diff --git a/ee/maintained-apps/outputs/microsoft-teams/darwin.json b/ee/maintained-apps/outputs/microsoft-teams/darwin.json
index 4bbbbcab94a..22135c0d1ad 100644
--- a/ee/maintained-apps/outputs/microsoft-teams/darwin.json
+++ b/ee/maintained-apps/outputs/microsoft-teams/darwin.json
@@ -1,15 +1,15 @@
 {
   "versions": [
     {
-      "version": "26072.608.4595.8484",
+      "version": "26093.311.4599.3126",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.teams2';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.teams2' AND version_compare(bundle_short_version, '26072.608.4595.8484') < 0);"
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.teams2' AND version_compare(bundle_short_version, '26093.311.4599.3126') < 0);"
       },
-      "installer_url": "https://statics.teams.cdn.office.net/production-osx/26072.608.4595.8484/MicrosoftTeams.pkg",
+      "installer_url": "https://statics.teams.cdn.office.net/production-osx/26093.311.4599.3126/MicrosoftTeams.pkg",
       "install_script_ref": "f3b736a4",
       "uninstall_script_ref": "e0dfc909",
-      "sha256": "24f75f9884416e726ce31e964758b3625e8d5d714aa05f175bcd75c2345172ee",
+      "sha256": "15c7b72ff51da883173d140985cc1edbd9538290d5846b14a7ead03fcf65d6ef",
       "default_categories": [
         "Communication"
       ]
diff --git a/ee/maintained-apps/outputs/teleport-connect/darwin.json b/ee/maintained-apps/outputs/teleport-connect/darwin.json
index 4762c18f23e..ec83727d91b 100644
--- a/ee/maintained-apps/outputs/teleport-connect/darwin.json
+++ b/ee/maintained-apps/outputs/teleport-connect/darwin.json
@@ -1,15 +1,15 @@
 {
   "versions": [
     {
-      "version": "18.7.5",
+      "version": "18.7.6",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'gravitational.teleport.connect';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'gravitational.teleport.connect' AND version_compare(bundle_short_version, '18.7.5') < 0);"
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'gravitational.teleport.connect' AND version_compare(bundle_short_version, '18.7.6') < 0);"
       },
-      "installer_url": "https://cdn.teleport.dev/Teleport%20Connect-18.7.5.dmg",
+      "installer_url": "https://cdn.teleport.dev/Teleport%20Connect-18.7.6.dmg",
       "install_script_ref": "e5ce8979",
       "uninstall_script_ref": "b6540188",
-      "sha256": "0d980dc9b6a7892da7ec2a70e0dcf4f5b3b33bbbef3596bd81c9a1966b646e7f",
+      "sha256": "34fb47cbc3fa4a698c5239b49ba4037e133ead40cd22f35d12e3d1d840d7a296",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/teleport-suite/darwin.json b/ee/maintained-apps/outputs/teleport-suite/darwin.json
index f95d7010bf3..29e44bc573e 100644
--- a/ee/maintained-apps/outputs/teleport-suite/darwin.json
+++ b/ee/maintained-apps/outputs/teleport-suite/darwin.json
@@ -1,22 +1,22 @@
 {
   "versions": [
     {
-      "version": "18.7.5",
+      "version": "18.7.6",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.gravitational.teleport.tsh';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.gravitational.teleport.tsh' AND version_compare(bundle_short_version, '18.7.5') < 0);"
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.gravitational.teleport.tsh' AND version_compare(bundle_short_version, '18.7.6') < 0);"
       },
-      "installer_url": "https://cdn.teleport.dev/teleport-18.7.5.pkg",
-      "install_script_ref": "35762c86",
+      "installer_url": "https://cdn.teleport.dev/teleport-18.7.6.pkg",
+      "install_script_ref": "2c7e3ed1",
       "uninstall_script_ref": "42474e69",
-      "sha256": "f842b32f8dd1ee7a3ac923028be6c50cdf69df19c834481008f4b9b1dc57ffeb",
+      "sha256": "a7fe57ea1633d25a879126076845c1604ccf47e8982c062d8b172ee72ab5c2ad",
       "default_categories": [
         "Developer tools"
       ]
     }
   ],
   "refs": {
-    "35762c86": "#!/bin/sh\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.gravitational.teleport.tsh'\nsudo installer -pkg \"$TMPDIR/teleport-18.7.5.pkg\" -target /\nrelaunch_application 'com.gravitational.teleport.tsh'\n",
+    "2c7e3ed1": "#!/bin/sh\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.gravitational.teleport.tsh'\nsudo installer -pkg \"$TMPDIR/teleport-18.7.6.pkg\" -target /\nrelaunch_application 'com.gravitational.teleport.tsh'\n",
     "42474e69": "#!/bin/sh\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    # Convert (.*) to .* for regex matching to handle patterns like (.*).com.example.app\n    local regex_pattern=$(echo \"$prefix\" | sed 's/(\\.\\*)/.*/g')\n    echo \"Expanding wildcard for PKGID: $PKGID (pattern: ^${regex_pattern})\"\n    for receipt in $(pkgutil --pkgs | grep -E \"^${regex_pattern}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\n# Remove teleport-suite packages (handles wildcard patterns with (.*))\nremove_pkg_files '(.*).com.gravitational.teleport.tctl'\nforget_pkg '(.*).com.gravitational.teleport.tctl'\nremove_pkg_files '(.*).com.gravitational.teleport.tsh'\nforget_pkg '(.*).com.gravitational.teleport.tsh'\nremove_pkg_files 'com.gravitational.teleport'\nforget_pkg 'com.gravitational.teleport'\n\n# Explicitly remove apps from /Applications (in case pkgutil removal didn't catch them)\nsudo rm -rf '/Applications/tctl.app'\nsudo rm -rf '/Applications/tsh.app'\n\n# Remove binaries\nsudo rm -rf '/usr/local/bin/fdpass-teleport'\nsudo rm -rf '/usr/local/bin/tbot'\nsudo rm -rf '/usr/local/bin/tctl'\nsudo rm -rf '/usr/local/bin/teleport'\nsudo rm -rf '/usr/local/bin/tsh'\n\n# Remove user data\ntrash $LOGGED_IN_USER '~/.tsh'\n\n"
   }
 }
diff --git a/ee/maintained-apps/outputs/zotero/darwin.json b/ee/maintained-apps/outputs/zotero/darwin.json
index e8fea4c2ffa..600791ba81a 100644
--- a/ee/maintained-apps/outputs/zotero/darwin.json
+++ b/ee/maintained-apps/outputs/zotero/darwin.json
@@ -1,15 +1,15 @@
 {
   "versions": [
     {
-      "version": "9.0.1",
+      "version": "9.0.2",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'org.zotero.zotero';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'org.zotero.zotero' AND version_compare(bundle_short_version, '9.0.1') < 0);"
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'org.zotero.zotero' AND version_compare(bundle_short_version, '9.0.2') < 0);"
       },
-      "installer_url": "https://download.zotero.org/client/release/9.0.1/Zotero-9.0.1.dmg",
+      "installer_url": "https://download.zotero.org/client/release/9.0.2/Zotero-9.0.2.dmg",
       "install_script_ref": "ced4f343",
       "uninstall_script_ref": "24de4c91",
-      "sha256": "c7dce69eea9d837d7ed5f0a3462059f943bdaa6c5a561c0113a723b390871711",
+      "sha256": "02d03b147677d1ced823d9b196ff7107f5a77c42874ce2e48d3a6ce8dc3ed64a",
       "default_categories": [
         "Productivity"
       ]