# Fleet v4.85.0

- Product: Fleet (https://whatsnew.fyi/product/fleet)
- Vendor: Fleet Device Management
- Date: 2026-05-14
- Version: v4.85.0
- Original notes: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.85.0
- Permalink: https://whatsnew.fyi/product/fleet/releases/v4.85.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Added a dark theme to the Fleet UI, selectable in account settings with light, dark, and system options
- **added** — Implemented Clear Passcode feature for iOS and iPadOS
- **added** — Added support for Fleet variables in Apple's declaration profiles (DDM)
- **added** — Added support for passing end-user authentication context to the Fleet MSI installer during Windows MDM enrollment to prevent duplicate authentication prompts when EUA is enabled
- **changed** — Switched to Docker as the default WiX runtime on macOS (including Apple Silicon) when generating .msi packages via fleetctl package, making Wine no longer required on macOS for the default path
- **changed** — Updated macOS 15 CIS benchmark to include v2.0.0 changes
- **changed** — Updated the macOS 14 (Sonoma) CIS policy set to benchmark v3.0.0
- **changed** — Switched Fleet-maintained apps serving location from GitHub to https://maintained-apps.fleetdm.com/manifests with fallback to previous GitHub-hosted copies if inaccessible
- **added** — Added conditional HTTP downloads using ETag headers for software in GitOps, skipping re-download when content hasn't changed
- **added** — Added always_download option for software in GitOps to bypass the new conditional download feature
- **added** — Added automatic escaping of JSON special characters in GitOps variables used in .json configuration profiles (Apple DDM declarations and Android profiles)
- **changed** — Updated fleetctl gitops to process Android certificates before Android profiles
- **changed** — Made fleet name uniqueness rules consistent across the UI, API, and GitOps paths, requiring fleet names to differ by more than letter case and returning a 409 error on all code paths for conflicts
- **added** — Enabled renewing and deleting AB tokens in the UI in GitOps mode
- **changed** — Changed the team's script_execution_timeout in agent options to default to the global agent options value when unset
- **added** — Added ability to save policies whose SQL is flagged as a syntax error
- **changed** — Withheld Android Wi-Fi configuration profiles (openNetworkConfiguration with ClientCertKeyPairAlias) until the referenced certificate is installed or terminally failed on the device
- **changed** — Updated the host OS settings detail column to show the reason when an Android profile is pending due to a certificate dependency
- **added** — Added Hosts online, Vulnerability exposure, and Hosts enrolled charts to the dashboard
- **added** — Added an admin setting to control retention of vulnerability-exposure data used by the dashboard chart

##### Fleet 4.85.0 (May 14, 2026)

###### IT Admins

- Added a dark theme to the Fleet UI, selectable in account settings with light, dark, and system options.
- Implemented Clear Passcode feature for iOS and iPadOS.
- Added support for Fleet variables in Apple's declaration profiles (DDM).
- Added support for passing end-user authentication context to the Fleet MSI installer during Windows MDM enrollment, so end users are not prompted to authenticate twice when EUA is enabled.
- Switched to Docker as the default WiX runtime on macOS (including Apple Silicon) when generating `.msi` packages via `fleetctl package`. Wine is no longer required on macOS for the default path.
- Updated macOS 15 CIS benchmark to include v2.0.0 changes.
- Updated the macOS 14 (Sonoma) CIS policy set to benchmark v3.0.0.
- Switched Fleet-maintained apps serving location from GitHub to https://maintained-apps.fleetdm.com/manifests. If this site is inaccessible, Fleet will fall back to the previous GitHub-hosted copies of manifest files.
- Added conditional HTTP downloads using ETag headers for software in GitOps, skipping re-download when content hasn't changed.
- Added `always_download` option for software in GitOps to bypass the new conditional download feature.
- Added automatic escaping of JSON special characters in GitOps variables used in `.json` configuration profiles (Apple DDM declarations and Android profiles).
- Updated `fleetctl gitops` to process Android certificates before Android profiles.
- Made fleet name uniqueness rules consistent across the UI, API, and GitOps paths. Fleet names must now differ by more than letter case, and conflicts return a 409 error on all code paths.
- Enabled renewing and deleting AB tokens in the UI in GitOps mode.
- Changed the team's `script_execution_timeout` in agent options to default to the global agent options value when unset.
- Added ability to save policies whose SQL is flagged as a syntax error.
- Withheld Android Wi-Fi configuration profiles (`openNetworkConfiguration` with `ClientCertKeyPairAlias`) until the referenced certificate is installed or terminally failed on the device.
- Updated the host OS settings detail column to show the reason when an Android profile is pending due to a certificate dependency.
- Added "Hosts online", "Vulnerability exposure", and "Hosts enrolled" charts to the dashboard.
- Added an admin setting to control retention of vulnerability-exposure data used by the dashboard chart.
- Added new policy details page with a read-only view of policy information.
- Updated edit policy page to redirect users with read-only access to the policy details page.
- Added dedicated `/policies/:id/live` route for running policies.

###### Security Engineers

- Added UI pages for creating and editing API-only users with support for fleet assignment, role selection, and API endpoint access control.
- Added new middleware (`APIOnlyEndpointCheck`) that enforces a 403 response for API-only users whose request either isn't in the API endpoint catalog or falls outside their configured per-user endpoint restrictions.
- Added `POST /users/api_only` endpoint for creating API-only users.
- Added `PATCH /users/api_only/{id}` endpoint for updating existing API-only users.
- Updated `fleetctl user create --api-only` to remove email and password field requirements.
- Added a new premium `GET /api/_version_/fleet/rest_api` endpoint that returns the contents of the embedded `api_endpoints.yml` artifact.
- Updated `GET /users/{id}` response to include the new `api_endpoints` field for API-only users.
- Added `user_api_endpoints` table to track per-user API endpoint permissions.

###### Bug fixes and improvements

- Updated Go to 1.26.3.
- Improved MySQL writer performance by skipping no-op `UPDATE host_orbit_info` and `UPDATE host_disks` writes when the stored values already match the incoming ingest values from osquery, cutting these writes to near zero at steady

_[Truncated at 4000 characters — full notes: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.85.0]_