# Fleet v4.66.0

- Product: Fleet (https://whatsnew.fyi/product/fleet)
- Vendor: Fleet Device Management
- Date: 2025-04-04
- Version: v4.66.0
- Original notes: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.66.0
- Permalink: https://whatsnew.fyi/product/fleet/releases/v4.66.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Integrate with DigiCert Trust Lifecycle Manager to deploy DigiCert certificates to macOS devices via configuration profiles
- **added** — Support for queries with LabelsIncludeAny in backend
- **added** — Allow adding labels when saving or editing queries in the UI
- **added** — Add author_id to labels DB table to track who created a label
- **added** — Support for Fleet-maintained apps for Windows
- **added** — Integrate with custom SCEP server to deploy certificates from own SCEP server to macOS devices via configuration profiles
- **added** — Add platform key to software_package and app_store_app keys throughout API
- **added** — Add Apple Root Certificate for HTTP requests to https://gdmf.apple.com/v2/pmv to enforce minimum macOS version at enrollment
- **added** — Add configuration to Fleet server to enable H2C (forcing http2) to work around GCP Cloud Run file upload size limitation
- **added** — Add validation to both org logo URL fields and accept data URIs as valid
- **added** — Add took field (request duration) on server logs for requests that fail (non-2XX)
- **added** — Add support for displaying scheduled query labels in fleetctl
- **changed** — Update activity log UI for new certificate authority features
- **changed** — Update host details software table to filter by vulnerability severity and known exploit
- **changed** — Return more granular data for live query and policy runs so it can be displayed to users
- **changed** — Move software version transformations for vulnerability matching out of software ingestion to ensure software inventory versions match what osquery reports
- **changed** — Modify host software query to apply the vulnerability filter on VPP apps and latest software installs and uninstalls
- **changed** — Update macOS setup experience to show an error if an App Store app installation fails due to lack of licenses
- **changed** — Improve error messages when Fleet admin tries to upload a FileVault or BitLocker configuration profile
- **changed** — Allow for any number of comments at the top of XML files for Windows MDM profile CSPs
- **changed** — Disable unsupported automatic install option during add flow of .exe custom packages
- **changed** — Treat software installer download errors as a failure for that installation attempt to prevent software installation from remaining in pending
- **fixed** — Fix false positive on macOS 15.3 by matching the version format reported by Vulncheck
- **fixed** — Fix false positive for CVE-2024-6286 on non-Windows hosts
- **fixed** — Fix software installer download and Fleet Maintained App errors by extending the timeout for the download and FMA add endpoints
- **fixed** — Fix issue where bootstrap package was incorrectly installed during renewal of Apple MDM enrollment profiles
- **fixed** — Fix bug to ignore Windows hosts that are not enrolled in Fleet MDM for disk encryption statistics and filters
- **fixed** — Fix policy automation with scripts to surface errors to user instead of rendering false success message
- **fixed** — Fix whitespace not being displayed correctly in policy automation calendar preview
- **fixed** — Fix bug where Windows profiles were not being resent after fleetctl GitOps update
- **fixed** — Fix row selection firing twice in host selection screen
- **fixed** — Fix Dashboard Software table truncating host count
- **fixed** — Fix error when requesting /fleet/software/titles endpoint unpaginated with more than 33k software titles by batching the policies by software title id query
- **fixed** — Fix issue where removing label conditions on configuration profiles did not clear the labels associated with the profile when applied via fleetctl gitops
- **removed** — Remove duplicate download and delete attempts for MSRC bulletins when hosts are enrolled spanning multiple builds of the same version of Windows
- **removed** — Remove unreliable default install and uninstall scripts for .exe software packages; install and uninstall scripts are now required when adding .exe packages

##### Fleet 4.66.0 (Apr 4, 2025)

###### Security Engineers
- Added integration with DigiCert Trust Lifecycle Manager. Fleet admins can now deploy DigiCert certificates to their macOS devices via configuration profiles.
- Updated activity log UI for new certificate authority features.
- Updated host details > software table to filter by vulnerability severity and known exploit.
- Return more granular data for live query and policy runs so it can be displayed to users.
- Allowed adding labels when saving or editing queries in the UI.
- Added support for queries with LabelsIncludeAny in backend.
- Added `author_id` to labels DB table to track who created a label.
- Removed duplicate download/delete attempts for MSRC bulletins when hosts are enrolled spanning multiple builds of the same version of Windows.
- Split up expired query deletion to avoid deadlocks in zero-trust flows.
- Moved software version transformations for vulnerability matching out of software ingestion to ensure software inventory versions match what osquery reports. 
- Modified host software query to apply the vulnerability filter on VPP apps and latest software installs & uninstalls.
- Fixed false positive on macOS 15.3 by making sure we match the version format reported by Vulncheck.
- Fixed false positive for CVE-2024-6286 on non-Windows hosts.

###### IT Admins
- Added support for Fleet-maintained apps for Windows.
- Added integration with a custom SCEP server. Fleet admins can now deploy certificates from their own SCEP server to their macOS devices via configuration profiles. The SCEP server will only see traffic from the Fleet server.
- Return more granular data for live query and policy runs so it can be displayed to users.
- Added support for queries with LabelsIncludeAny in backend.
- Allowed adding labels when saving or editing queries in the UI.
- Updated macOS setup experience to show an error if an App Store app installation fails due to lack of licenses.
- Added `platform` key to `software_package` and `app_store_app` keys throughout API.
- Improved error messages when Fleet admin tries to upload a FileVault (macOS) or a BitLocker (Windows) configuration profile.
- Ignored compatible Linux hosts in disk encryption statistics and filters if disk encryption is disabled.
- Allowed for any number of comments at the top of XML files for Windows MDM profile CSPs.
- Disabled unsupported automatic install option during add flow of .exe custom packages.
- Updated Fleet to treat software installer download errors as a failure for that installation attempt, which prevents the software installation from remaining in "pending".
- Added Apple Root Certificate for HTTP requests to https://gdmf.apple.com/v2/pmv. This solves the issue of minimum macOS version not being enforced at enrollment.
- Removed unreliable default (un)install scripts for .exe software packages; install and uninstall scripts are now required when adding .exe packages.
- Added software URL validation in GitOps to catch URL parse errors earlier.

###### Other improvements
- Updated the empty states when choosing a label scope for new software, queries, and profiles.
- Clarified meanings of various types and fields involved in live query/policy infrastructure, document, and refactor for improved code clarity.
- Added configuration to Fleet server to enable H2C (forcing http2) to get around a limitation in GCP Cloud Run for upload file sizes.
- Added validation to both org logo URL fields, and accept data URIs as valid.
- Removed redundant json array parsing in osquery pack report handler.
- Added `took` field (request duration) on server logs for requests that fail (non-2XX).
- Unified all pagination logic and styling.
- Updated the new policy flow and associated UI elements.
- Updated UI to cleanly truncate two overflowing values and display full values in a tooltip.
- Removed extra space above Next and Previous buttons in host activity feeds.
- A

_[Truncated at 4000 characters — full notes: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.66.0]_