# Fleet v4.84.0

- Product: Fleet (https://whatsnew.fyi/product/fleet)
- Vendor: Fleet Device Management
- Date: 2026-04-25
- Version: v4.84.0
- Original notes: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.84.0
- Permalink: https://whatsnew.fyi/product/fleet/releases/v4.84.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Support for Entra conditional access to Windows devices
- **added** — Ability to pin Fleet-maintained apps to a specific major version in GitOps
- **added** — ACME for MDM protocol communication and hardware device attestation
- **added** — GET /api/v1/fleet/hosts/{id}/reports endpoint that lists query reports associated with a specific host
- **added** — Support for labels_include_all conditional scoping for software installers and apps
- **added** — Validation for software install, uninstall, and post-install scripts
- **added** — Ability to specify custom patch policy query in an FMA manifest
- **added** — Ability to re-send Android certificates to a specific host
- **added** — Reports tab to Host details page
- **added** — Support for specifying a Fleet-Maintained App as a policy software automation in GitOps
- **added** — Support for running python scripts on macOS and Linux
- **added** — Automatic retry up to 3 times when the Android agent reports a certificate install failure
- **added** — Activity logging when a certificate is installed or fails to install on an Android host
- **added** — Host activity card on the Android host details page
- **added** — disk_space fleetd table for macOS that reports available disk space including purgeable storage
- **added** — Configuration profile deletion when a Windows configuration profile is deleted or a host moves teams via SyncML Delete commands
- **added** — Support for outputting VPP policy automations in fleetctl generate-gitops
- **added** — Vulnerability detection for Microsoft 365 Apps and Office products on Windows
- **added** — OSV data source for Ubuntu vulnerability scanning
- **changed** — Fleet-maintained apps serving location from GitHub to https://maintained-apps.fleetdm.com/manifests
- **changed** — Increased automatic retry limit for failed Apple configuration profiles from 1 to 3
- **changed** — Increased default limit for the software batch endpoint from 1MiB to 25MiB
- **changed** — Increased default SSO session validity period from 5 to 15 minutes
- **changed** — Improved performance of distributed read endpoint by reducing mutex contention using sync.RWMutex instead of sync.Mutex
- **changed** — Automatic rotation of Mac recovery lock passwords 1 hour after the password is viewed via the API
- **changed** — Updated ingestion/CVE logic to support JetBrains software with 2 version numbers
- **fixed** — Addressed false positive vulnerabilities CVE-2019-17201 and CVE-2019-17202 reported for Admin By Request on macOS and Linux hosts
- **fixed** — Generated correct CPE from malformed ipswitch whatsup CPE to ensure applicable CVEs are matched
- **fixed** — Removed incorrect report key from get/create/modify API responses
- **fixed** — Fixed host detail queries not being sent to hosts running Flatcar Container Linux and CoreOS
- **added** — FLEET_MDM_CERTIFICATE_PROFILES_LIMIT server config option to throttle the number of CA certificate profile installations per reconciler cycle

**NOTE FOR SELF-HOSTED**: the fleetdm/fleet:v4.84.0 Docker image is broken in Kubernetes environments. Use [fleetdm/fleet:v4.84.1](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.84.1) instead.

##### Fleet 4.84.0 (Apr 24, 2026)

###### IT Admins
- Added support for Entra conditional access to Windows devices.
- Added ability to pin Fleet-maintained apps to a specific major version in GitOps.
- Implemented ACME for MDM protocol communication, and hardware device attestation.
- Added `GET /api/v1/fleet/hosts/{id}/reports` endpoint (also accessible as `/hosts/{id}/queries`) that lists the query reports associated with a specific host.
- Added support for `labels_include_all` conditional scoping for software installers and apps.
- Added validation for software install, uninstall, and post-install scripts.
- Added ability to specify custom patch policy query in an FMA manifest.
- Added ability to re-send Android certificates to a specific host.
- Added Reports tab to Host details page.
- Allowed specifying a Fleet-Maintained App (FMA) as a policy software automation in GitOps.
- Added support for running python scripts on macOS and Linux.
- Added automatic retry (up to 3 times) when the Android agent reports a certificate install failure.
- Added activity logging when a certificate is installed or fails to install on an Android host.
- Enabled the host activity card on the Android host details page.
- Switched Fleet-maintained apps serving location from GitHub to https://maintained-apps.fleetdm.com/manifests. **NOTE:** If you limit outbound Fleet server traffic, make sure it can access the new FMA manifests location.
- Increased automatic retry limit for failed Apple (macOS, iOS, iPadOS) configuration profiles from 1 to 3. Windows profiles remain at 1 retry.
- Added a new `disk_space` fleetd table for macOS that reports available disk space including purgeable storage, matching the value shown in Finder's "Get Info" dialog and System Settings → General → Storage.
- Added configuration profile deletion when a Windows configuration profile is deleted or a host moves teams via SyncML `<Delete>` commands, bringing Windows profile removal to parity with macOS.
- Added support for outputting VPP policy automations in `fleetctl generate-gitops`.
- Added logging of profile names alongside MDM commands installing or removing them.
- Added indication in the UI when a profile command was deferred via `NotNow` status.
- Added activity when setup experience is canceled due to software install failure.
- Added cancel activities for each VPP app install skipped due to setup experience cancellation, and switched "failed" activity to "canceled" for package-based software installs in the same situation.
- Added install failure activity when VPP installs fail due to licensing issues during setup experience.

###### Security Engineers
- Added vulnerability detection for Microsoft 365 Apps and Office products on Windows.
- Added OSV data source for Ubuntu vulnerability scanning.
- Added automatic rotation of Mac recovery lock passwords 1 hour after the password is viewed via the API.
- Updated ingestion/CVE logic to support JetBrains software with 2 version numbers, like WebStorm 2025.1
- Addressed false positive vulnerabilities (CVE-2019-17201, CVE-2019-17202) reported for Admin By Request on macOS and Linux hosts. These CVEs are Windows-specific.
- Generated correct CPE from malformed ipswitch whatsup CPE, ensuring applicable CVEs are matched.
- Added software source to ecosystem matching to help prevent non-deterministic CPE selection when multiple vendors exist for the same product.

###### Other improvements and bug fixes
- Upped the default limit for the software batch endpoint, from 1MiB to 25MiB.
- Added `FLEET_MDM_CERTIFICATE_PROFILES_LIMIT` server config option to throttle the number of CA certificate profile installations per reconciler cycle, preventing CA server overload in large deployments

_[Truncated at 4000 characters — full notes: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.84.0]_