Fleet Release Notes

Fleet 4.93.0 is now available. See the complete changelog or read on for highlights. For upgrade instructions, visit the upgrade guide in the Fleet docs.

Highlights

• macOS app patching: prompt end users before deadline
• Android zero-touch enrollment
• More Android host vitals
• Rotate Windows local admin password
• Restrict Managed Apple Account sign-in to managed devices
• Hardware attestation for iOS and iPadOS
• Reports that cover every host

macOS app patching: prompt end users before deadline

Available in Fleet Premium

IT admins can now warn end users before Fleet patches an open macOS app. When a patch policy with notify_before_patching fails and the app is open, Fleet Desktop shows a notification listing the apps that will update, waits one hour, shows a reminder five minutes before, and then installs the update. This gives end users time to save their work, instead of waiting until they close the app on their own (patch_when_closed).

The deadline is one hour. Setting a custom deadline is coming soon.

See what end users experience, including a video walkthrough, in the patching end user experience guide.

GitHub issue: #39178

Android zero-touch enrollment

Available in Fleet Premium

IT admins can now ship company-owned Android devices straight to end users and have them enroll in Fleet the first time they're turned on. In Settings > Integrations > MDM > Android zero-touch, copy the DPC extras JSON into Google's zero-touch portal. Zero-touch-enrolled hosts land in "Unassigned." Assigning them to a different fleet automatically is coming soon.

Learn how to set it up in the Android zero-touch enrollment guide.

GitHub issue: #49165

More Android host vitals

IT admins can now see more Android host vitals on the Host details page, including whether USB debugging is on, whether a passcode is set, whether Google Play Protect is on, encryption status, security patch level, manufacturer, security posture (from Google's Play Integrity checks), and phone numbers. These vitals are also returned by the get host API.

GitHub issue: #49791

Rotate Windows local admin password

Available in Fleet Premium

IT admins can now rotate the password for Fleet's managed local admin account on Windows hosts, the same way they already could on macOS. Go to Host details > Actions > Show managed account and select Rotate password. Fleet also rotates the password automatically an hour after someone views it, so a password shared for troubleshooting doesn't stay valid.

Learn more about the managed local account on Windows.

GitHub issue: #43489

Restrict Managed Apple Account sign-in to managed devices

Available in Fleet Premium

IT admins can now make sure end users sign in to their Managed Apple Account only on devices enrolled in Fleet. This stops company data from syncing to personal, unmanaged Apple devices. In Apple Business, set Allow Managed Apple Account on to Managed devices only or Supervised devices only, and Fleet confirms to Apple that the host is managed during sign-in.

Hosts that automatically enroll (ADE) are already tied to an Apple Business (AB). Manually enrolled hosts aren't, so Fleet uses your default AB for sign-in. If you've added more than one AB, choose a default for sign-in in Settings > Integrations > MDM > Apple Business (AB). Otherwise, Managed Apple Account sign-in fails on manually enrolled hosts.

Learn more in the Apple MDM setup guide.

Only turn on this setting if you're just starting to roll out Managed Apple Account sign-in. If your end users already sign in with Managed Apple Accounts, leave it off for now. Hosts enrolled before Fleet 4.93.0 can't sign in to Managed Apple Accounts with this setting on until their next enrollment profile renewal, about every six months.

If you want to turn it on sooner, follow these instructions.

GitHub issue: #45829

Hardware attestation for iOS and iPadOS

Available in Fleet Premium

Hardware attestation (ACME), which Fleet already supports for Apple silicon Macs, now works for iPhones and iPads assigned to Fleet in Apple Business. With apple_require_hardware_attestation on, iPhones and iPads from 2017 or later (with an A11 Bionic chip or later), running iOS or iPadOS 16 or later, prove their hardware matches a known Apple Business record when they enroll. Hosts already enrolled with SCEP move to ACME on their next certificate renewal. Older devices keep enrolling with SCEP.

Learn more in the GitOps reference.

GitHub issue: #51528

Reports that cover every host

Reports now store as many results as you have hosts, instead of stopping at 1,000. A report that returns one result per host covers your whole fleet, so you can bring Jamf extension attributes over to Fleet. Sorting, search, and pagination now run on the server, so large reports stay usable.

Fleet doesn't store a host's result over 512 KB. Learn more in the reports guide.

GitHub issue: #43723

Changes

IT Admins

• Added a "Notify before patching" option for macOS Fleet-maintained app patch policies. When the app is open, Fleet Desktop tells the end user 1 hour before the app is closed and updated, and again 5 minutes before. Requires Fleet Desktop 1.5.0.
• Added support for Android zero-touch enrollment for company-owned devices.
• Added the new Android host vitals to the Vitals card on the host details page: USB debugging enabled, passcode set, Play Protect enabled, encryption status, manufacturer, security update version, kernel version, bootloader version, software update status, security posture, carrier, phone number, IMEI, and MEID, plus the device's Android API level in a tooltip on the operating system. Phone number, carrier, IMEI, and MEID are shown only for company-owned hosts. On Android hosts the operating system no longer repeats the security patch level, which now has its own vital.
• Added collection of the Android hardware radio identifiers (IMEI and MEID) from AMAPI status reports, returned as imei and meid by the get host endpoints for company-owned Android hosts.
• Added the ability to rotate the managed local account password on Windows hosts, from Host details > Actions > Show managed account or the POST /hosts/:id/managed_account_password/rotate endpoint. As on macOS, viewing the password also schedules an automatic rotation about an hour later.
• Added IdP host vitals (username, full name, groups, department) on Entra-joined Windows hosts enrolled without Fleet MDM, by matching the Entra join user reported by the device to the SCIM-provisioned user. Manually set and end user authentication usernames take precedence.
• Added host_id and host_serial to the mdm_enrolled activity for Windows hosts, so the activity appears on the host's activity timeline and automations can identify the device. Windows automatic (Entra/Autopilot) enrollments report neither the host nor its serial at enrollment time, so their activity is now recorded the first time the enrollment is linked to a host instead of being recorded without them. The activity also reports installed_from_dep for Windows, and the activity feed shows the serial and the enrollment type alongside the host name.
• Added support for restricting Managed Apple Account sign-ins via Apple Business, using the GetToken protocol.
• Added the ability for users with the Technician role to clear passcodes on iOS and iPadOS hosts.
• Raised the report cap to the number of hosts when that is higher than report_cap, so reports that return one result per host are never clipped.
• Changed reports that reach the cap to keep updating results for hosts already in the report instead of pausing entirely. Only results from hosts not yet in the report are skipped.
• Stopped storing a host's result for a report when it is larger than 512 KB. Only the fetch time is recorded.
• Added page, per_page, order_key, order_direction, and query parameters to GET /api/v1/fleet/reports/:id/report, and a count field to its response. Without per_page the endpoint still returns all results, now ordered by last_fetched descending.
• Changed the report results page to paginate, sort, and search server-side instead of loading every result into the browser.
• Added real online and offline status for iOS, iPadOS, and Android hosts based on MDM activity, instead of always reporting them as offline. The status is reflected on the hosts list, host details, dashboard summary, and target counts.
• Added an online history modal on the host details page. Clicking a host's online/offline status opens a 30-day checkerboard of that host's connectivity.
• Added the ability to filter hosts by platform label and disk encryption status at the same time. Disk encryption status rows on Controls > OS settings now link to the host list filtered by both.
• Added a populate_end_users query parameter to the "List hosts" API endpoint, which includes each host's end users, with their identity provider (IdP) details and other emails, in the response.
• Added disk_encryption_enabled to each host in the response of the list hosts endpoint (GET /api/v1/fleet/hosts).
• Added a --cpu-quota flag to fleetctl package to set the systemd CPUQuota enforced on fleetd in Linux packages (deb, rpm, pkg.tar.zst). The default remains 20%.
• Allowed setting the extensions_autoload flag in agent options command_line_flags. It's still rejected when the extensions key is also configured, because fleetd uses that flag to load the extensions it manages.
• Added support for hosts running AMD Ryzen AI Developer Platform, a Debian-based Linux distribution.

Security Engineers

• Added hardware attestation (ACME) for iPhones and iPads assigned to Fleet in Apple Business. With apple_require_hardware_attestation on, devices with an A11 Bionic chip or later running iOS or iPadOS 16 or later prove their hardware matches a known Apple Business record when they enroll. Hosts already enrolled with SCEP move to ACME on their next certificate renewal, and older devices keep enrolling with SCEP.
• Added the ability to limit enrollments to only automated (DEP) Apple Business device enrollments.
• Added the mdm.apple_one_time_enroll_secrets server configuration option, which uses one-time enrollment secrets delivered in the fleetd configuration profile for macOS hosts instead of shared enrollment secrets.
• Added vulnerability detection for Go binaries in software inventory, using the Go vulnerability database (https://vuln.go.dev).
• Added the Go module path and Go toolchain version to Go binaries in software inventory. Go binaries now show a Go icon, and their version includes the toolchain they were built with (for example, v0.21.1 (go1.26.1)).
• Added signature_information with executable_path and executable_sha256 for each Mach-O executable installed by a Homebrew formula under its keg's bin and sbin, for use with Santa binary rules. Requires an updated fleetd.
• Added multi-signal detection to the ai_tools fleetd table, so AI agents that aren't recognized tools (homegrown agents and CrewAI, AutoGen, or LangChain harnesses) are reported instead of being missed. Two new columns, confidence and evidence, show how certain each detection is and which signals produced it. Hosts may report more agents rows than before as a result.
• Added TOML and YAML MCP config parsing to the ai_tools table, so MCP servers declared by Grok, Codex, Hermes, and the OpenClaw family are now reported. An MCP server that stores an Authorization value in its config is now flagged with the existing plaintext_secret risk flag.
• Added support for end users to create their own BitLocker startup PIN from the My device page, so a Windows user without local admin rights can satisfy a fleet that requires one. The PIN is stored encrypted, handed to the host's agent exactly once, and cleared. Fleet never shows it back to the end user or to an admin.
• Updated CIS Windows 10 Enterprise benchmark policies from v4.0.0 to v5.0.0.

Bug fixes and improvements

[Extensive list of bug fixes and improvements omitted for brevity but included in full release notes]

Ready to upgrade?

Visit our Upgrade guide in the Fleet docs to update to Fleet 4.93.0.

Manage all your devices like it's 2026

Open MDM, patching, and vuln management for every OS.

Read case studies
Try it yourself

Release fleetd-chrome 1.3.6

rolls up the pending ee/fleetd-chrome/changes entries into CHANGELOG.md and bumps the version in package.json/package-lock.json.

The beta (fleetd-chrome-v1.3.6-beta, tagged on this commit) was released via the beta workflow and tested internally. After merge, the merged commit will be tagged fleetd-chrome-v1.3.6 to trigger the production release.

Checklist for submitter

QA'd all new/changed functionality manually (beta extension tested on Fleet's managed Chrome)

AI: Claude Code (claude-opus-5-5)

Summary by CodeRabbit

Updates

The ChromeOS Fleet Desktop extension is now version 1.3.6. No user-facing feature or behavior changes are included in this update.

Bug fixes

Improved SSO session handling.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

a7986ef00fed084a04c87066447bfba147155af130e6245996da856e504a3fe8 fleet_v4.91.2_linux.tar.gz
1f215a284bba7f1eb926f54618563d3bedd79d959938d3e62741b31c108f2f61 fleetctl_v4.91.2_linux_amd64.tar.gz
9067c4be8c1451eb7a202382d0caf59f565625f6ef00ecff81b510165aa1ea49 fleetctl_v4.91.2_linux_amd64.zip
18f9ee5157fb24df6c75c3976f3488395993a7e96e76c5d55c48d02563b438e5 fleetctl_v4.91.2_linux_arm64.tar.gz
b7cd3acd3472ba70bccc8b7f67104ab3d59ac7db1b5cc80e6352d192a63dc9fd fleetctl_v4.91.2_linux_arm64.zip
97764f75584bbaef341d039e516efc3c7fb23227b1c33199eb8b3e09fbc9e758 fleetctl_v4.91.2_macos.tar.gz
03359997339e45b961f54b1aeec6a72767445dc1efb2d5cfb2f9a12aa64d696e fleetctl_v4.91.2_macos.zip
63d73bcf0bee5d9bbf6c901a18406830764996b8341aff693586cb4587819955 fleetctl_v4.91.2_windows_amd64.tar.gz
a76a4b443d1ae6a5183033a6c2c7f4985f273f0f5e2c7734e41b676b2d812bb7 fleetctl_v4.91.2_windows_amd64.zip
d4398b5bf6a38d611e18a0e23805c7c00905c8bf91e75f9357af74d444192009 fleetctl_v4.91.2_windows_arm64.tar.gz
d96960a44047f14d9f27320c71a3653cd3c13494183e159a7cff006f31345899 fleetctl_v4.91.2_windows_arm64.zip

Bug fixes

Improved SSO session handling.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

621a80f7474f99f32108b775a2cec84f3efcb91de7169b071bc7a9163d421742 fleet_v4.90.3_linux.tar.gz

8cbebc1408ce33797d4daa13fb5f5a1020633bd1f5bdeda8493b2c4b034ad9b6 fleetctl_v4.90.3_linux_amd64.tar.gz

46069c8579e6245c7015992034b5dcfebb48fd997611a224d54682f98a0c9c1f fleetctl_v4.90.3_linux_amd64.zip

4feee49d1dc760be039394240c6a58fad7d07b1034475c9759d274adffd8493a fleetctl_v4.90.3_linux_arm64.tar.gz

eaba2966c74bd45777c8970f903d8ca388128233b2fcf4c652c8a8fc5beda60c fleetctl_v4.90.3_linux_arm64.zip

4373d5b3261e6b68448a7aff91c82ab1166ff057b74ed12c63b54554d3a0ab40 fleetctl_v4.90.3_macos.tar.gz

f113e742bbadb94acb341dfa8e4e31d62eabfda74be64fdf069760777e680a9e fleetctl_v4.90.3_macos.zip

a07fafb9c7b40745629dcfdb8d86995587044e111e670d9b58107d096e400e0e fleetctl_v4.90.3_windows_amd64.tar.gz

6562da8e47a11b0b6500669575c230ace2308f3a12e99acb47d7bf88c00bc8a3 fleetctl_v4.90.3_windows_amd64.zip

111ecac05e02bdac98d69a8ac2288f943e952389b05392aaf827f45cf5a089ee fleetctl_v4.90.3_windows_arm64.tar.gz

ecdaa99df1ce5ab6098f5a45bb2621d450b9d6a8ec96894a4770553e21951bbd fleetctl_v4.90.3_windows_arm64.zip

Bug fixes

Improved SSO session handling.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

56c0dd0b8bdda95f2b4e8f44d256779fe2094e26457dad3e4a7b538ee993f35b fleet_v4.89.3_linux.tar.gz
640db18491cfdab4baf5652dc57626149d7cd819ef7d965948319d194317ccd4 fleetctl_v4.89.3_linux_amd64.tar.gz
599ab863890b031a7e31844e9541d9516e4c99ca0a531e2dedbcde5eba31f5e3 fleetctl_v4.89.3_linux_amd64.zip
a5a68825c9bf10928db94f47321a7c236fad12883bf64a8050849d6e51a16a28 fleetctl_v4.89.3_linux_arm64.tar.gz
fa86a3638921b46968eb44b4df5b0a832b0c2640214e8ca9efb5839045c3886e fleetctl_v4.89.3_linux_arm64.zip
644c51b41447158a9f26aea5591e69133792c79adfcb547ad01e8d80506c52ea fleetctl_v4.89.3_macos.tar.gz
31342ac1321f76962627064314b1d6699ac50ed77a4babcf2df8170b3439ae56 fleetctl_v4.89.3_macos.zip
b316ad94e6b5c060287527854a39ab267c7509ce99a42a7542e57bfaf82f02ee fleetctl_v4.89.3_windows_amd64.tar.gz
4aec2db9461e1a2ef34d7a4a1d8faa2e8d03514d16a44adb0c2f4ffc610967aa fleetctl_v4.89.3_windows_amd64.zip
49951a13c2f69c60306e83527e2250c642456de30c331e0ffb2864f412b72b3a fleetctl_v4.89.3_windows_arm64.tar.gz
fa582bfe3e21fafa807342c72eef2540379f844e86c667fc90e3e3032c82f477 fleetctl_v4.89.3_windows_arm64.zip

Bug fixes

Improved SSO session handling.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

58db6ea0753ebe63f79419a4e24ea08addb95c5f3e80ceee639dfe963419e3ee fleet_v4.88.2_linux.tar.gz
8c563e3fbc217bbef2aea5d38d19da2eea4966b8b624298ade93b73b79b740d9 fleetctl_v4.88.2_linux_amd64.tar.gz
a28b2c8e7013fc91055ee1645e7cc33cef7bef71c4bb97618faa82c5944e3933 fleetctl_v4.88.2_linux_amd64.zip
9d1a2b12eddb93fe2b7a67577e0494e630f8984c13eb81332c4c4691c982369d fleetctl_v4.88.2_linux_arm64.tar.gz
93ef62c7442afd07d20adc7a6fab1449ea5fdff6e03aa97a94d24b23f2bae7f2 fleetctl_v4.88.2_linux_arm64.zip
5305cb0230169f2a1c9ac364939085f1c9fee2b5f63ef3a72a2e6e068b96c0c4 fleetctl_v4.88.2_macos.tar.gz
0be344f60761d26b728ccda3914630efe334c65d57d04afa91e145a8d3165719 fleetctl_v4.88.2_macos.zip
d2f4af4ea103b45183e5db1fb7eaa444f731151994b4f23d810f62110c558e68 fleetctl_v4.88.2_windows_amd64.tar.gz
6ef54b180aba718d0d159cb74f800d5a61953cce7adce5bb091a53f7246e5a69 fleetctl_v4.88.2_windows_amd64.zip
cc8413f5f79d29242f2e7cb608c97064e7abf04538d3602ff88d217481c8347f fleetctl_v4.88.2_windows_arm64.tar.gz
7a454cf3624e0d813cecfd2fab515a89fa13bb792ce3e1d557ade5ed1dc69f5a fleetctl_v4.88.2_windows_arm64.zip

Bug fixes

Improved SSO session handling.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

ef05d274309a47207142c00904acb91ccfb7d4107e84e5fb34d46521b6d2d00e fleet_v4.92.3_linux.tar.gz
a37a8ddee76145791b197925681aae8e3ace24e1f734efafb525dc1580ac8e6c fleetctl_v4.92.3_linux_amd64.tar.gz
8455542cd6e2c6366ded842c3b597d9e4f12a5e3eecc3a4e1d3c504cebeadaa9 fleetctl_v4.92.3_linux_amd64.zip
a7bf915904e6dbe2726f529467af7806a985ea71cd624776a3e9a0a2cd5c1b22 fleetctl_v4.92.3_linux_arm64.tar.gz
15fc447c241075808d754b691e2ecca03e6269b5cc0078ce76f3e5a3fd31c2c2 fleetctl_v4.92.3_linux_arm64.zip
6fa17a3907ac491cd015ea9d6e0950889049bc51b319fdf50654b81e6e623ffa fleetctl_v4.92.3_macos.tar.gz
5deb2fc9da5ddacbc19a2c11f1d4237dadd8ddf22f195b59281900b9207af6de fleetctl_v4.92.3_macos.zip
5c34e81094ba668f50dc03283848b32bcf142caf501fc9cee4b69b04627f0374 fleetctl_v4.92.3_windows_amd64.tar.gz
af12c75a3cec83584bd2f9bcb6e82c3d531b13f354d910e6b3f74f8ee6634d57 fleetctl_v4.92.3_windows_amd64.zip
c932e015c011322b871a366183a9ed0395bdcf6765d859c0e342f299e034c437 fleetctl_v4.92.3_windows_arm64.tar.gz
3c8b5719d7ba2477c304f68f0e0f45ec250c58e608853ff3f6751441861981fc fleetctl_v4.92.3_windows_arm64.zip

Bug fixes

Fleet now retries Android Management API calls that fail because the API rate limit was exceeded (HTTP 429), waiting 60 seconds and then backing off exponentially, so user-initiated actions like lock, wipe, and custom commands are no longer dropped on a transient rate limit. Background jobs (profile delivery, device reconciliation, software jobs) still fail fast and retry on their next run.

Fixed software title details pages and the hosts list software status filter timing out for software with a large install history.

Added an hourly cleanup that deletes software install and uninstall records more than 30 days old, configurable with server.software_install_results_retention.

Improved the performance of applying scripts through GitOps on Fleet instances with a large script-run history.

Added an hourly cleanup that deletes script results more than 30 days old, configurable with server.script_results_retention.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

cece684541a46faca40ba5821c7c6cf3248df381a4adb442291ec37eea3bccae fleet_v4.92.2_linux.tar.gz
167fb6b8cbbd1f3c7ce80b92811be98724d4672c955c36f2e135162913450f60 fleetctl_v4.92.2_linux_amd64.tar.gz
63def34fbe603ce45a0d375c4c7fddadffd09d7ad27d65e6b416e57bb22620a5 fleetctl_v4.92.2_linux_amd64.zip
cdb2c087c60747e200660a98ba0cb81d619815b7b1a7f6eb638f00749db63e43 fleetctl_v4.92.2_linux_arm64.tar.gz
aff1c3b9742f392159e4bf3d337963a7ab54e0981f4a68c72fcc4f06f086eeb2 fleetctl_v4.92.2_linux_arm64.zip
2d0599c2f56fb14c53753f4353134b853d695ea8864d95b5d775a8ac426d9b8d fleetctl_v4.92.2_macos.tar.gz
02249cbc4b9481578e60710380751774328bd8782572ddce96340402f2539cb2 fleetctl_v4.92.2_macos.zip
a8c3fea6faac839c4c93d9f7505cc2babac4c470047ec4cb87245507e2bec3ce fleetctl_v4.92.2_windows_amd64.tar.gz
1f0b3876881ec3a62ab2fed2e594fdff31c7cc35ca25d88fe6e4d15d901b5315 fleetctl_v4.92.2_windows_amd64.zip
6b3f61ddb962c54ab583d082c8286223245514e1680c1e9ea721301f9b7042cd fleetctl_v4.92.2_windows_arm64.tar.gz
74d61c87e91ba08030ac9439e7bfdfb6a83903965fb58d26ebc1a21529d25402 fleetctl_v4.92.2_windows_arm64.zip

Bug fixes

Fixed GitOps re-downloading Fleet-maintained apps whose manifest carries no hash, such as 1Password, Google Chrome, Slack, Webex, and Zoom, on every run.

Fixed software with an invisible reported name rendering as a blank row in Host details > Software, the Software page, and My device > Software. Some macOS system apps (e.g. MediaRemoteUI on macOS 27) hide themselves by setting their display name to a single zero-width character, which is neither empty nor trimmable; Fleet now falls back to the bundle identifier for these.

Fixed the GitOps starter's CI jobs failing when the FLEET_URL secret ended in a slash.

Fixed macOS hosts losing their IdP username, full name, groups, and department (and dropping out of IdP-group labels) after an MDM certificate renewal or re-enrollment when the IdP user had been set manually.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

81fe0e41e64a33fc953d1b1a1707a316f40dd74750f37ed968b35dac937f4b1a fleet_v4.92.1_linux.tar.gz

1ae57c4a41835c43698b25add316de0d94cd2ead8380e7873199a0cd57f561de fleetctl_v4.92.1_linux_amd64.tar.gz

748adb58e27d26894e2c561bcc6449b52d3a88a02d8b7f4cef6703aecfd3704e fleetctl_v4.92.1_linux_amd64.zip

efeb18c4d5799cdfba93d615234e01b0001fa766c1d74898289e3890edb1dd22 fleetctl_v4.92.1_linux_arm64.tar.gz

fe2383e8e6f7230611d0414b02477f56a11c7cf20e9e2c9d4eff41cec8a8edfb fleetctl_v4.92.1_linux_arm64.zip

daf5ac5e5eba524054fcc43733efdefed313c43333d5187f7a38005e87594a43 fleetctl_v4.92.1_macos.tar.gz

c687b37622756d3dcf232e0d530bdd0d64321e47037144d6af6e4094b5a58c00 fleetctl_v4.92.1_macos.zip

94c7bc730dfd41cb441d57f7c7b0a9b61bce614f4229733681e5666975676326 fleetctl_v4.92.1_windows_amd64.tar.gz

c36fa7b4cea870a395bffbf9071fccfddad7b897d83172feccf59472d7f13610 fleetctl_v4.92.1_windows_amd64.zip

ce628198b6123447429e4beb3840f50e8b7b13da32a3b470d6eb82c572520813 fleetctl_v4.92.1_windows_arm64.tar.gz

6038977b0cbae1fa14b1f1a44bf25cd982ba028b4c92ef33df25ed351db0eba4 fleetctl_v4.92.1_windows_arm64.zip

Fleet 4.92.0 is now available.

See the complete changelog or read on for highlights. For upgrade instructions, visit the upgrade guide in the Fleet docs.

Highlights

• Android: run any command
• Android: scope self-service software
• Fleet assignment for Windows Autopilot hosts before enrollment
• Custom macOS FileVault
• Cancel upcoming lock/wipe commands
• Policy automations: resend a configuration profile
• Filter vulnerability exposure by severity
• Require SSO for Fleet Desktop

Android: run any command

IT admins can now send any command from the Android Management API to an Android host via fleetctl mdm run-command or Fleet's API, in addition to any Apple (macOS, iOS, iPadOS) or Windows command. This unlocks automations for commands Fleet doesn't have built-in UI/API action for yet, like requesting device info or relinquishing ownership.

IT admins can see Android commands results on a host's Host details page or via fleetctl get mdm-commands and fleetctl get mdm-command-results, the same way we already could for Apple and Windows hosts. This makes it easier to troubleshoot a command sent to an Android host, whether it came from the Fleet UI, GitOps, or a custom command sent through the API.

See an example Android command, like rebooting a host, in the MDM commands guide.

GitHub issues: #23232, #33158

Android: scope self-service software

Available in Fleet Premium

IT admins adding software to Android hosts' managed Google Play Store can now target hosts using labels, the same targeting options already available for macOS, Windows, and Linux software. This makes it possible to make an app available in self-service on a more specific set of Android hosts instead of every host in a fleet. Learn how to add an Android app.

GitHub issue: #33062

Scoping an different Android app configuration to specifc hosts is coming soon.

Fleet assignment for Windows Autopilot hosts before enrollment

Available in Fleet Premium

Windows Autopilot now show up in Fleet as "Pending" hosts, along with their Autopilot group tag, before they ever enroll. IT admins can manually transfer a pending host to the right fleet from the Hosts page, or build an automation on top of Fleet's API to do it before the host ever enrolls, instead of waiting for it to land in "Unassigned" first.

GitHub issue: #43481

Custom macOS FileVault

Available in Fleet Premium

IT admins can now add custom disk encryption (FileVault) settings for macOS. This makes it possible to upload a custom FDEFileVaultOptions configuration profile, for example, to defer FileVault until the next login, or allow a third-party tool such as Xcreds to enforce FileVault, while Fleet still escrows the recovery key.

GitHub issue: #48654

Cancel upcoming lock/wipe commands

IT admins can now cancel a pending lock, wipe, clear passcode, or enable lost mode command on Apple (macOS, iOS, iPadOS) hosts before a host receives it, from the host's Host details > Activity > Upcoming > MDM commands or via Fleet's API. Even if the host runs a lock command before the cancellation reaches it, Fleet still shows the unlock PIN, once the result comes back.

Lock on Windows/Linux and wipe on Linux run as scripts, but can be canceled via Host details > Activity > Upcoming, or via Fleet's API. Wipe on Windows and lock, wipe, and clear passcode on Android aren't cancelable yet.

GitHub issue: #43181

Policy automations: resend a configuration profile

Available in Fleet Premium

IT admins can now automatically resends a configuration profile when a host fails the policy, the same way Fleet already supports automatically running scripts and installing software. This makes it possible to build automated fixes for configuration drift, like renewing a certificate, fixing a Wi-Fi profile, or re-enforcing a CIS benchmark setting.

GitHub issue: #40637

Filter vulnerability exposure by severity

Available in Fleet Premium

The vulnerability exposure chart on the dashboard can now be filtered by severity (CVSS score), giving Security Engineers more control over what the chart shows. We can also set the default severity filter for the whole organization by configuring cvss_min/cvss_max in GitOps.

GitHub issue: #47326

Require SSO for Fleet Desktop

Available in Fleet Premium

IT admins can now require end users to sign in with SSO before they can access self-service in Fleet Desktop for macOS, Windows, Linux, or iOS/iPadOS hosts. In Organization settings > Fleet Desktop, turn on the new "End user authentication" setting, or set fleet_desktop.sso_enabled in GitOps, to add an extra layer of authentication in front of Fleet Desktop.

GitHub issue: #47116

Changes

IT Admins

• Added support for running custom Android MDM commands via the Fleet API.
• Added support for listing and viewing results of Android custom MDM commands via the API and fleetctl CLI.
• Added support for automatically installing in-house apps (.ipa) on iOS and iPadOS hosts when they enroll into Fleet.
• Added Windows devices registered in a connected Microsoft Entra tenant's Autopilot registry to Fleet as pending hosts before they enroll; they become regular hosts on enrollment without creating a duplicate.
• Added support for resending a configuration profile on policy failure as part of a policy automation.
• Added collection of additional Android host vitals from AMAPI status reports (USB debugging, passcode set, Google Play Protect, encryption status, manufacturer, security update version, kernel and bootloader version, software update status, API level, security posture, and per-SIM phone numbers), returned by the get host endpoints for Android hosts.
• Added a QR code for the enrollment link on the Android and iOS/iPadOS tabs of the Add hosts modal, so the enrollment flow can be started by scanning instead of copying the link to a device.
• Added the osquery.config_in_memory_cache server configuration option and disabled the in-memory cache of the osquery config's scheduled-report section by default; set it to true to re-enable the cache.
• Added server.endpoint_request_size_overrides to configure a max request body size per API endpoint, with the largest of the endpoint's default and the override winning.
• Added mdm.is_personal_enrollment to host API responses, reporting whether the last MDM enrollment Fleet recorded for the host was personal (BYOD). Unlike mdm.enrollment_status, it is not cleared when the host unenrolls.
• Added mdm.bootstrap_token_escrowed to the get host and get host by Fleet Desktop token API responses, so admins can see whether Fleet has escrowed a macOS host's bootstrap token without querying the database directly.
• Added support for display_name on Fleet-maintained apps in GitOps.
• Added the ability to sort the versions table by version on the Software details page.

Security Engineers

• Added per-platform disk encryption settings: enforcement and key escrow for macOS, enforcement for Windows, and key escrow for Linux.
• Added a new "End user authentication" setting (fleet_desktop.sso_enabled, Fleet Premium) that requires end users to sign in via single sign-on (SSO) before accessing Fleet Desktop's "My device" page.
• Added a severity (CVSS score) filter to the Vulnerability exposure dashboard chart, which now requires Fleet Premium, and updated the severity filter on the Software, Host details, and My device pages so the min and max score inputs appear only when custom severity is selected.
• Added an audit activity when a deprovisioned SCIM user has no email to match a Fleet account, so operators can spot accounts that may remain active.
• Added the ability to cancel a pending Apple MDM lock, wipe, clear passcode, or enable lost mode command before the host receives it, via DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid. If the host executes a canceled lock or wipe anyway, Fleet now restores the host's lock/wipe state (including the unlock PIN) when the result arrives.

Bug fixes and improvements

• Reduced the size of the Fleet UI JavaScript bundle by ~89% (14.9 MB to 1.6 MB gzipped) by serving Fleet-maintained app icons as individual static files instead of embedding all ~1,100 of them in the bundle downloaded on every page load.
• Reduced the size of the Fleet UI JavaScript bundle by a further ~62% (1.6 MB to 632 KB gzipped) by loading each page's code when its route is opened rather than compiling every page into the bundle downloaded on first load.
• Reduced memory usage of the vulnerabilities cron by streaming NVD matches to the database in bounded chunks instead of holding every matched vulnerability in memory (8.5 GB → 2.1 GB peak on a 22.7M-match fleet), and inserts now start during matching so large fleets no longer exceed the vulnerability processing time limit.
• Reduced database load when processing osquery result logs by resolving scheduled query names in a single batch lookup instead of one query per result.
• Added an "Inactive" status with an explanatory tooltip to the Users table for accounts that haven't been used for 30+ days. Regular users are inactive when they haven't logged in (or had session activity) for 30+ days; API-only users are inactive when their token has made no API requests for 30+ days. Fleet now records each user's last login time in a new last_login_at field, reports last session activity in a new last_activity_at field, and returns a server-computed status field (active, inactive, or no_access) from the users API.
• Added an experimental WebSocket notification transport for fleetd agents (ADR-0011), disabled by default (enable with the websocket.transport_enabled server configuration): connected agents are pushed a "check now" notification when a live query targets them or when interval work (labels, policies, host vitals, refetch) is due, instead of polling distributed/read every 10 seconds.
• Added conditional request (etag) support to the osquery config endpoint (/api/osquery/config), behind the osquery.config_etags server option (FLEET_OSQUERY_CONFIG_ETAGS, default off). When it's enabled, agents that send an etag field in the request body receive the minimal {"etag":"ok"} response when their configuration is unchanged, reducing agent config bandwidth; agents that don't send the field see no change. While it's off, every config request is served exactly as before.
• Added an osquery.redis_config_etags server option (FLEET_OSQUERY_REDIS_CONFIG_ETAGS, default off, and requires osquery.config_etags): when both are enabled, config check-ins with a matching etag are answered directly from a Redis-backed ETag store, skipping the config build and its database reads entirely. Fleets with uniform configs share one ETag per fleet and platform; fleets with label-scoped reports use isolated per-host ETags invalidated whenever a host's label results are recorded. The short circuit fails open (any Redis error falls back to a full build) and is bypassed automatically for deployments with 2017 packs.
• Windows user-scoped configuration profiles (./User/...) are now held in "Pending" until a user signs in, instead of failing during setup. On hosts enrolled by a user (Windows Autopilot, Entra ID) that user releases the hold; on hosts enrolled by installing fleetd, any signed-in user does, and Windows applies the settings to whoever is signed in. User-scoped profiles that already failed on an earlier Fleet version are not resent automatically: after upgrading, resend them once (or edit the profile) and Fleet will deliver them when a user is signed in.
• Removing a Windows user-scoped configuration profile now waits for a signed-in user as well, instead of being reported as removed while the setting was still applied.
• Windows configuration profiles now retry up to 3 times before being marked "Failed", matching Apple. Retries cover profiles the host rejects and profiles whose Fleet-proxied SCEP certificate never arrives. A profile stays "Pending" while Fleet retries.
• Fleet no longer marks a configuration profile "Failed" when it briefly can't reach the NDES admin URL to fetch a SCEP challenge. The profile stays pending and Fleet tries again. Challenge failures that need an admin to act (invalid credentials, a full password cache, or an account without SCEP enroll permission) still fail the profile immediately with the same message as before.
• Escaped values interpolated into the conditional access Apple configuration profile so a value containing markup is carried as literal text.
• Fleet now clears dynamic labels and pending commands and software installs when an Android host re-enrolls. Manually assigned labels are preserved, and pending software installs are reported as failed. Past host activities for the host are also cleared unless preserve_host_activities_on_reenrollment is enabled.
• Increased Android certificate delivery retries from 3 to 7 and added exponential backoff between attempts.
• Improved SCIM user deactivation to more reliably deprovision the matching Fleet user.
• Moved the host's OS settings table out of the "OS settings" modal into a dedicated Controls tab on Host details and My device.
• Moved toast notifications to the bottom center of the screen so they no longer cover buttons in the bottom-right of pages and modals.
• Updated the macOS enroll modal's "Company-owned" label and helper text to match iOS/iPadOS and Android ("Company-owned (fully-managed)").
• Updated wipe modal for Apple and Windows hosts to call out deleting may remove the Wipe Pending status.
• Updated the message end users see when they take too long to sign in during MDM enrollment to say their session may have timed out, instead of a generic error.
• Added a descriptive message when a script produces empty standard output.
• Improved fleetctl generate-gitops to emit software titles in name order instead of the default hosts_count order.
• Improved the hosts report CSV export (GET /api/v1/fleet/hosts/report) so that exported cell values are treated as text by spreadsheet applications.
• Changed duration fields in Fleet server logs (e.g. took) to render as human-readable strings with time units (e.g. "1.116187ms") instead of raw nanosecond numbers. Log pipelines that parse these fields numerically will need to be updated.
• Changed requests denied by an API-only user's endpoint restrictions to return a distinct 403 message ("endpoint not permitted for this API-only user"), logged at info level with the route and denial reason, so they can be distinguished from role-based permission denials.
• Enforced API-only endpoint restrictions on the debug routes so a restricted API-only token can no longer reach /debug/*.
• Removed the unused jq binary from the fleetdm/fleet Docker image to reduce the image's attack surface and prevent SBOM scanners from flagging jq CVEs.
• Deprecated osquery_max_log_write_body_size and osquery_max_distributed_write_body_size in favor of new configs.
• Deprecated fleetdm/bomutils docker image. Starting in 4.90.0, fleetctl does not use fleetdm/bomutils to generate .pkg fleetd installers.
• Updated the EPSS scores feed to download from its new canonical URL (epss.empiricalsecurity.com) instead of relying on the redirect from the old host (epss.cyentia.com).
• Improved outbound address filtering to cover the unspecified addresses (0.0.0.0 and ::), the deprecated IPv4-compatible IPv6 form, and IPv4 addresses reached through a NAT64 prefix.
• Made vulnerability host count updates recover automatically after an interrupted table swap.
• Added support for sending blank APNS pings to Apple devices.
• Improved parsing of Apple MachineInfo blobs during enrollment.
• Improved validation of the order_key parameter when listing software, rejecting sort keys that aren't supported instead of passing them through to the query.
• Improved validation of the order_key parameter on GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities, rejecting unsupported sort keys.
• Added MDM profile counts (Apple, Windows, Android configuration profiles and Apple DDM declarations) to usage statistics for troubleshooting.
• Added conditional config request support to osquery-perf simulated hosts, including stats for conditional requests and estimated bandwidth saved, for load-testing the above.
• Added a useFormValidation hook as the single source of truth for the documented form validation behavior, and applied it to the new user and new API-only user forms.
• Updated the DDM asset error message shown when the Authentication key is provided to explain that Fleet defaults to MDM authentication.
• Removed mention of osquery when viewing a DDM profile that is verifying.
• Removed the QR code from the "Add hosts" enrollment instructions for company-owned Android hosts, since fully-managed enrollment isn't done by scanning a code.
• Disabled the Save button in the end user migration workflow while a request is in flight.
• Documented why safari_extensions returns empty without Full Disk Access or a uid constraint (users JOIN/CROSS JOIN, or WHERE uid = ...), noted the /Applications-only scan limitation, fixed standard Safari inventory SQL to include a users CROSS JOIN, and replaced legacy .safariextz bash equivalents with modern Safari App/Web Extension paths.
• Fleet now restores BitLocker protection on Windows hosts that are encrypted but whose protection is off, where disk encryption is enforced. This includes hosts that require a startup PIN but do not have one yet, and hosts where an admin, third-party software, or a previous MDM forbade the TPM-only protector Fleet needs, which Fleet now clears. Such a host shows "Enforcing" while Fleet repairs it, and "Action required" with the reason in its disk encryption details only once fleetd reports it cannot.
• Fixed a Windows host's disk encryption status naming an action the end user cannot take. A host whose protection is off no longer asks them to create a BitLocker PIN, since Windows only offers PIN setup on a protected volume, and a repair waiting on a pending restart now asks for that restart on both the host details page and the end user's My device page.
• Fixed an issue where a second user signing in to a Windows device that was already enrolled via Autopilot would get stuck on the "Account setup" Enrollment Status Page for up to 3 hours.
• Fixed built-in and starter library Linux labels being too strict to match derived distributions, so hosts running Pop!_OS, Linux Mint, Zorin OS, Debian, older Fedora releases, Amazon Linux, and SUSE now appear in the Linux labels that apply to them.
• Fixed an upgrade failure where a MySQL "Prepared statement needs to be re-prepared" error (1615) aborted a database migration instead of being retried.
• Fixed osquery and orbit config endpoints returning HTTP 500 when a host references a recently deleted team by invalidating the Redis host cache on team deletion.
• Fixed the dashboard "Hosts enrolled" chart drill-down including pending hosts in the filtered host list, by adding an "Enrolled hosts" status filter (status=enrolled on the list hosts and count hosts endpoints) that excludes hosts pending MDM enrollment.
• Fixed pending hosts (Apple Business Manager, Windows Autopilot) showing a "Fetching fresh vitals" spinner and a "This host is offline. Please try refetching host vitals later." error on the host details page, even though nobody asked for a refetch.
• Fixed "Turn off MDM" being available again after it succeeded, which let an offline host be sent duplicate unenroll commands.
• Fixed an Apple configuration profile that was removed and then added back before the host came online being stripped from the host and reinstalled, instead of staying in place.
• Fixed ACME certificates deployed via user-scoped profiles not showing on the macOS host details page, and recorded them under the enrolled user's scope instead of the system keychain.
• Fixed an issue where a misleading detail was shown for pending/verifying DDM profiles.
• Fixed iOS/iPadOS refetch getting blocked when an online device acknowledged a refetch command before Fleet finished recording the command as sent.
• Fixed duplicate IdP device mapping ("2 users") shown for a host after it re-enrolled through ADE with end user authentication when its IdP username had previously been set manually. The enrollment now replaces the manually set mapping instead of adding a second one.
• Fixed the host details Vitals card replacing Enrollment ID with an empty Serial number after a personal (BYOD) Android host is unenrolled.
• Fixed Android MDM commands returning 500 instead of the actual error code from the Google Android Enterprise API.
• Fixed an issue where Homebrew cask metadata for a Fleet-maintained app (macOS) could reach the generated install/uninstall scripts without being escaped for shell use. All cask-controlled values interpolated into generated scripts are now escaped, so shell metacharacters in the metadata are treated as literal text.
• Fixed macOS Fleet-maintained apps with in-bundle login items or background helpers (e.g. 1Password's browser helper) always being detected as open. The Fleet-managed "app is open" check now matches only the app's own executable instead of any process running inside the app bundle.
• Fixed Fleet-maintained apps selecting the wrong version to be active.
• Fixed the Fleet-maintained app auto-update cron not updating install and uninstall scripts when it advances an app to a new version.
• Fixed the Fleet-maintained apps auto-update cron job not updating scripts when they change in the manifest without a version change.
• Fixed software search to match on bundle_identifier and custom display_name so admins and end users can find macOS custom packages by their visible name.
• Fixed the transient empty state shown when changing Self-service search and category filters.
• Fixed self-service reinstall and uninstall buttons remaining disabled after cancelling the uninstall confirmation modal.
• Fixed the VPP install details modal retrying the command results request four times when the result isn't available yet and the API returns a 404.
• Fixed activity feed rendering a blank actor for failed iPad VPP installs: auto-update terminal failures now attribute to Fleet, and any install whose initiating admin has since been deleted also renders "Fleet" instead of an empty name.
• Fixed uninstalling .sh and .py script packages from macOS hosts, which was rejected even though installing them there is allowed. The rejection message for other platforms now names them the same way the install message does ("macOS and Linux" rather than "linux").
• Fixed the "Advanced options" reveal button on the Edit software modal not expanding for .msix packages (e.g., Claude, Slack on Windows), which prevented users from viewing or editing install/uninstall scripts.
• Fixed the error toast shown when selecting a custom package with an unsupported extension so the friendly message stays on the main line and the extension reason appears in the expandable raw-response panel.
• Fixed the Save button never activating when adding a package from the software title page while GitOps mode is enabled.
• Fixed the "Software" automation filter on the Policies page to no longer include patch policies. Added a dedicated "Patch" filter option.
• Fixed the total number of retries of a failing software install automation across policy runs not being limited.
• Fixed exclude-label-scoped policies running, and their automations firing, on newly enrolled hosts before the host had evaluated the label's membership.
• Fixed an issue where label-scoped reports could run on hosts outside the target label (or be skipped for hosts inside it).
• Fixed a race where a newly created or edited label-scoped query could briefly be delivered to every host (and out-of-scope results stored in its report) because the query row was committed before its labels.
• Fixed built-in labels being overwritten, renamed, or deleted by supplying a label name that differs from the built-in name only in letter casing.
• Fixed the modify label endpoint so that a dynamic label's membership can no longer be cleared by sending an empty hosts or host_ids list, which is now rejected like a non-empty one.
• Fixed the label spec endpoints so that the host membership list only includes hosts the requesting user is authorized to see, preventing cross-team host ID disclosure through global manual labels.
• Fixed an issue where disabled packs could still be applied to hosts in certain targeting configurations.
• Fixed query (report) results submitted to /api/osquery/log so that they are only accepted when the query is actually scheduled for the submitting host, preventing an enrolled host from adding rows to reports it was never assigned or from streaming results for those queries to a log destination.
• Fixed report descriptions so that newlines are preserved when the description is displayed, instead of being collapsed onto a single line.
• Fixed the fleet and global schedule endpoints accepting reports that belong to a different fleet, and made them return the same "not found" response for a report outside the caller's access as for one that doesn't exist.
• Fixed live query authorization so that an empty team selection is authorized like an omitted one.
• Fixed policy result ingestion so a host can no longer report results for policies it is not assigned, preventing forged policy membership across fleet, platform, and label scopes.
• Fixed an issue where an activity might not be created when an MDM command was enqueued via the API.
• Fixed GET /api/v1/fleet/hosts/identifier/:identifier disclosing host details to GitOps users, who are denied on all other host read endpoints. Unlike GET /api/v1/fleet/hosts/:id, which returns an error for GitOps users, this endpoint still succeeds and returns the host's id (and nothing else), for backwards compatibility with the deprecated Puppet module.
• Fixed authentication and enrollment tokens (including session, invite, email-change, MFA, host device, and MDM enrollment/installer tokens) so that case-mutated tokens are no longer accepted; these tokens are now matched case-sensitively.
• Fixed deleting a certificate template that doesn't exist returning a 500 internal server error. Users authorized to manage certificate templates now get a 404, and users who aren't get a 403 whether or not the template exists.
• Fixed getting a certificate template by ID disclosing whether templates a user can't access exist. Reading a template on another fleet now returns a 404, the same as a template that doesn't exist.
• Fixed the add/edit certificate authority modals showing a generic "Please try again." error instead of the invalid URL error returned by the server. The error now names the certificate authority, for example "Invalid Hydrant URL. Please correct and try again."
• Fixed editing only the username or only the password of an NDES SCEP certificate authority skipping validation against the NDES server. Fleet now verifies the credentials on save and returns an error if they're wrong, instead of saving a broken certificate authority whose misconfiguration only surfaced later as a profile failure on hosts.
• Fixed editing only the SCEP URL of an NDES SCEP certificate authority failing with a "password" must be set when modifying an existing certificate authority error. The password field is now cleared when the SCEP URL changes, so it's re-entered and sent with the update.
• Fixed an empty username or password being saved on an NDES SCEP certificate authority.
• Fixed adding or editing a certificate authority with a bad NDES admin URL or credentials showing a generic "Please try again." message instead of "Invalid admin URL or credentials."
• Fixed updating an NDES SCEP certificate authority with the masked password (********) returned by the GET endpoint sending the mask to the NDES server as the literal password and failing with a misleading "invalid credentials" error. The mask is now rejected with an invalid-password error, matching GitOps behavior.
• Fleet now skips validating NDES credentials against the NDES server when an update leaves the admin URL, username, and password unchanged, so a no-op edit doesn't consume a slot in NDES's password cache.
• Fixed an unreachable NDES admin URL (timeout, DNS failure, connection refused) being reported as "Invalid admin URL or credentials" when editing an NDES SCEP certificate authority. It's now reported as "Couldn't connect to admin URL."
• Fixed the Save button staying enabled in the edit certificate authority modal after Fleet clears the unchanged NDES password, which let the form submit an empty password.
• Fixed editing a Windows configuration profile so that uploading a replacement file with a different name updates the profile's name.
• Fixed uploading a Windows configuration profile with a file name longer than 255 characters returning a database error.
• Fixed a bug where Windows disk encryption showed a "Resend" action that always failed, since BitLocker enforcement isn't a configuration profile.
• Fixed an issue where Observer, Observer+ and Technician could not see the managed account rotation banner.
• Fixed the error returned when a free-tier request sets a premium-only field so that it names the field as it appears in the request payload (for example critical) instead of Fleet's internal Go field name (for example Critical).
• Fixed a query returning a MySQL error if hit with unsupported platforms, by now returning an empty result.
• Fixed an issue where stale fleet names could appear in mdm.apple_business after renaming a fleet.
• Fixed false positive vulnerabilities reported for JetBrains teamcity-cli installed via Homebrew, which was incorrectly matched to the TeamCity CI server's CPE.
• Fixed fleetctl gitops silently dropping ios_updates and ipados_updates when it creates a new fleet.
• Fixed fleetctl generate-gitops failing with an unsupported Content-Type error when the org logo is an SVG.
• Fixed fleetctl generate-gitops not using .sh and .ps1 extensions for install scripts.
• Fixed an issue where deleting an ADE device after turning off Apple Business could leave orphaned rows.
• Fixed form validation on the new/edit user and API-only user forms: field errors no longer appear before a field has been edited, clear as soon as the field is focused, and the "select at least one fleet" error now renders on the selector instead of as a toast.
• Updated validation error copy on the new/edit user and API-only user forms to the standard wording (e.g. "Enter an email" instead of "Email field must be completed").
• Fixed the fleet, role, and API access controls staying editable while a user was being saved on the new/edit user and API-only user forms.
• Fixed error toasts showing an expandable "Raw response" panel containing an empty {} when the underlying error carried no details.
• Fixed inconsistent spacing around the enrollment URL on the iOS & iPadOS tab of the Add hosts modal, so it now matches the macOS and Android tabs.
• Fixed the confirmation checkbox on the "Clear passcode" host modal rendering in green instead of red, so it now matches the destructive "Clear passcode" button.
• Fixed incorrect background color on authentication pages (login, SSO, registration) in dark mode.
• Fixed autofilled inputs showing a white background in dark mode. The autofill style now uses theme colors instead of a hardcoded white, and covers Firefox via the standard :autofill selector.
• Fixed label color for install/post-install/uninstall script fields in software package advanced options to match Fleet's standard form label color.
• Fixed long unbreakable words (e.g. file paths in inline code) overflowing the table info side panel on the report and policy editor pages.
• Matched the height of the host status and platform/label filter dropdowns on the Hosts page.
• Fixed the "Collecting results..." empty state on the report details page reading "about about X hours".

Ready to upgrade?

Visit our Upgrade guide in the Fleet docs to update to Fleet 4.92.0.

Manage all your devices like it's 2026
Open MDM, patching, and vuln management for every OS.

Read case studies
Try it yourself

Fleet 4.92.0 (Sep 21, 2026)

IT Admins

• Added support for running custom Android MDM commands via the Fleet API.
• Added support for listing and viewing results of Android custom MDM commands via the API and fleetctl CLI.
• Added support for automatically installing in-house apps (.ipa) on iOS and iPadOS hosts when they enroll into Fleet.
• Added Windows devices registered in a connected Microsoft Entra tenant's Autopilot registry to Fleet as pending hosts before they enroll; they become regular hosts on enrollment without creating a duplicate.
• Added support for resending a configuration profile on policy failure as part of a policy automation.
• Added collection of additional Android host vitals from AMAPI status reports (USB debugging, passcode set, Google Play Protect, encryption status, manufacturer, security update version, kernel and bootloader version, software update status, API level, security posture, and per-SIM phone numbers), returned by the get host endpoints for Android hosts.
• Added a QR code for the enrollment link on the Android and iOS/iPadOS tabs of the Add hosts modal, so the enrollment flow can be started by scanning instead of copying the link to a device.
• Added the osquery.config_in_memory_cache server configuration option and disabled the in-memory cache of the osquery config's scheduled-report section by default; set it to true to re-enable the cache.
• Added server.endpoint_request_size_overrides to configure a max request body size per API endpoint, with the largest of the endpoint's default and the override winning.
• Added mdm.is_personal_enrollment to host API responses, reporting whether the last MDM enrollment Fleet recorded for the host was personal (BYOD). Unlike mdm.enrollment_status, it is not cleared when the host unenrolls.
• Added mdm.bootstrap_token_escrowed to the get host and get host by Fleet Desktop token API responses, so admins can see whether Fleet has escrowed a macOS host's bootstrap token without querying the database directly.
• Added support for display_name on Fleet-maintained apps in GitOps.
• Added the ability to sort the versions table by version on the Software details page.

Security Engineers

• Added per-platform disk encryption settings: enforcement and key escrow for macOS, enforcement for Windows, and key escrow for Linux.
• Added a new "End user authentication" setting (fleet_desktop.sso_enabled, Fleet Premium) that requires end users to sign in via single sign-on (SSO) before accessing Fleet Desktop's "My device" page.
• Added a severity (CVSS score) filter to the Vulnerability exposure dashboard chart, which now requires Fleet Premium, and updated the severity filter on the Software, Host details, and My device pages so the min and max score inputs appear only when custom severity is selected.
• Added an audit activity when a deprovisioned SCIM user has no email to match a Fleet account, so operators can spot accounts that may remain active.
• Added the ability to cancel a pending Apple MDM lock, wipe, clear passcode, or enable lost mode command before the host receives it, via DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid. If the host executes a canceled lock or wipe anyway, Fleet now restores the host's lock/wipe state (including the unlock PIN) when the result arrives.

Bug fixes and improvements

• Reduced the size of the Fleet UI JavaScript bundle by ~89% (14.9 MB to 1.6 MB gzipped) by serving Fleet-maintained app icons as individual static files instead of embedding all ~1,100 of them in the bundle downloaded on every page load.
• Reduced the size of the Fleet UI JavaScript bundle by a further ~62% (1.6 MB to 632 KB gzipped) by loading each page's code when its route is opened rather than compiling every page into the bundle downloaded on first load.
• Reduced memory usage of the vulnerabilities cron by streaming NVD matches to the database in bounded chunks instead of holding every matched vulnerability in memory (8.5 GB → 2.1 GB peak on a 22.7M-match fleet), and inserts now start during matching so large fleets no longer exceed the vulnerability processing time limit.
• Reduced database load when processing osquery result logs by resolving scheduled query names in a single batch lookup instead of one query per result.
• Added an "Inactive" status with an explanatory tooltip to the Users table for accounts that haven't been used for 30+ days. Regular users are inactive when they haven't logged in (or had session activity) for 30+ days; API-only users are inactive when their token has made no API requests for 30+ days. Fleet now records each user's last login time in a new last_login_at field, reports last session activity in a new last_activity_at field, and returns a server-computed status field (active, inactive, or no_access) from the users API.
• Added an experimental WebSocket notification transport for fleetd agents (ADR-0011), disabled by default (enable with the websocket.transport_enabled server configuration): connected agents are pushed a "check now" notification when a live query targets them or when interval work (labels, policies, host vitals, refetch) is due, instead of polling distributed/read every 10 seconds.
• Added conditional request (etag) support to the osquery config endpoint (/api/osquery/config), behind the osquery.config_etags server option (FLEET_OSQUERY_CONFIG_ETAGS, default off). When it's enabled, agents that send an etag field in the request body receive the minimal {"etag":"ok"} response when their configuration is unchanged, reducing agent config bandwidth; agents that don't send the field see no change. While it's off, every config request is served exactly as before.
• Added an osquery.redis_config_etags server option (FLEET_OSQUERY_REDIS_CONFIG_ETAGS, default off, and requires osquery.config_etags): when both are enabled, config check-ins with a matching etag are answered directly from a Redis-backed ETag store, skipping the config build and its database reads entirely. Fleets with uniform configs share one ETag per fleet and platform; fleets with label-scoped reports use isolated per-host ETags invalidated whenever a host's label results are recorded. The short circuit fails open (any Redis error falls back to a full build) and is bypassed automatically for deployments with 2017 packs.
• Windows user-scoped configuration profiles (./User/...) are now held in "Pending" until a user signs in, instead of failing during setup. On hosts enrolled by a user (Windows Autopilot, Entra ID) that user releases the hold; on hosts enrolled by installing fleetd, any signed-in user does, and Windows applies the settings to whoever is signed in. User-scoped profiles that already failed on an earlier Fleet version are not resent automatically: after upgrading, resend them once (or edit the profile) and Fleet will deliver them when a user is signed in.
• Removing a Windows user-scoped configuration profile now waits for a signed-in user as well, instead of being reported as removed while the setting was still applied.
• Windows configuration profiles now retry up to 3 times before being marked "Failed", matching Apple. Retries cover profiles the host rejects and profiles whose Fleet-proxied SCEP certificate never arrives. A profile stays "Pending" while Fleet retries.
• Fleet no longer marks a configuration profile "Failed" when it briefly can't reach the NDES admin URL to fetch a SCEP challenge. The profile stays pending and Fleet tries again. Challenge failures that need an admin to act (invalid credentials, a full password cache, or an account without SCEP enroll permission) still fail the profile immediately with the same message as before.
• Escaped values interpolated into the conditional access Apple configuration profile so a value containing markup is carried as literal text.
• Fleet now clears dynamic labels and pending commands and software installs when an Android host re-enrolls. Manually assigned labels are preserved, and pending software installs are reported as failed. Past host activities for the host are also cleared unless preserve_host_activities_on_reenrollment is enabled.
• Increased Android certificate delivery retries from 3 to 7 and added exponential backoff between attempts.
• Improved SCIM user deactivation to more reliably deprovision the matching Fleet user.
• Moved the host's OS settings table out of the "OS settings" modal into a dedicated Controls tab on Host details and My device.
• Moved toast notifications to the bottom center of the screen so they no longer cover buttons in the bottom-right of pages and modals.
• Updated the macOS enroll modal's "Company-owned" label and helper text to match iOS/iPadOS and Android ("Company-owned (fully-managed)").
• Updated wipe modal for Apple and Windows hosts to call out deleting may remove the Wipe Pending status.
• Updated the message end users see when they take too long to sign in during MDM enrollment to say their session may have timed out, instead of a generic error.
• Added a descriptive message when a script produces empty standard output.
• Improved fleetctl generate-gitops to emit software titles in name order instead of the default hosts_count order.
• Improved the hosts report CSV export (GET /api/v1/fleet/hosts/report) so that exported cell values are treated as text by spreadsheet applications.
• Changed duration fields in Fleet server logs (e.g. took) to render as human-readable strings with time units (e.g. "1.116187ms") instead of raw nanosecond numbers. Log pipelines that parse these fields numerically will need to be updated.
• Changed requests denied by an API-only user's endpoint restrictions to return a distinct 403 message ("endpoint not permitted for this API-only user"), logged at info level with the route and denial reason, so they can be distinguished from role-based permission denials.
• Enforced API-only endpoint restrictions on the debug routes so a restricted API-only token can no longer reach /debug/*.
• Removed the unused jq binary from the fleetdm/fleet Docker image to reduce the image's attack surface and prevent SBOM scanners from flagging jq CVEs.
• Deprecated osquery_max_log_write_body_size and osquery_max_distributed_write_body_size in favor of new configs.
• Deprecated fleetdm/bomutils docker image. Starting in 4.90.0, fleetctl does not use fleetdm/bomutils to generate .pkg fleetd installers.
• Updated the EPSS scores feed to download from its new canonical URL (epss.empiricalsecurity.com) instead of relying on the redirect from the old host (epss.cyentia.com).
• Improved outbound address filtering to cover the unspecified addresses (0.0.0.0 and ::), the deprecated IPv4-compatible IPv6 form, and IPv4 addresses reached through a NAT64 prefix.
• Made vulnerability host count updates recover automatically after an interrupted table swap.
• Added support for sending blank APNS pings to Apple devices.
• Improved parsing of Apple MachineInfo blobs during enrollment.
• Improved validation of the order_key parameter when listing software, rejecting sort keys that aren't supported instead of passing them through to the query.
• Improved validation of the order_key parameter on GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities, rejecting unsupported sort keys.
• Added MDM profile counts (Apple, Windows, Android configuration profiles and Apple DDM declarations) to usage statistics for troubleshooting.
• Added conditional config request support to osquery-perf simulated hosts, including stats for conditional requests and estimated bandwidth saved, for load-testing the above.
• Added a useFormValidation hook as the single source of truth for the documented form validation behavior, and applied it to the new user and new API-only user forms.
• Updated the DDM asset error message shown when the Authentication key is provided to explain that Fleet defaults to MDM authentication.
• Removed mention of osquery when viewing a DDM profile that is verifying.
• Removed the QR code from the "Add hosts" enrollment instructions for company-owned Android hosts, since fully-managed enrollment isn't done by scanning a code.
• Disabled the Save button in the end user migration workflow while a request is in flight.
• Documented why safari_extensions returns empty without Full Disk Access or a uid constraint (users JOIN/CROSS JOIN, or WHERE uid = ...), noted the /Applications-only scan limitation, fixed standard Safari inventory SQL to include a users CROSS JOIN, and replaced legacy .safariextz bash equivalents with modern Safari App/Web Extension paths.
• Fleet now restores BitLocker protection on Windows hosts that are encrypted but whose protection is off, where disk encryption is enforced. This includes hosts that require a startup PIN but do not have one yet, and hosts where an admin, third-party software, or a previous MDM forbade the TPM-only protector Fleet needs, which Fleet now clears. Such a host shows "Enforcing" while Fleet repairs it, and "Action required" with the reason in its disk encryption details only once fleetd reports it cannot.
• Fixed a Windows host's disk encryption status naming an action the end user cannot take. A host whose protection is off no longer asks them to create a BitLocker PIN, since Windows only offers PIN setup on a protected volume, and a repair waiting on a pending restart now asks for that restart on both the host details page and the end user's My device page.
• Fixed an issue where a second user signing in to a Windows device that was already enrolled via Autopilot would get stuck on the "Account setup" Enrollment Status Page for up to 3 hours.
• Fixed built-in and starter library Linux labels being too strict to match derived distributions, so hosts running Pop!_OS, Linux Mint, Zorin OS, Debian, older Fedora releases, Amazon Linux, and SUSE now appear in the Linux labels that apply to them.
• Fixed an upgrade failure where a MySQL "Prepared statement needs to be re-prepared" error (1615) aborted a database migration instead of being retried.
• Fixed osquery and orbit config endpoints returning HTTP 500 when a host references a recently deleted team by invalidating the Redis host cache on team deletion.
• Fixed the dashboard "Hosts enrolled" chart drill-down including pending hosts in the filtered host list, by adding an "Enrolled hosts" status filter (status=enrolled on the list hosts and count hosts endpoints) that excludes hosts pending MDM enrollment.
• Fixed pending hosts (Apple Business Manager, Windows Autopilot) showing a "Fetching fresh vitals" spinner and a "This host is offline. Please try refetching host vitals later." error on the host details page, even though nobody asked for a refetch.
• Fixed "Turn off MDM" being available again after it succeeded, which let an offline host be sent duplicate unenroll commands.
• Fixed an Apple configuration profile that was removed and then added back before the host came online being stripped from the host and reinstalled, instead of staying in place.
• Fixed ACME certificates deployed via user-scoped profiles not showing on the macOS host details page, and recorded them under the enrolled user's scope instead of the system keychain.
• Fixed an issue where a misleading detail was shown for pending/verifying DDM profiles.
• Fixed iOS/iPadOS refetch getting blocked when an online device acknowledged a refetch command before Fleet finished recording the command as sent.
• Fixed duplicate IdP device mapping ("2 users") shown for a host after it re-enrolled through ADE with end user authentication when its IdP username had previously been set manually. The enrollment now replaces the manually set mapping instead of adding a second one.
• Fixed the host details Vitals card replacing Enrollment ID with an empty Serial number after a personal (BYOD) Android host is unenrolled.
• Fixed Android MDM commands returning 500 instead of the actual error code from the Google Android Enterprise API.
• Fixed an issue where Homebrew cask metadata for a Fleet-maintained app (macOS) could reach the generated install/uninstall scripts without being escaped for shell use. All cask-controlled values interpolated into generated scripts are now escaped, so shell metacharacters in the metadata are treated as literal text.
• Fixed macOS Fleet-maintained apps with in-bundle login items or background helpers (e.g. 1Password's browser helper) always being detected as open. The Fleet-managed "app is open" check now matches only the app's own executable instead of any process running inside the app bundle.
• Fixed Fleet-maintained apps selecting the wrong version to be active.
• Fixed the Fleet-maintained app auto-update cron not updating install and uninstall scripts when it advances an app to a new version.
• Fixed the Fleet-maintained apps auto-update cron job not updating scripts when they change in the manifest without a version change.
• Fixed software search to match on bundle_identifier and custom display_name so admins and end users can find macOS custom packages by their visible name.
• Fixed the transient empty state shown when changing Self-service search and category filters.
• Fixed self-service reinstall and uninstall buttons remaining disabled after cancelling the uninstall confirmation modal.
• Fixed the VPP install details modal retrying the command results request four times when the result isn't available yet and the API returns a 404.
• Fixed activity feed rendering a blank actor for failed iPad VPP installs: auto-update terminal failures now attribute to Fleet, and any install whose initiating admin has since been deleted also renders "Fleet" instead of an empty name.
• Fixed uninstalling .sh and .py script packages from macOS hosts, which was rejected even though installing them there is allowed. The rejection message for other platforms now names them the same way the install message does ("macOS and Linux" rather than "linux").
• Fixed the "Advanced options" reveal button on the Edit software modal not expanding for .msix packages (e.g., Claude, Slack on Windows), which prevented users from viewing or editing install/uninstall scripts.
• Fixed the error toast shown when selecting a custom package with an unsupported extension so the friendly message stays on the main line and the extension reason appears in the expandable raw-response panel.
• Fixed the Save button never activating when adding a package from the software title page while GitOps mode is enabled.
• Fixed the "Software" automation filter on the Policies page to no longer include patch policies. Added a dedicated "Patch" filter option.
• Fixed the total number of retries of a failing software install automation across policy runs not being limited.
• Fixed exclude-label-scoped policies running, and their automations firing, on newly enrolled hosts before the host had evaluated the label's membership.
• Fixed an issue where label-scoped reports could run on hosts outside the target label (or be skipped for hosts inside it).
• Fixed a race where a newly created or edited label-scoped query could briefly be delivered to every host (and out-of-scope results stored in its report) because the query row was committed before its labels.
• Fixed built-in labels being overwritten, renamed, or deleted by supplying a label name that differs from the built-in name only in letter casing.
• Fixed the modify label endpoint so that a dynamic label's membership can no longer be cleared by sending an empty hosts or host_ids list, which is now rejected like a non-empty one.
• Fixed the label spec endpoints so that the host membership list only includes hosts the requesting user is authorized to see, preventing cross-team host ID disclosure through global manual labels.
• Fixed an issue where disabled packs could still be applied to hosts in certain targeting configurations.
• Fixed query (report) results submitted to /api/osquery/log so that they are only accepted when the query is actually scheduled for the submitting host, preventing an enrolled host from adding rows to reports it was never assigned or from streaming results for those queries to a log destination.
• Fixed report descriptions so that newlines are preserved when the description is displayed, instead of being collapsed onto a single line.
• Fixed the fleet and global schedule endpoints accepting reports that belong to a different fleet, and made them return the same "not found" response for a report outside the caller's access as for one that doesn't exist.
• Fixed live query authorization so that an empty team selection is authorized like an omitted one.
• Fixed policy result ingestion so a host can no longer report results for policies it is not assigned, preventing forged policy membership across fleet, platform, and label scopes.
• Fixed an issue where an activity might not be created when an MDM command was enqueued via the API.
• Fixed GET /api/v1/fleet/hosts/identifier/:identifier disclosing host details to GitOps users, who are denied on all other host read endpoints. Unlike GET /api/v1/fleet/hosts/:id, which returns an error for GitOps users, this endpoint still succeeds and returns the host's id (and nothing else), for backwards compatibility with the deprecated Puppet module.
• Fixed authentication and enrollment tokens (including session, invite, email-change, MFA, host device, and MDM enrollment/installer tokens) so that case-mutated tokens are no longer accepted; these tokens are now matched case-sensitively.
• Fixed deleting a certificate template that doesn't exist returning a 500 internal server error. Users authorized to manage certificate templates now get a 404, and users who aren't get a 403 whether or not the template exists.
• Fixed getting a certificate template by ID disclosing whether templates a user can't access exist. Reading a template on another fleet now returns a 404, the same as a template that doesn't exist.
• Fixed the add/edit certificate authority modals showing a generic "Please try again." error instead of the invalid URL error returned by the server. The error now names the certificate authority, for example "Invalid Hydrant URL. Please correct and try again."
• Fixed editing only the username or only the password of an NDES SCEP certificate authority skipping validation against the NDES server. Fleet now verifies the credentials on save and returns an error if they're wrong, instead of saving a broken certificate authority whose misconfiguration only surfaced later as a profile failure on hosts.
• Fixed editing only the SCEP URL of an NDES SCEP certificate authority failing with a "password" must be set when modifying an existing certificate authority error. The password field is now cleared when the SCEP URL changes, so it's re-entered and sent with the update.
• Fixed an empty username or password being saved on an NDES SCEP certificate authority.
• Fixed adding or editing a certificate authority with a bad NDES admin URL or credentials showing a generic "Please try again." message instead of "Invalid admin URL or credentials."
• Fixed updating an NDES SCEP certificate authority with the masked password (********) returned by the GET endpoint sending the mask to the NDES server as the literal password and failing with a misleading "invalid credentials" error. The mask is now rejected with an invalid-password error, matching GitOps behavior.
• Fleet now skips validating NDES credentials against the NDES server when an update leaves the admin URL, username, and password unchanged, so a no-op edit doesn't consume a slot in NDES's password cache.
• Fixed an unreachable NDES admin URL (timeout, DNS failure, connection refused) being reported as "Invalid admin URL or credentials" when editing an NDES SCEP certificate authority. It's now reported as "Couldn't connect to admin URL."
• Fixed the Save button staying enabled in the edit certificate authority modal after Fleet clears the unchanged NDES password, which let the form submit an empty password.
• Fixed editing a Windows configuration profile so that uploading a replacement file with a different name updates the profile's name.
• Fixed uploading a Windows configuration profile with a file name longer than 255 characters returning a database error.
• Fixed a bug where Windows disk encryption showed a "Resend" action that always failed, since BitLocker enforcement isn't a configuration profile.
• Fixed an issue where Observer, Observer+ and Technician could not see the managed account rotation banner.
• Fixed the error returned when a free-tier request sets a premium-only field so that it names the field as it appears in the request payload (for example critical) instead of Fleet's internal Go field name (for example Critical).
• Fixed a query returning a MySQL error if hit with unsupported platforms, by now returning an empty result.
• Fixed an issue where stale fleet names could appear in mdm.apple_business after renaming a fleet.
• Fixed false positive vulnerabilities reported for JetBrains teamcity-cli installed via Homebrew, which was incorrectly matched to the TeamCity CI server's CPE.
• Fixed fleetctl gitops silently dropping ios_updates and ipados_updates when it creates a new fleet.
• Fixed fleetctl generate-gitops failing with an unsupported Content-Type error when the org logo is an SVG.
• Fixed fleetctl generate-gitops not using .sh and .ps1 extensions for install scripts.
• Fixed an issue where deleting an ADE device after turning off Apple Business could leave orphaned rows.
• Fixed form validation on the new/edit user and API-only user forms: field errors no longer appear before a field has been edited, clear as soon as the field is focused, and the "select at least one fleet" error now renders on the selector instead of as a toast.
• Updated validation error copy on the new/edit user and API-only user forms to the standard wording (e.g. "Enter an email" instead of "Email field must be completed").
• Fixed the fleet, role, and API access controls staying editable while a user was being saved on the new/edit user and API-only user forms.
• Fixed error toasts showing an expandable "Raw response" panel containing an empty {} when the underlying error carried no details.
• Fixed inconsistent spacing around the enrollment URL on the iOS & iPadOS tab of the Add hosts modal, so it now matches the macOS and Android tabs.
• Fixed the confirmation checkbox on the "Clear passcode" host modal rendering in green instead of red, so it now matches the destructive "Clear passcode" button.
• Fixed incorrect background color on authentication pages (login, SSO, registration) in dark mode.
• Fixed autofilled inputs showing a white background in dark mode. The autofill style now uses theme colors instead of a hardcoded white, and covers Firefox via the standard :autofill selector.
• Fixed label color for install/post-install/uninstall script fields in software package advanced options to match Fleet's standard form label color.
• Fixed long unbreakable words (e.g. file paths in inline code) overflowing the table info side panel on the report and policy editor pages.
• Matched the height of the host status and platform/label filter dropdowns on the Hosts page.
• Fixed the "Collecting results..." empty state on the report details page reading "about about X hours".
• Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

• orbit-v1.61.0
• fleet-desktop-v1.61.0 (included with Orbit)
• osquery-5.23.1 (included with Orbit)
• fleetd-chrome-v1.3.5
• fleetd-android-v1.5.0

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

e0d2b9afcf661dcdaea3f0c9c0bd8b2c51fd032e8fb771b9e625c3b4e6b81210 fleet_v4.92.0_linux.tar.gz
69e2319abbecc5e8a4a9f4bbe4233895d338af681daaf18d5d8eba608d0b5439 fleetctl_v4.92.0_linux_amd64.tar.gz
da77eef850a0f13cede3b551c8ac90b424e7864a4145ba310cc730639127d1c1 fleetctl_v4.92.0_linux_amd64.zip
3a12324fb34e397f5de2aca24a172080e20c81e0a213c6cb567564893802a366 fleetctl_v4.92.0_linux_arm64.tar.gz
5827c85e48ae6a0fb18b9b38894445aec343f08a8dc82ef043d8855ae381d962 fleetctl_v4.92.0_linux_arm64.zip
e4d8ccbe4303e794c0efa322d537bd418d992ec4a13db5e79077987e9099dcc9 fleetctl_v4.92.0_macos.tar.gz
7675d605b0ce3f13a2fa3556ac1d231af60b13002098736df59ae5d322783913 fleetctl_v4.92.0_macos.zip
9499cecadcc20a10bf1f43dfd0c0b3f5318b87687f722cbe3faa622b910cc2d9 fleetctl_v4.92.0_windows_amd64.tar.gz
3f0578afbaf4504c66fc7580acd608953cfc299f81d96b277db31a1fc2a773e0 fleetctl_v4.92.0_windows_amd64.zip
bf081d6487b75680045466978201e5ed0051eb545896e404f6290904b9ca7b6b fleetctl_v4.92.0_windows_arm64.tar.gz
e98531e5db88da8effae211f3cafa44fa84258af79048879f3d379ffb49949cf fleetctl_v4.92.0_windows_arm64.zip

Cherry-pick of #53119 into the rc-minor-fleetd-v1.61.0 RC branch.

Related issue: Resolves #51527

Checklist for submitter

Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.

See Changes
files
for more information.

Testing

QA'd all new/changed functionality manually (in original PR #53119)

AI

AI: Claude Code (claude-fable-5-1)

fleetd/orbit/Fleet Desktop

Verified compatibility with the latest released version of Fleet (see Must rule)

If the change applies to only one platform, confirmed that runtime.GOOS is used as needed to isolate changes

Co-authored-by: Claude [email protected]