fleetd on a wiped or re-imaged device that re-enrolls through Autopilot/Entra (OOBE). The server previously treated stale host orbit info as proof fleetd was present and skipped the install, leaving the device MDM-enrolled but without fleetd and hanging the Enrollment Status Page; it now re-delivers fleetd when the host has not checked in since the current enrollment.
• Fixed "My device" page to sort software by display name instead of installer filename when a custom display name is set.
• Fixed a bug where running many concurrent live queries that each target a small number of hosts could overload Redis and slow down host check-ins.
• Fixed browser Back button being trapped on the script batch progress and details pages.
• Fixed a bug where all MDM commands in the command list were incorrectly displayed as "custom MDM command". Only commands run via the custom MDM command API now display this label.
• Fixed fleet-mcp run_live_query returning a 403 error for users with the observer+ role. Multi-host live queries now run as an ad-hoc live query campaign (raw SQL, streamed over the results websocket) instead of creating a temporary saved query, so they require only the live-query permission that observer+ already has.
• Fixed GitOps volume_purchasing_program failing when using All fleets for the fleets field.
• Fixed Fleet-maintained apps that share a macOS bundle identifier (for example Firefox and Firefox ESR) so that adding one no longer renames its software title to the other, and no longer shows the other as already added.
• Fixed a generic error in the software install activity modal when using Fleet Free to show a Fleet Premium message instead.
• Fixed an unclear error message that happened when running fleetctl generate-gitops with an existing patch policy for an installer that no longer references a Fleet-maintained app because it was deleted from the catalog.
• Fixed the configuration profiles batch endpoint timing out when removing many Windows profiles from a team with a large number of hosts. Deleting Windows profiles (including clearing a team's profiles via GitOps, deleting individual profiles, and deleting a team) now returns quickly and the profiles are removed from hosts in the background by Fleet, the same way profile changes are already delivered.
• Fixed the policy and report details pages briefly showing the previously-viewed policy/report's content when navigating between them.
• Fixed horizontal scrollbar showing up when there is nothing to scroll in report and policy results tables.
• Fixed an issue where Windows and Linux hosts that had already enrolled were prompted for end user authentication (an SSO browser tab) when fleetd re-enrolled after a service restart. Re-enrollment of an already-enrolled host no longer requires end user authentication; only genuinely new devices are prompted.
• Fixed a bug where adding a script-only package via path in GitOps made fleetctl generate-gitops produce an invalid file.
• Fixed an issue where Missing hosts filter and dashboard card incorrectly reported iOS, iPadOS, and Android hosts.
• Fixed password reset, user invite, MFA login, change-email confirmation, and SMTP test emails to no longer duplicate the URL prefix in their links when Fleet is deployed under a subpath.
• Fixed software title details pages timing out for installers, VPP apps, and in-house apps with a large backlog of pending host activities.
• Fixed macOS configuration profiles getting stuck in "Verifying" when a host reported a profile install date in a 12-hour time format.
• Fixed the Fleet-maintained apps list being cut off so that apps near the end of the alphabet were unreachable. The list is now paginated (100 apps per page), and the platform and "Hide added apps" filters are applied across the full library instead of only the loaded apps.
• Fixed GitOps relative path lookup for controls.setup_experience.(apple_setup_assistant, macos_script, software.package_path) in unassigned.yml, and org_logo_paths under org_settings.
• Fixed a bug where a script executed in a scheduled batch would still execute on hosts that had been transferred to a different fleet between the time the batch was scheduled and the time it later executed
• Fixed a bug where the MDM command results endpoint might not return hostnames for all returned hosts
• Fixed the activity feed showing a focus outline when an activity was clicked. The outline now appears only when tabbing to an activity with the keyboard, matching the focus behavior used elsewhere in the UI.
• Fixed the agent settings YAML editor (global and fleet-level) hiding command_line_flags behind a comment when set to {} or null. Those values now render as-is, since they have special semantics (they clear all local osquery flags on hosts).
• Fixed "Select all matching hosts" to display the actual total host count instead of "50+" in both the hosts table header and the delete hosts modal.
• Fixed an issue where the macOS "Update new hosts to latest" OS update setting could stay enabled in GitOps after minimum_version and deadline were cleared; when update_new_hosts isn't explicitly set, it now defaults to enabled only while a minimum version and deadline are configured.
• Fixed an issue where more than 8 entries for OS versions would not be paginated.

Ready to upgrade?

Visit our Upgrade guide in the Fleet docs to update to Fleet 4.89.0.

Manage all your devices like it's 2026

Open MDM, patching, and vuln management for every OS.

Read case studies

Try it yourself

Original source

Bug fixes

Fixed an issue where a configuration profile could be enqueued multiple times for a single host.

Fixed recovery lock password being enforced on personally-owned (BYOD) macOS hosts, where it would always fail because personal enrollments have device lock rights stripped. These hosts are now skipped.

Fixed a bug where a user's BYOD selection was not persisted through IdP authentication

Fixed a bug where installing App Store (VPP) or in-house apps on an iOS/iPadOS host enrolled with the manual (profile-driven) BYOD enrollment profile failed while trying to look up a VPP user. These device-channel hosts now install apps to the device, the same as company-owned manual enrollment; user-scoped licensing is reserved for Account-Driven User Enrollment.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

1adc9236a16edfdbaa321b3abcbea8fd93354bf348aa1984f1dbf41929f837be fleet_v4.88.1_linux.tar.gz
c0e6db9c7559487036572a292c8a4acb586fa041524d4e59d76730b4932a7375 fleetctl_v4.88.1_linux_amd64.tar.gz
3396a776f736513f511c7e8486838c0a4d6548d42329b66967d5abe33d8d1616 fleetctl_v4.88.1_linux_amd64.zip
6587d56fa84b8b93a25bc26551c86170de61a3ff00f7ad2745b841522fb9cff9 fleetctl_v4.88.1_linux_arm64.tar.gz
b79a62d090d562fd223b6674a9393f7276b5735fbae38ea5438927ba7a21554e fleetctl_v4.88.1_linux_arm64.zip
c308cce437f2cca7b24e27aa3501f8da5b072192f31ab68bd763dd33de7facad fleetctl_v4.88.1_macos.tar.gz
18256e18353febc7205cdaf5512ea820af282c0993ab8908704ee7a958814887 fleetctl_v4.88.1_macos.zip
b6028f87ca1c9f0302f0c8fa496de8f36afb06aab5838131befede5b20d95e93 fleetctl_v4.88.1_windows_amd64.tar.gz
6d67da0f5a97310abfd5772876d6baabe110bc8219e49e08cbea674f8086e60c fleetctl_v4.88.1_windows_amd64.zip
ff8334a6c8527a7d9ae069492aecf67403197ef4761e99c5526038adf39cc202 fleetctl_v4.88.1_windows_arm64.tar.gz
04db52fdd300cc55ffa94e84163551c0d8777414652ae995ab56fed778d1d873 fleetctl_v4.88.1_windows_arm64.zip

Original source

Bug fixes

Added support for personal (BYOD) Apple MDM enrollment, tracking per-host enrollment permissions so that personal devices cannot be remotely wiped or locked, and preserving those permissions across SCEP/ACME certificate renewal.

Fixed an issue where fleetd could intermittently fail to install during Windows MDM enrollment, which could cause the Windows Autopilot Enrollment Status Page to hang.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

85280edd8db7ad2212ba5456997cfacdfeeabaf5b6124732f6fb95df45324163 fleet_v4.88.0_linux.tar.gz

847f9bfee46cd8a2f637975efbb4e8b5b2a5ed290af3759361721a4623338631 fleetctl_v4.88.0_linux_amd64.tar.gz

8698436ad196fb0542705d9a1872f7f45a3804e40d87d5e66d889e5def928d73 fleetctl_v4.88.0_linux_amd64.zip

80d52c9b38960a6ddbaf9e6b1545f2aba24210e5c9274efe716eaf7ec33183a5 fleetctl_v4.88.0_linux_arm64.tar.gz

e2be3aa46de32dbde7e998ebf4ccf807021dec2468242f22f1efdd77e1f2014a fleetctl_v4.88.0_linux_arm64.zip

e6cd3e2e28c955a9f64c8f12c50e1e78935b7a30dac0f9253726725633f19b5d fleetctl_v4.88.0_macos.tar.gz

f192245fde09f6f9a2a14c34d443114104f55ec93841ec330d6149845b9a8794 fleetctl_v4.88.0_macos.zip

3a113fdf800011ce006a1c68c00f039eaab5d3546c64d21b4bb02209391f55ff fleetctl_v4.88.0_windows_amd64.tar.gz

109eda99ba889f9aa2d3e676748158cdacfa759125f8484817035beeae42a950 fleetctl_v4.88.0_windows_amd64.zip

5b370cc2d208ce752b073fc11e24f77ad02294881b8ad01fc7ac6f4bc9518860 fleetctl_v4.88.0_windows_arm64.tar.gz

4d029140b782793f5051068129410decfb19d819fb41f83880dccc2ee8304596 fleetctl_v4.88.0_windows_arm64.zip

Original source