Update Fleet-maintained apps - #44498
Conversation
Generated automatically with cmd/maintained-apps.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
GitHub Actions
Failure
CI Feedback 🧐A test triggered by this PR failed. Here is an AI-generated analysis of the failure:
|
WalkthroughThis pull request updates version information for two maintained application entries. The Google Drive Windows installer is bumped from version 123.0.1.0 to 124.0.3.0, including updates to the installer URL, SHA256 checksum, and the patched detection query. The NordPass macOS entry is updated from version 7.6.18 to 7.6.20 with a corresponding update to the version comparison threshold in the patched detection query. Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@ee/maintained-apps/outputs/nordpass/darwin.json`:
- Line 4: The committed darwin.json contains an unverified version string
("version": "7.6.20"); revert this change or restore the previously verified
version (e.g., "7.5") in the "version" field and do not merge until the release
is validated. To fix, replace the "version": "7.6.20" entry in
ee/maintained-apps/outputs/nordpass/darwin.json with the confirmed release
version, and/or remove the automated bump; then verify the installer URL,
release notes, and cryptographic signature/checksum for that version before
applying any update. Ensure the JSON "version" key is the only edited token for
this change and add a short commit message noting verification steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 7a8c7e25-4ed4-4525-8a51-dbfb82db85e8
📒 Files selected for processing (2)
ee/maintained-apps/outputs/google-drive/windows.jsonee/maintained-apps/outputs/nordpass/darwin.json
| "versions": [ | ||
| { | ||
| "version": "7.6.18", | ||
| "version": "7.6.20", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify the NordPass installer URL is accessible and check for security advisories
# Check if the installer URL is accessible
echo "Checking installer URL accessibility..."
curl -I -L "https://downloads.npass.app/mac/arm/NordPass.dmg" 2>&1 | head -20
# Note: Cannot verify actual version from DMG without downloading and mounting
echo -e "\n---\nNote: Actual version verification requires downloading and inspecting the DMG file"Repository: fleetdm/fleet
Length of output: 1304
🌐 Web query:
NordPass version 7.6.20 release date and changelog
💡 Result:
No evidence found of a NordPass version 7.6.20 release. Official NordPass desktop release notes list up to version 7.5 as the latest (as of April 13, 2026). Browser extensions reach up to 7.3.12 (Firefox, Jan 19, 2026) and Chrome at 7.5.6 (March 23, 2026). Mac App Store versions are around 7.2.x (Dec 2025). Android tops at 5.11. No mentions of 7.6.20 or its changelog in official sources, app stores, or web searches. It may be an unreleased future version, a misremembered number, or specific to an unindexed platform/build.
Citations:
- 1: https://nordpass.com/blog/desktop-app-update-notes/
- 2: https://www.nordpass.com/blog/category/release-notes/
- 3: https://nordpass.com/blog/nordpass-android-update-notes/
- 4: https://chromewebstore.google.com/detail/nordpass%C2%AE-password-manage/eiaeiblijfjekdanodkjadfinkhbfgcd
- 5: https://addons.mozilla.org/en-US/firefox/addon/nordpass-password-management/versions/
- 6: https://macupdater.com/app_updates/appinfo/com.nordpass.safari.app.password.manager/index.html
- 7: https://apps.apple.com/ca/app/nordpass-password-manager/id6443917910?mt=12
🌐 Web query:
NordPass security advisories vulnerabilities 2026
💡 Result:
I couldn’t find any NordPass-issued “security advisory” page or CVE list specifically covering 2026 vulnerabilities. The best authoritative, NordPass-owned security/vulnerability information that surfaced in research is: 1) NordPass Windows Hello integration “vulnerability” mitigation (NordPass Support article) - NordPass states there is a security concern in the integration between NordPass and Windows Hello that “under specific circumstances, could allow attackers to get unauthorized access to a user’s NordPass vault without providing their Master Password.” - NordPass advises mitigation steps until a fix is fully implemented: switch to the NordPass standalone extension and/or temporarily disable the “Unlock with Windows Hello” feature in the NordPass desktop app. 2) DOM-based extension clickjacking affecting NordPass browser extension (external researcher/press coverage) - A third-party security post about “DOM-based Extension Clickjacking” reports that NordPass was among the password managers affected, and that it was “Patched” (i.e., NordPass fixed it) according to the post. 3) Other NordPass vulnerability-type reports found in research but not clearly “2026 security advisories” - A 2025 third-party write-up claims a NordPass issue related to credit card data exposure in memory; however, it does not appear to be an official NordPass advisory. - Wikipedia summarizes older NordPass vulnerability discussions (2024 injection-attacks; 2025 clickjacking), but it’s not an official advisory source. If you want, tell me whether you want only (a) NordPass official advisories/support articles and (b) items disclosed in calendar year 2026. With that constraint, I’ll re-run targeted searches specifically for 2026-dated NordPass security advisories/release-note entries that mention security fixes.
Citations:
- 1: https://support.nordpass.com/hc/en-us/articles/21596712224785-How-to-avoid-the-Windows-Hello-vulnerability
- 2: https://nudgesecurity.com/post/dom-based-extension-clickjacking-vulnerabilities-in-popular-browser-extensions
- 3: https://venaksecurity.com/2025/01/06/nordpass-password-manager-vulnerability-unsecured-credit-card-data-at-risk/
- 4: https://en.wikipedia.org/wiki/NordPass
Version 7.6.20 does not appear to exist in official NordPass releases and should not be committed.
Official NordPass release notes list version 7.5 as the latest desktop version (as of April 13, 2026). No evidence of version 7.6.20 exists in official sources, app stores, or public releases. The installer URL is accessible but cannot be verified to serve this version. Do not merge this automated update until verifying the source and validity of version 7.6.20.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@ee/maintained-apps/outputs/nordpass/darwin.json` at line 4, The committed
darwin.json contains an unverified version string ("version": "7.6.20"); revert
this change or restore the previously verified version (e.g., "7.5") in the
"version" field and do not merge until the release is validated. To fix, replace
the "version": "7.6.20" entry in ee/maintained-apps/outputs/nordpass/darwin.json
with the confirmed release version, and/or remove the automated bump; then
verify the installer URL, release notes, and cryptographic signature/checksum
for that version before applying any update. Ensure the JSON "version" key is
the only edited token for this change and add a short commit message noting
verification steps.
2 participants
Automated ingestion of latest Fleet-maintained app data.
Summary by CodeRabbit