Update Fleet-maintained apps

[fleet-release]

Automated ingestion of latest Fleet-maintained app data.

Summary by CodeRabbit

• Chores
  • Updated Claude Desktop macOS application metadata to version 1.2581.0, including new installer package and security verification checksums
  • Updated Connect Fonts (SuitcaseFusion) maintained-application metadata to version 28.1.1 with corresponding updated installation artifacts
  • Updated Dropbox macOS application metadata from version 246.4.3513 to 248.4.3576 with new installer packages and security checksums

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[coderabbitai]

Walkthrough

Updated version metadata for three maintained applications in JSON configuration files: Claude Desktop macOS (1.2278.0 → 1.2581.0), Connect Fonts (28.1.0 → 28.1.1), and Dropbox macOS (246.4.3513 → 248.4.3576). For each application, the corresponding version field, patched SQL logic comparison threshold, installer URL filename, and SHA256 checksum were updated to match the new release artifacts.

Possibly related PRs

• Update Fleet-maintained apps #43523: Continues maintained-app metadata updates for Claude Desktop macOS with the same version bump and field modifications (version, patched query, installer_url, sha256).
• Update Fleet-maintained apps #43380: Modifies the same maintained-app JSON files with version updates and corresponding changes to patched SQL comparisons, installer URLs, and SHA256 checksums.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description 'Automated ingestion of latest Fleet-maintained app data' is generic and vague, lacking specific details about which apps were updated or their version changes.	Provide specific details such as the app names and version numbers being updated (e.g., 'Updates Claude Desktop to 1.2581.0, Connect Fonts to 28.1.1, and Dropbox to 248.4.3576').

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Update Fleet-maintained apps' clearly and concisely summarizes the main change—updating metadata for multiple Fleet-maintained applications to newer versions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fma-2604141957

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

ee/maintained-apps/outputs/claude/darwin.json (1)

12-12: Checksum field is updated, but installer integrity is still not enforced downstream.

Line 12 is correct in this manifest, but Fleet’s downloader path currently does not verify downloaded content against sha256, so this protection is metadata-only right now. Consider adding checksum validation in the installer download/apply flow.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@ee/maintained-apps/outputs/claude/darwin.json` at line 12, The manifest’s
"sha256" field is present but never enforced downstream; add checksum
verification to the installer download/apply flow by fetching the expected
"sha256" from the manifest and computing the SHA-256 of the downloaded
installer, then compare and abort on mismatch. Implement a helper like
verifyInstallerChecksum(downloadedBytes, expectedSha256) and call it from the
downloader function (e.g., downloadInstaller) before calling applyInstaller or
any install/apply step, logging and failing the operation when the computed
checksum != manifest "sha256".

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@ee/maintained-apps/outputs/claude/darwin.json`:
- Line 12: The manifest’s "sha256" field is present but never enforced
downstream; add checksum verification to the installer download/apply flow by
fetching the expected "sha256" from the manifest and computing the SHA-256 of
the downloaded installer, then compare and abort on mismatch. Implement a helper
like verifyInstallerChecksum(downloadedBytes, expectedSha256) and call it from
the downloader function (e.g., downloadInstaller) before calling applyInstaller
or any install/apply step, logging and failing the operation when the computed
checksum != manifest "sha256".

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ce49b401-c64d-44d6-ac5b-bd96ae25f6aa

📥 Commits

Reviewing files that changed from the base of the PR and between 86b5eaf and 1677fe0.

📒 Files selected for processing (3)

• ee/maintained-apps/outputs/claude/darwin.json
• ee/maintained-apps/outputs/connect-fonts/darwin.json
• ee/maintained-apps/outputs/dropbox/darwin.json

[github-actions]

Closing in favor of #43579.