Skip to content

Update Fleet-maintained apps #44498

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
allenhouchins merged 1 commit into from
Apr 30, 2026
Merged

Update Fleet-maintained apps #44498

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions ee/maintained-apps/outputs/google-drive/windows.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
{
"versions": [
{
"version": "123.0.1.0",
"version": "124.0.3.0",
"queries": {
"exists": "SELECT 1 FROM programs WHERE name = 'Google Drive' AND publisher = 'Google LLC';",
"patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Google Drive' AND publisher = 'Google LLC' AND version_compare(version, '123.0.1.0') < 0);"
"patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Google Drive' AND publisher = 'Google LLC' AND version_compare(version, '124.0.3.0') < 0);"
},
"installer_url": "https://dl.google.com/release2/drive-file-stream/i7uoko2jcsgfv6ozjykgzu6ixe_123.0.1.0/setup.exe",
"installer_url": "https://dl.google.com/release2/drive-file-stream/ad3gkahhztgqrnd7u3npfpvue3ba_124.0.3.0/setup.exe",
"install_script_ref": "fa36b892",
"uninstall_script_ref": "785a96b9",
"sha256": "97b68598375724779c966a3c13223819c1ee40309cd1973d0cfea7744796c1a7",
"sha256": "c770d2dd4a81182e41e0e134162c5393663f359c638a7df5e247cf5d1fd72ad7",
"default_categories": [
"Productivity"
]
Expand Down
4 changes: 2 additions & 2 deletions ee/maintained-apps/outputs/nordpass/darwin.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
{
"versions": [
{
"version": "7.6.18",
"version": "7.6.20",

@coderabbitai coderabbitai Bot Apr 30, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify the NordPass installer URL is accessible and check for security advisories

# Check if the installer URL is accessible
echo "Checking installer URL accessibility..."
curl -I -L "https://downloads.npass.app/mac/arm/NordPass.dmg" 2>&1 | head -20

# Note: Cannot verify actual version from DMG without downloading and mounting
echo -e "\n---\nNote: Actual version verification requires downloading and inspecting the DMG file"

Repository: fleetdm/fleet

Length of output: 1304

🌐 Web query:

NordPass version 7.6.20 release date and changelog

💡 Result:

No evidence found of a NordPass version 7.6.20 release. Official NordPass desktop release notes list up to version 7.5 as the latest (as of April 13, 2026). Browser extensions reach up to 7.3.12 (Firefox, Jan 19, 2026) and Chrome at 7.5.6 (March 23, 2026). Mac App Store versions are around 7.2.x (Dec 2025). Android tops at 5.11. No mentions of 7.6.20 or its changelog in official sources, app stores, or web searches. It may be an unreleased future version, a misremembered number, or specific to an unindexed platform/build.

Citations:

🌐 Web query:

NordPass security advisories vulnerabilities 2026

💡 Result:

I couldn’t find any NordPass-issued “security advisory” page or CVE list specifically covering 2026 vulnerabilities. The best authoritative, NordPass-owned security/vulnerability information that surfaced in research is: 1) NordPass Windows Hello integration “vulnerability” mitigation (NordPass Support article) - NordPass states there is a security concern in the integration between NordPass and Windows Hello that “under specific circumstances, could allow attackers to get unauthorized access to a user’s NordPass vault without providing their Master Password.” - NordPass advises mitigation steps until a fix is fully implemented: switch to the NordPass standalone extension and/or temporarily disable the “Unlock with Windows Hello” feature in the NordPass desktop app. 2) DOM-based extension clickjacking affecting NordPass browser extension (external researcher/press coverage) - A third-party security post about “DOM-based Extension Clickjacking” reports that NordPass was among the password managers affected, and that it was “Patched” (i.e., NordPass fixed it) according to the post. 3) Other NordPass vulnerability-type reports found in research but not clearly “2026 security advisories” - A 2025 third-party write-up claims a NordPass issue related to credit card data exposure in memory; however, it does not appear to be an official NordPass advisory. - Wikipedia summarizes older NordPass vulnerability discussions (2024 injection-attacks; 2025 clickjacking), but it’s not an official advisory source. If you want, tell me whether you want only (a) NordPass official advisories/support articles and (b) items disclosed in calendar year 2026. With that constraint, I’ll re-run targeted searches specifically for 2026-dated NordPass security advisories/release-note entries that mention security fixes.

Citations:

Version 7.6.20 does not appear to exist in official NordPass releases and should not be committed.

Official NordPass release notes list version 7.5 as the latest desktop version (as of April 13, 2026). No evidence of version 7.6.20 exists in official sources, app stores, or public releases. The installer URL is accessible but cannot be verified to serve this version. Do not merge this automated update until verifying the source and validity of version 7.6.20.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@ee/maintained-apps/outputs/nordpass/darwin.json` at line 4, The committed
darwin.json contains an unverified version string ("version": "7.6.20"); revert
this change or restore the previously verified version (e.g., "7.5") in the
"version" field and do not merge until the release is validated. To fix, replace
the "version": "7.6.20" entry in ee/maintained-apps/outputs/nordpass/darwin.json
with the confirmed release version, and/or remove the automated bump; then
verify the installer URL, release notes, and cryptographic signature/checksum
for that version before applying any update. Ensure the JSON "version" key is
the only edited token for this change and add a short commit message noting
verification steps.

"queries": {
"exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.nordsec.nordpass';",
"patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.nordsec.nordpass' AND version_compare(bundle_short_version, '7.6.18') < 0);"
"patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.nordsec.nordpass' AND version_compare(bundle_short_version, '7.6.20') < 0);"
},
"installer_url": "https://downloads.npass.app/mac/arm/NordPass.dmg",
"install_script_ref": "abc4bff7",
Expand Down
Loading