Fleet device management releases

Bug fixes

• Reduced database load from GET /api/latest/fleet/device/{token}/desktop and other Fleet Desktop endpoints when invalid or expired device auth tokens are presented, by resolving the token to a host id with a single-table indexed lookup before running the multi-join host-details query.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

8323559b7c4a586beb31997c585f4000305a754d90902b42796ca84929e8c442  fleet_v4.84.3_linux.tar.gz
deaa661f852646cdbffd50d48278635717661b294c3d02279d112a787e228c1e  fleetctl_v4.84.3_linux_amd64.tar.gz
c6fb3708ea246ee05b756c242cb6f8978bd124d216b3621c2d7fb6637494afb8  fleetctl_v4.84.3_linux_amd64.zip
bce3986624a1d33badb31df1b533feafae877206ac81d3c268cc7428a8625461  fleetctl_v4.84.3_linux_arm64.tar.gz
1a0219499f50cc190949b7ad08686a49df4edb74349283e5c965aa2dc38d8859  fleetctl_v4.84.3_linux_arm64.zip
2d002968c2e2b03b1a05b7925087acce75df90e00458c91af6435e7a9ad87f73  fleetctl_v4.84.3_macos.tar.gz
5d3383af113eed7f12b75b07f8d834c6fa79299e8dce0a3f2bc7a92c10b8453e  fleetctl_v4.84.3_macos.zip
56e88759715ee94f64197869bc60799df06426493b4efa662e55bf8148b057f5  fleetctl_v4.84.3_windows_amd64.tar.gz
6f3d202f5ac908dd6261eee70ee39a9cad91f00687fa93adf13121f67d96777c  fleetctl_v4.84.3_windows_amd64.zip
d3ceac170d1f3315c71f5d71e57f288ceb73e2dc14a04414ad1f63a55286f9bf  fleetctl_v4.84.3_windows_arm64.tar.gz
6a9e17827f10c99dcddfe2d61bff309daf685159411cb4481483e1a8be4f5214  fleetctl_v4.84.3_windows_arm64.zip

Bug fixes

• Fixed filtering in /api/v1/fleet/labels/:id/hosts endpoint.
• Fixed a dead SQL condition in hostVPPInstalls that was misleading but harmless: Android VPP apps never produce nano_command_results entries (they use Google's Android Management API, not nanoMDM), so the previous (hvsi.platform != 'android' OR ncr.id IS NULL) guard was a tautology. Replaced with a clarifying comment.
• Fleet UI > Settings > Variables: Fixed access to not allow adding custom variable while in gitops mode both in the empty state and when a variable already exists
• Fixed a bug where custom package installers were not removed when adding an FMA for the same title via GitOps, which caused setup experience to install duplicate software.
• Fixed a bug where host environment variables in script-only packages would cause gitops to fail
• Updated go to 1.26.2
• Fixed an issue where trying to wipe a device after its certificate was renewed could fail due to a missing bootstrap token. Note: The device might still have wiped
• Fixed a bug where duplicate software installers for linux could be added.
• Improved validation for invalid order_key values in /api/v1/fleet/commands, /api/v1/fleet/mdm/commands and /api/v1/fleet/mdm/apple/commands endpoints.
• Fixed a server panic when an Apple MDM DeviceInformation refetch response omitted DeviceName or other expected fields.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

5bb555863948d05299e252e6df5b11914b981773f9b7e7253a1a8b2dc8d83143  fleet_v4.84.2_linux.tar.gz
1b2c7c3a320fc506de9f8b185c9d66de847e14d0d1b5ebffdc9179aeefe0c05c  fleetctl_v4.84.2_linux_amd64.tar.gz
b75e046e5fc70060e7c6383d4fe2d9b388e42367b816bee837491c3274c30000  fleetctl_v4.84.2_linux_amd64.zip
aec1812e1b406f9ac2e4694a2477902760bb3475d58506707f3626e88ef0aa12  fleetctl_v4.84.2_linux_arm64.tar.gz
b1c590f38a1992aa569783c66707986eed2418ccc557570a3bf71d249102ec86  fleetctl_v4.84.2_linux_arm64.zip
6f2d7dbdd6d51722e9373a9558fa78377c83f9b904ad5930031644d07f5e5607  fleetctl_v4.84.2_macos.tar.gz
358bc348bcf54008ac4892dc8d09553acb221b6f0f163039fd56b0ddd8e9dfa3  fleetctl_v4.84.2_macos.zip
69f8b57c80e702a9edf608dd698d3572f8a30860228a381cbbd004c4c1c3346f  fleetctl_v4.84.2_windows_amd64.tar.gz
c58b932c5aa9f003a53262a45021f3af1d94723f703cb50bf6feba8fcf9bf065  fleetctl_v4.84.2_windows_amd64.zip
ec94d3257a195336bd1a6843eaff7440a58e8a51299589725c7bb37bbb5a524a  fleetctl_v4.84.2_windows_arm64.tar.gz
425fb7a53842a0d0f0da43e1d781b5446a5817eee204edd88e94c62be77f1e6c  fleetctl_v4.84.2_windows_arm64.zip

Bug fixes

• Fixed Fleet's Docker image failing to start in Kubernetes with an unknown userid error, triggered by a fleetctl dependency side effect.
• Use Docker as the default WiX runtime on macOS (including Apple Silicon) when generating .msi packages via fleetctl package. Wine is no longer required on macOS for the default path.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

d8f4cfe973fdba253eae70d6e0c83e681d6d945ec52d37a8c9e20a887cc21c32  fleet_v4.84.1_linux.tar.gz
615567928c7e94f9cee9ae60e81852f9d300031f1e3933c5c34981f5883b9861  fleetctl_v4.84.1_linux_amd64.tar.gz
ba79ac36c7aef0e7259c9f2bc6615a42ff098b18dd4baf3564ed704c973a730b  fleetctl_v4.84.1_linux_amd64.zip
d042ff15c6c2a27eba7e992d4b11fbfd9b1dcc99b95741c6b19723601e7025cc  fleetctl_v4.84.1_linux_arm64.tar.gz
8da325cf0c2c4c729c22d4c66ab2c53c355fabb16aae1a45b43df04c8c6bfb6d  fleetctl_v4.84.1_linux_arm64.zip
75acdbd6945eb374c77cde0f65350945712cd93f9098f93bf246df88b520ae8d  fleetctl_v4.84.1_macos.tar.gz
6809e7b94fd8c99fe9f243130d1049ff4735b7c3eedb65a00d51e4526602d761  fleetctl_v4.84.1_macos.zip
72819485c95a0c7b1b765c4b64f34241d3a2712de6700c2059533427e9bded52  fleetctl_v4.84.1_windows_amd64.tar.gz
2e3cf8977a08f331fa441af11aecc0592f833f079bacdd9efb26768cd94a258e  fleetctl_v4.84.1_windows_amd64.zip
eacfbeb4cb83e8ea42fab4ea9e430ff114b6f0c7d742f781c552921b5ecdfa82  fleetctl_v4.84.1_windows_arm64.tar.gz
433efde225f9f62f95812a0b76a4335f7446210dd1d2e7319905618ff724026d  fleetctl_v4.84.1_windows_arm64.zip

Fleet 4.84.0 (Apr 24, 2026)

IT Admins

• Added support for Entra conditional access to Windows devices.
• Added ability to pin Fleet-maintained apps to a specific major version in GitOps.
• Implemented ACME for MDM protocol communication, and hardware device attestation.
• Added GET /api/v1/fleet/hosts/{id}/reports endpoint (also accessible as /hosts/{id}/queries) that lists the query reports associated with a specific host.
• Added support for labels_include_all conditional scoping for software installers and apps.
• Added validation for software install, uninstall, and post-install scripts.
• Added ability to specify custom patch policy query in an FMA manifest.
• Added ability to re-send Android certificates to a specific host.
• Added Reports tab to Host details page.
• Allowed specifying a Fleet-Maintained App (FMA) as a policy software automation in GitOps.
• Added support for running python scripts on macOS and Linux.
• Added automatic retry (up to 3 times) when the Android agent reports a certificate install failure.
• Added activity logging when a certificate is installed or fails to install on an Android host.
• Enabled the host activity card on the Android host details page.
• Switched Fleet-maintained apps serving location from GitHub to https://maintained-apps.fleetdm.com/manifests. NOTE: If you limit outbound Fleet server traffic, make sure it can access the new FMA manifests location.
• Increased automatic retry limit for failed Apple (macOS, iOS, iPadOS) configuration profiles from 1 to 3. Windows profiles remain at 1 retry.
• Added a new disk_space fleetd table for macOS that reports available disk space including purgeable storage, matching the value shown in Finder's "Get Info" dialog and System Settings → General → Storage.
• Added configuration profile deletion when a Windows configuration profile is deleted or a host moves teams via SyncML <Delete> commands, bringing Windows profile removal to parity with macOS.
• Added support for outputting VPP policy automations in fleetctl generate-gitops.
• Added logging of profile names alongside MDM commands installing or removing them.
• Added indication in the UI when a profile command was deferred via NotNow status.
• Added activity when setup experience is canceled due to software install failure.
• Added cancel activities for each VPP app install skipped due to setup experience cancellation, and switched "failed" activity to "canceled" for package-based software installs in the same situation.
• Added install failure activity when VPP installs fail due to licensing issues during setup experience.

Security Engineers

• Added vulnerability detection for Microsoft 365 Apps and Office products on Windows.
• Added OSV data source for Ubuntu vulnerability scanning.
• Added automatic rotation of Mac recovery lock passwords 1 hour after the password is viewed via the API.
• Updated ingestion/CVE logic to support JetBrains software with 2 version numbers, like WebStorm 2025.1
• Addressed false positive vulnerabilities (CVE-2019-17201, CVE-2019-17202) reported for Admin By Request on macOS and Linux hosts. These CVEs are Windows-specific.
• Generated correct CPE from malformed ipswitch whatsup CPE, ensuring applicable CVEs are matched.
• Added software source to ecosystem matching to help prevent non-deterministic CPE selection when multiple vendors exist for the same product.

Other improvements and bug fixes

• Upped the default limit for the software batch endpoint, from 1MiB to 25MiB.
• Added FLEET_MDM_CERTIFICATE_PROFILES_LIMIT server config option to throttle the number of CA certificate profile installations per reconciler cycle, preventing CA server overload in large deployments.
• Added banner to Add software page to inform users that Android web apps require Google Chrome.
• Enabled Windows MDM in fleetctl preview by auto-generating WSTEP certificates on startup.
• Used the same templates for fleetctl new and new instance initialization.
• Added "API time" to GitOps output on API errors.
• Allowed clearing Windows OS update deadline and grace period fields to remove enforcement.
• Updated ordering of setup experience software to take display names into account.
• Updated iOS/iPadOS refetch logic to slowly clear out old/stale results.
• Increased the default SSO session validity period from 5 to 15 minutes.
• Improved performance of distributed read endpoint by reducing mutex contention in shouldUpdate using sync.RWMutex instead of sync.Mutex.
• Allowed OTEL service name to be overridden with standard OTEL_SERVICE_NAME env var.
• Revised which versions Fleet tests MySQL against to remove 8.0.39 and add 8.0.42.
• Allowed typing whitespace on Settings > Integrations > SSO > End users form.
• Removed incorrect report key from get/create/modify API responses.
• Added (query_id, has_data, host_id, last_fetched) index on query_results.
• Improved database query performance for the Host Details > Reports page by adding a has_data virtual generated column to query_results.
• Made sure that fleet names are trimmed and validate to prevent whitespace-only or padded names across API, gitops, frontend, and existing data.
• Hid host details > reports in the UI from platforms that do not support scheduled reporting.
• Updated GitOps label functionality to allow omitting the hosts: key under a manual label to mean "preserve existing host membership", rather than removing all hosts.
• Added Flatcar Container Linux and CoreOS to the list of recognized Linux platforms, fixing host detail queries (IP address, disk space, etc.) not being sent to hosts running these distributions.
• Updated the default fleet selected when navigating to the dashboard and to controls.
• Reduced redundant database queries during policy result submission by computing flipping policies once per host check-in instead of multiple times.
• Reduced redundant database calls in the osquery distributed query results hot path by pre-loading configuration (AppConfig, HostFeatures, TeamMDMConfig, conditional access) once per request instead of once per detail query result.
• Updated UI to use new multiplatform API keys.
• Activated warnings for deprecated API parameters, API URLs, fleetctl commands and fleetctl command options.
• Updated the Request Certificate API to return the proper PEM header for PKCS #7 certificates returned by EST CAs.
• Added "Learn more" link on End User Authentication section.
• Moved Apple MDM worker to a faster cron, and started sending profiles on Post DEP enrollment job, to speed up initial macOS setup.
• Optimized PolicyQueriesForHost and ListPoliciesForHost SQL queries by replacing correlated subqueries with a single aggregated LEFT JOIN for label-based policy scoping, reducing query time by ~77% at scale.
• Improved VPP install failure messaging to explain verification timeouts in Host details and My device install details.
• Refactored large anonymous functions into named functions to improve nil-safety static analysis coverage.
• Renamed "Custom settings" to "Configuration profiles" in Fleet UI.
• Added description to UI to help users understand which fleet a policy belongs to during add/edit.
• Updated Fleet-maintained apps to overwrite software title names on sync and when adding an FMA installer.
• Improved Fleet server performance for the Windows MDM profiles summary and host OS settings filter queries by replacing correlated subqueries with a single aggregation pass.
• Improved Windows MDM server performance at scale by reducing redundant database queries during device check-ins.
• Updated go to 1.26.1
• Fixed a server panic when uploading a Windows MDM profile to a fleet on a free license.
• Fixed MSRC vulnerability scanning to differentiate between Windows Server Core and full desktop installations, preventing false positive/negative CVEs caused by non-deterministic product matching.
• Fixed GitOps policy software resolution failing when URL lookup doesn't match, by falling back to hash-based lookup.
• Fixed GitOps failing to delete a certificate authority when certificate templates still reference it in fleet configs.
• Fixed duplicate text in error message when script validation fails when adding a custom package.
• Fixed issue where the include_available_for_install query param wasn't being applied correctly to the GET /api/latest/fleet/hosts/{id}/software endpoint.
• Fixed disk encryption key modal to not show stale key when switching between hosts.
• Fixed SCIM user not associating with host when IdP username was set before the SCIM user was created.
• Fixed Google Drive version not matching upstream.
• Fixed bug that cleared the MDM lock state if an "idle" message was received right after the lock ACK.
• Fixed team maintainers, admins, and GitOps users being unable to add certificate templates due to missing read access to certificate authorities.
• Fixed fleetd installation failure on macOS when installing it through Host details page > Software > Library as a Custom package.
• Fixed a bug where SQL queries using table aliases (e.g., FROM mounts m) incorrectly reported no compatible platforms.
• Fixed fleetctl gitops failing with "No available VPP Token" when assigning VPP apps alongside a new team.
• Fixed a bug where OS versions were not populated in vulnerability details for OS-only vulnerabilities (e.g., macOS CVEs).
• Fixed a TOCTOU-related issue when checking before deleting last admin.
• Fixed database locking issues on the policy_membership table by batching cleanup DELETE operations and moving them outside the primary GitOps apply transaction.
• Fixed success message on Android software configuration to reference software display name when applicable.
• Fixed a bug where Android host certificate template records were not cleared when a device unenrolled, causing stale certificate statuses after re-enrollment.
• Fixed a bug where the organization logo URL entered during setup was only saved for dark backgrounds and not for light backgrounds.
• Fixed an issue where setup experience items (software to install) were not enqueued for Linux distributions that did not report a "platform-like" value, e.g. Arch Linux and Omarchy.
• Fixed a bug where filtering hosts by software version for a software version not present on the selected team returned nil software instead of a lightweight report of the software.
• Fixed Fleet's usage of the incorrectly spelled 'vulnerabities' in favor of 'vulnerabilities' in MSRC bulletins.
• Fixed nondeterministic CPE matching when multiple CPE candidates share the same product name.
• Fixed a bug where Windows hosts with an empty display_version in the database would get 0 CVEs from MSRC vulnerability scanning.
• Fixed a bug where fleetctl generate-gitops failed if a Fleet-maintained app was associated to a software title with a different name (e.g. names with different versions).
• Fixed fleetctl generate-gitops failing to include VPP fleet assignments.
• Fixed query results table deduplicating rows when query data contains an id column, and fixed id column header and cell styling.
• Fixed missing underline on "Reports" nav item when active in top navigation.
• Fixed bug where adding a patch policy for a new installer in the UI caused gitops runs that didn't include that installer to fail.
• Fixed browser back button requiring an extra click to leave the Policies and Reports pages.
• Fixed a bug where Fleet continued to show a stale Recovery Lock password after a macOS host left MDM, by soft-deleting the stored password whenever the host leaves MDM (re-enrollment, CheckOut, admin unenroll, or a periodic sweep of hosts osquery reports as unenrolled) and hiding the password on the host details page until the host is enrolled again.
• Fixed an issue where silent migration status would persist even after re-enrolling the device normally, causing SCEP renewal to fail.
• Fixed issue where the "Change Management" form would reset when the page lost and regained focus.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.54.0
2. fleet-desktop-v1.54.0 (included with Orbit)
3. osquery-5.22.1 (included with Orbit)
4. fleetd-chrome-v1.3.5
5. fleetd-android-v1.0.2

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Please visit our upgrade guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

81f41a8040fa24d6eedb36f4e07781a1e9c7becd5230a8fbaa4838585a9d7e10  fleet_v4.84.0_linux.tar.gz
f75f2ba262a0d729b620c43a423e5821798fbdd8c9dff837b79e760ad8a49e3b  fleetctl_v4.84.0_linux_amd64.tar.gz
a6bb3ce5900159593f7baab35ded00b5f57265d5c2b3b466075ec08c8e579a98  fleetctl_v4.84.0_linux_amd64.zip
47cc6a694b3c28e39e6f5808b36656a5a8759d1e27b19bbc9e6af1c544d51c6b  fleetctl_v4.84.0_linux_arm64.tar.gz
09aa54bdff09d288b179f9f3238c6dc5a9d77f1ed706666f376f248e314568e9  fleetctl_v4.84.0_linux_arm64.zip
5d6dc8cb956937f91469e0bc24b6c65e7c3eebf10776b8ae5554f8540c1fa04c  fleetctl_v4.84.0_macos.tar.gz
7a995e9b12007a4e1453f63e8bf15fe224a283678f60424c146ceff6e57dbb57  fleetctl_v4.84.0_macos.zip
f370a39f8ebd89521f6f73fd7040ba371dfe53cd5917a5e063ab4ed3013aedc0  fleetctl_v4.84.0_windows_amd64.tar.gz
e2ec4d03889487ece6c0f786b1f2fb5bf93c82a0024f28aeba668e7f206b1c91  fleetctl_v4.84.0_windows_amd64.zip
67af88665d450fc14329fde02ef6d1ec64faaae12b7748c23bb56c1605f63eae  fleetctl_v4.84.0_windows_arm64.tar.gz
775b847ccab8fdbf9bf27b5e469fa6283b28799416761c5619f1917aaa1f453d  fleetctl_v4.84.0_windows_arm64.zip