# Fleet v4.73.0

- Product: Fleet (https://whatsnew.fyi/product/fleet)
- Vendor: Fleet Device Management
- Date: 2025-09-09
- Version: v4.73.0
- Original notes: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.73.0
- Permalink: https://whatsnew.fyi/product/fleet/releases/v4.73.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — New detail query for determining whether a BitLocker PIN is set when TPM PIN enforcement is required
- **added** — Host identity certificate renewal support for TPM-backed certificates on Linux when within 180 days of expiration
- **added** — Global activity created when a new disk encryption key is escrowed
- **added** — Issuer and issued cells to the host details and my device page certificates table
- **added** — Filtering host and team software by minimum and maximum CVSS score in the Fleet UI
- **added** — Display of kernel vulnerabilities in the operating system details page for Linux systems
- **changed** — Updated macOS 13 CIS policies to align with CIS Benchmark v3.1.0 from v3.0.0
- **changed** — Updated macOS 14 CIS policies to align with CIS Benchmark v2.1.0 from v2.0.0
- **changed** — Updated macOS 15 CIS policies to align with CIS Benchmark v1.1.0 from v1.0.0
- **changed** — Fleet's certificate ingestion now accepts non-standard country codes longer than 2 characters and truncates long values with error logging instead of failing
- **added** — API endpoints for adding, deleting and listing secret variables
- **added** — Ability to add and delete custom variables in the UI
- **added** — API endpoints to get and list batch scripts
- **added** — Cron job to launch scheduled batch scripts
- **added** — API endpoint to cancel scheduled batch script run
- **added** — Ability to cancel batch script runs directly from the UI summary modal
- **added** — Ability to schedule batch script runs in advance in the Run scripts modal
- **added** — Ability to filter the hosts list to those incompatible with the script in a batch run
- **added** — Side navigation on the Controls > Scripts page with Library tab and new Batch progress tab

##### Fleet 4.73.0 (Sep 8, 2025)

###### Security Engineers
- Added new detail query, only executed if TPM PIN enforcement is required, for determining whether a BitLocker PIN is set.
- Added host identity certificate renewal support for TPM-backed certificates (Linux-only). When a certificate is within 180 days of expiration, orbit will automatically renew it using proof-of-possession with the existing certificate's private key.
- Added new global activity created when a new disk encryption key is escrowed.
- Added issuer and issued cells to the host details and my device page certificates table.
- Allowed filtering host and team software by minimum and maximum CVSS score in the Fleet UI.
- Updated UI to display kernel vulnerabilities in the operating system details page for Linux systems.
- Updated macOS 13 CIS policies to align with CIS Benchmark v3.1.0 (from v3.0.0).
- Updated macOS 14 CIS policies to align with CIS Benchmark v2.1.0 (from v2.0.0).
- Updated macOS 15 CIS policies to align with CIS Benchmark v1.1.0 (from v1.0.0).
- Updated Fleet's certificate ingestion to accept non-standard country codes of longer than 2 characters. In addition, updated ingestion of other fields to truncate long values and log an error instead of failing.

###### IT Admins
- Added API endpoints for adding, deleting and listing secret variables.
- Added ability to add and delete custom variables in the UI.
- Added APIendpoints to get and list batch scripts. 
- Added cron job to launch scheduled batch scripts.
- Added API endpoint to cancel scheduled batch script run.
- Added the ability to cancel batch script runs directly from the UI summary modal.
- Added ability to schedule batch script runs in advance to the "Run scripts" modal.
- Added the ability to filter the hosts list to those hosts that were incompatible with the script in a batch run.
- Added side navigation on the Controls > Scripts page, with the previous Scripts page content under the "Library" tab and a new "Batch progress" tab containing details about started, scheduled, and finished scripts.
- Added batch execution IDs to script run activities.
- Added IdP SSO authentication to the BYOD mobile devices enrollment if that option is enabled for the team.
- Allowed overriding install/uninstall scripts, and specifying pre-install queries and post-install scripts, for Fleet-maintained apps in GitOps.
- Added support of `$FLEET_VAR_HOST_UUID` in Windows MDM configuration profiles.
- Added additional logging information for Windows MDM discovery endpoint when errors occur.
- Added support for last opened time for Linux software (DEB & RPM packages).
  - NOTE: Package will need to be updated out-of-band once, because the pre-removal script from previously-generated packages is called upon an upgrade. The old pre-removal script stopped Orbit unconditionally. `fleet-osquery` can safely be updated through the Software page only _after_ a new package generated with this version of fleetctl has been installed through other means.
- Added indication of whether software on a host was never opened, vs. being a software type where last opened time collection is not supported.
- Added automatic install policies into host software responses.
- Updated `fleetctl api` to now support sending data in the body of non-GET requests using the `-F` flag. (Thanks @fuhry!) 

###### Other improvements and bug fixes
- Added permissions to OS updates page so that only global admins and the team admin can see the page.
- Cleared label membership when label platform changes (via GitOps).
- Improved public IP extraction for Fleet Desktop requests.
- Marked DDM profiles as failed if response comes back with Unknown Declaration Type error, and improve upload validation for declaration type.
- Modified `PUT /api/v1/fleet/spec/secret_variables` endpoint to only accept secret variables with uppercase letters, numbers and underscores.
- Updated software inventory so that when

_[Truncated at 4000 characters — full notes: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.73.0]_