Update Fleet-maintained apps

[fleet-release]

Automated ingestion of latest Fleet-maintained app data.

Summary by CodeRabbit

• Chores
  • Updated maintained application metadata for CotEditor (6.2.6 → 7.0.0), GIMP (3.2.2/3.2.2.0 → 3.2.4/3.2.4.0), IINA (build artifact updated), OrbStack (2.0.5 → 2.1.0), Postman (12.6.8 → 12.7.0), and RapidAPI (4.5.4 → 4.5.5) including installer references and integrity verification data.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[coderabbitai]

Walkthrough

This PR updates maintained app metadata for eight applications and their platform variants in the ee/maintained-apps/outputs directory. Version numbers are incremented for CotEditor (6.2.6→7.0.0), GIMP (3.2.2→3.2.4 on macOS, 3.2.2.0→3.2.4.0 on Windows), OrbStack (2.0.5→2.1.0), Postman (12.6.8→12.7.0 on both macOS and Windows), and RapidAPI (4.5.4→4.5.5). For each update, the version comparison threshold in patched detection queries, installer download URLs, and SHA256 checksums are revised accordingly. IINA's macOS installer reference is updated to include a build number.

Possibly related PRs

• Update Fleet-maintained apps #43404: Updates identical Postman maintained-app JSON metadata for both darwin and windows platforms with version and installer URL changes.
• Update Fleet-maintained apps #43739: Modifies the IINA darwin.json maintained-app file with updates to installer URL and SHA256 checksum.
• Update Fleet-maintained apps #43662: Updates multiple Fleet maintained-app JSON entries with version, patched query, installer URL, and SHA256 modifications across different applications.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The PR description 'Automated ingestion of latest Fleet-maintained app data' is vague and generic, using non-descriptive terms that don't convey specific details about which apps were updated, what versions, or what changed.	Provide more specifics in the description, such as: which apps were updated (CotEditor, GIMP, IINA, OrbStack, Postman, RapidAPI), their old and new versions, and the nature of changes (version bumps, URL/checksum updates).

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Update Fleet-maintained apps' directly describes the main change: updating version metadata and installer URLs for 8 Fleet-maintained applications across multiple platforms.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fma-2604201242

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@ee/maintained-apps/outputs/iina/darwin.json`:
- Around line 9-12: The manifest uses only bundle_short_version ('1.4.2') which
will treat any 1.4.2 build as patched; update the Darwin manifest to perform
build-aware detection by adding a check against the bundle version/build
(CFBundleVersion) in addition to bundle_short_version so only machines with
CFBundleVersion matching the build in installer_url (build164) are considered
patched; locate the fields installer_url and sha256 and add or set the
corresponding bundle_version (or bundle_build) matcher to the exact build number
(164) used in IINA.v1.4.2-build164.dmg and ensure the query logic that
references bundle_short_version also checks this new bundle_version field.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a53bf159-4e1e-4a2e-b9f5-05d28690ed32

📥 Commits

Reviewing files that changed from the base of the PR and between 85552a1 and f9a4796.

📒 Files selected for processing (8)

• ee/maintained-apps/outputs/coteditor/darwin.json
• ee/maintained-apps/outputs/gimp/darwin.json
• ee/maintained-apps/outputs/gimp/windows.json
• ee/maintained-apps/outputs/iina/darwin.json
• ee/maintained-apps/outputs/orbstack/darwin.json
• ee/maintained-apps/outputs/postman/darwin.json
• ee/maintained-apps/outputs/postman/windows.json
• ee/maintained-apps/outputs/rapidapi/darwin.json

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify whether Fleet manifests or schema support build-aware detection for macOS apps.

# 1) Check if iina manifest has any build-aware query patterns beyond bundle_short_version.
rg -n -C3 --iglob '*iina*darwin.json' 'patched|bundle_short_version|bundle_version|build'

# 2) Look for maintained app manifests that use bundle_version (or similar) in patched queries.
rg -n -C2 'version_compare\(bundle_version|bundle_version|build' ee/maintained-apps/outputs

# 3) Inspect app inventory columns referenced by maintained app SQL queries.
rg -n -C3 'CREATE TABLE apps|bundle_short_version|bundle_version' server ee

Repository: fleetdm/fleet

Length of output: 50536

---

Build-level detection not supported in patch query; version-only comparison creates upgrade risk.

The patched query uses bundle_short_version = '1.4.2' only. Since IINA.v1.4.2-build164.dmg specifies a particular build, any machine with an older 1.4.2 build will be marked as patched and not offered the upgrade to build164. All examined maintained app manifests on Darwin follow this pattern, with no build-aware detection in use.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@ee/maintained-apps/outputs/iina/darwin.json` around lines 9 - 12, The
manifest uses only bundle_short_version ('1.4.2') which will treat any 1.4.2
build as patched; update the Darwin manifest to perform build-aware detection by
adding a check against the bundle version/build (CFBundleVersion) in addition to
bundle_short_version so only machines with CFBundleVersion matching the build in
installer_url (build164) are considered patched; locate the fields installer_url
and sha256 and add or set the corresponding bundle_version (or bundle_build)
matcher to the exact build number (164) used in IINA.v1.4.2-build164.dmg and
ensure the query logic that references bundle_short_version also checks this new
bundle_version field.